Branch was auto-updated.

detections/endpoint/windows_diskcryptor_usage.yml

@@ -0,0 +1,83 @@
+name: Windows DiskCryptor Usage
+id: d56fe0c8-4650-11ec-a8fa-acde48001122
+version: 1
+date: '2021-11-15'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic identifies DiskCryptor  process name of dcrypt.exe
+  or internal name dcinst.exe. This utility has been utilized by adversaries to encrypt
+  disks manually during an operation. In addition, during install, a dcrypt.sys driver
+  is installed and requires a reboot in order to take effect. There are no command-line
+  arguments used.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dcrypt.exe"
+  OR Processes.original_file_name=dcinst.exe) by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_diskcryptor_usage_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: It is possible false positives may be present based on the
+  internal name dcinst.exe, filter as needed. It may be worthy to alert on the service
+  name.
+references:
+- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
+- https://github.com/DavidXanatos/DiskCryptor
+tags:
+  analytic_story:
+  - Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/dcrypt/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1486
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 70
+  confidence: 50
+  risk_score: 35
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to encrypt disks.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/windows_installutil_credential_theft.yml

@@ -0,0 +1,91 @@
+name: Windows InstallUtil Credential Theft
+id: ccfeddec-43ec-11ec-b494-acde48001122
+version: 1
+date: '2021-11-12'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following analytic identifies the Windows InstallUtil.exe binary
+  loading `vaultcli.dll` and Samlib.dll`. This technique may be used to execute code
+  to bypassing application control and capture credentials by utilizing a tool like
+  MimiKatz. \
+
+  When `InstallUtil.exe` is used in a malicous manner, the path to an executable on
+  the filesystem is typically specified. Take note of the parent process. In a suspicious
+  instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe`
+  or `Explorer.exe`. \
+
+  If used by a developer, typically this will be found with multiple command-line
+  switches/arguments and spawn from Visual Studio. \
+
+  During triage review resulting network connections, file modifications, and parallel
+  processes. Capture any artifacts and review further.'
+search: '`sysmon` EventCode=7  process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll",
+  "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime
+  by Computer, process_name, ImageLoaded, OriginalFileName, process_id | rename Computer
+  as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_installutil_credential_theft_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and module loads from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: Typically this will not trigger as by it's very nature InstallUtil
+  does not need credentials. Filter as needed.
+references:
+- https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0
+tags:
+  analytic_story:
+  - Signed Binary Proxy Execution InstallUtil
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1218.004
+  - T1218
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ loading samlib.dll and vaultcli.dll to potentially
+    capture credentials in memory.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/windows_installutil_remote_network_connection.yml

@@ -0,0 +1,99 @@
+name: Windows InstallUtil Remote Network Connection
+id: 4fbf9270-43da-11ec-9486-acde48001122
+version: 1
+date: '2021-11-12'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following analytic identifies the Windows InstallUtil.exe binary
+  making a remote network connection. This technique may be used to download and execute
+  code while bypassing application control. \
+
+  When `InstallUtil.exe` is used in a malicous manner, the path to an executable on
+  the filesystem is typically specified. Take note of the parent process. In a suspicious
+  instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe`
+  or `Explorer.exe`. \
+
+  If used by a developer, typically this will be found with multiple command-line
+  switches/arguments and spawn from Visual Studio. \
+
+  During triage review resulting network connections, file modifications, and parallel
+  processes. Capture any artifacts and review further.'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where `process_installutil` by _time span=1h  Processes.process_guid Processes.process_name
+  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | join  process_guid [ | tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid
+  Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename  dest as connection_to_CNC]
+  | table _time dest parent_process_name process_name process_path process process_guid
+  connection_to_CNC dest_port | `windows_installutil_remote_network_connection_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node.
+  In addition, confirm the latest CIM App 4.20 or higher is installed and the latest
+  TA for the endpoint product.
+known_false_positives: Limited false positives should be present as InstallUtil is
+  not typically used to download remote files. Filter as needed based on Developers
+  requirements.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
+tags:
+  analytic_story:
+  - Signed Binary Proxy Execution InstallUtil
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1218.004
+  - T1218
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Ports.process_guid
+  - Ports.dest
+  - Ports.dest_port
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ generating a remote download.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/windows_installutil_uninstall_option.yml

@@ -0,0 +1,98 @@
+name: Windows InstallUtil Uninstall Option
+id: cfa7b9ac-43f0-11ec-9b48-acde48001122
+version: 1
+date: '2021-11-12'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following analytic identifies the Windows InstallUtil.exe binary.
+  This will execute code while bypassing application control using the `/u` (uninstall)
+  switch. \
+
+  InstallUtil uses the functions install and uninstall within the System.Configuration.Install
+  namespace to process .net assembly. Install function requires admin privileges,
+  however, uninstall function can be run as an unprivileged user.\
+
+  When `InstallUtil.exe` is used in a malicous manner, the path to an executable on
+  the filesystem is typically specified. Take note of the parent process. In a suspicious
+  instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe`
+  or `Explorer.exe`. \
+
+  If used by a developer, typically this will be found with multiple command-line
+  switches/arguments and spawn from Visual Studio. \
+
+  During triage review resulting network connections, file modifications, and parallel
+  processes. Capture any artifacts and review further.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_installutil` Processes.process
+  IN ("*/u*", "*uninstall*") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_installutil_uninstall_option_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Limited false positives should be present. Filter as needed
+  by parent process or application.
+references:
+- https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12
+- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
+tags:
+  analytic_story:
+  - Signed Binary Proxy Execution InstallUtil
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1218.004
+  - T1218
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ performing an uninstall.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/windows_installutil_uninstall_option_with_network.yml

@@ -0,0 +1,106 @@
+name: Windows InstallUtil Uninstall Option with Network
+id: 1a52c836-43ef-11ec-a36c-acde48001122
+version: 1
+date: '2021-11-12'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following analytic identifies the Windows InstallUtil.exe binary
+  making a remote network connection. This technique may be used to download and execute
+  code while bypassing application control using the `/u` (uninstall) switch. \
+
+  InstallUtil uses the functions install and uninstall within the System.Configuration.Install
+  namespace to process .net assembly. Install function requires admin privileges,
+  however, uninstall function can be run as an unprivileged user.\
+
+  When `InstallUtil.exe` is used in a malicous manner, the path to an executable on
+  the filesystem is typically specified. Take note of the parent process. In a suspicious
+  instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe`
+  or `Explorer.exe`. \
+
+  If used by a developer, typically this will be found with multiple command-line
+  switches/arguments and spawn from Visual Studio. \
+
+  During triage review resulting network connections, file modifications, and parallel
+  processes. Capture any artifacts and review further.'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time
+  span=1h  Processes.process_guid Processes.process_name Processes.dest Processes.process_path
+  Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join  process_guid
+  [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports
+  where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)`
+  | rename  dest as connection_to_CNC] | table _time dest parent_process_name process_name
+  original_file_name process_path process process_guid connection_to_CNC dest_port
+  | `windows_installutil_uninstall_option_with_network_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node.
+  In addition, confirm the latest CIM App 4.20 or higher is installed and the latest
+  TA for the endpoint product.
+known_false_positives: Limited false positives should be present as InstallUtil is
+  not typically used to download remote files. Filter as needed based on Developers
+  requirements.
+references:
+- https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12
+- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
+tags:
+  analytic_story:
+  - Signed Binary Proxy Execution InstallUtil
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1218.004
+  - T1218
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Ports.process_guid
+  - Ports.dest
+  - Ports.dest_port
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ performing an uninstall.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/windows_installutil_url_in_command_line.yml

@@ -0,0 +1,94 @@
+name: Windows InstallUtil URL in Command Line
+id: 28e06670-43df-11ec-a569-acde48001122
+version: 1
+date: '2021-11-12'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following analytic identifies the Windows InstallUtil.exe binary
+  passing a HTTP request on the command-line. This technique may be used to download
+  and execute code while bypassing application control. \
+
+  When `InstallUtil.exe` is used in a malicous manner, the path to an executable on
+  the filesystem is typically specified. Take note of the parent process. In a suspicious
+  instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe`
+  or `Explorer.exe`. \
+
+  If used by a developer, typically this will be found with multiple command-line
+  switches/arguments and spawn from Visual Studio. \
+
+  During triage review resulting network connections, file modifications, and parallel
+  processes. Capture any artifacts and review further.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_installutil` Processes.process
+  IN ("*http://*","*https://*") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_installutil_url_in_command_line_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Limited false positives should be present as InstallUtil is
+  not typically used to download remote files. Filter as needed based on Developers
+  requirements.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
+- https://gist.github.com/DanielRTeixeira/0fd06ec8f041f34a32bf5623c6dd479d
+tags:
+  analytic_story:
+  - Signed Binary Proxy Execution InstallUtil
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1218.004
+  - T1218
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ passing a URL on the command-line.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/wmic_xsl_execution_via_url.yml

@@ -0,0 +1,86 @@
+name: WMIC XSL Execution via URL
+id: 787e9dd0-4328-11ec-a029-acde48001122
+version: 1
+date: '2021-11-11'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible
+  Stylesheet Language) script. This originally was identified by Casey Smith, dubbed
+  Squiblytwo, as an application control bypass. Many adversaries will utilize this
+  technique to invoke JScript or VBScript within an XSL file. This technique can also
+  execute local/remote scripts and, similar to its Regsvr32 "Squiblydoo" counterpart,
+  leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in Windows
+  Management Instrumentation provided they utilize the /FORMAT switch. Upon identifying
+  a suspicious execution, review for confirmed network connnection and script download.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process
+  IN ("*http://*", "*https://*") Processes.process="*/format:*" by Processes.parent_process_name
+  Processes.original_file_name Processes.parent_process Processes.process_name Processes.process_id
+  Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmic_xsl_execution_via_url_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives are limited as legitimate applications typically
+  do not download files or xsl using WMIC. Filter as needed.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md
+- https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-4---wmic-bypass-using-remote-xsl-file
+tags:
+  analytic_story:
+  - Suspicious WMI Use
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1220/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1220
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ utilizing wmic to download a remote XSL script.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/xsl_script_execution_with_wmic.yml

@@ -12,7 +12,7 @@ description: This search is to detect a suspicious wmic.exe process or renamed w
   This TTP is really a good indicator for you to hunt further for FIN7 or other attacker
   that known to used this technique.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process = "*os get*"
+  as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process = "*os get*"
   Processes.process="*/format:*" Processes.process = "*.xsl*" by Processes.parent_process_name
   Processes.parent_process Processes.process_name Processes.process_id Processes.process
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
@@ -25,32 +25,42 @@ known_false_positives: unknown
 references:
 - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
 - https://attack.mitre.org/groups/G0046/
+- https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-3---wmic-bypass-using-local-xsl-file
 tags:
   analytic_story:
   - FIN7
+  - Suspicious WMI Use
   automated_detection_testing: passed
   confidence: 70
   context:
   - Source:Endpoint
-  - Stage:Execution
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: Process name $process_name$ with commandline $process$ to execute jscript
-    in $dest$
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to load a XSL script.
   mitre_attack_id:
   - T1220
   observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
   - name: user
     type: User
     role:
     - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/experimental/endpoint/exchange_powershell_module_usage.yml

@@ -33,6 +33,7 @@ references:
 - https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps
 - https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html
 - https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
+- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
 tags:
   analytic_story:
   - ProxyShell

lookups/attacker_tools.csv

@@ -23,4 +23,5 @@ Massscan_GUI.exe,This executable was delivered in the XMRig Crypto Miner
 KPortScan3.exe,This executable was delivered in the XMRig Crypto Miner and is commonly used by attackers to scan the internet
 NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Authentication. This tool allows attackers to detect Windows Servers with RDP without NLA enabled which facilitates the use of brute force non microsoft rdp tools or exploits
 ns.exe,A commonly used tool used by attackers to scan and map file shares
-SilverBullet.exe,Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts.
+SilverBullet.exe,Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts.
+kportscan3.exe, KPortScan 3.0 is a widely used port scanning tool on Hacking Forums, to perform network scanning on the internal networks.

macros/process_installutil.yml

@@ -0,0 +1,3 @@
+definition: (Processes.process_name=installutil.exe OR Processes.original_file_name=InstallUtil.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_installutil

stories/signed_binary_proxy_execution_installutil.yml

@@ -0,0 +1,28 @@
+name: Signed Binary Proxy Execution InstallUtil
+id: 9482a314-43dc-11ec-a3c9-acde48001122
+version: 1
+date: '2021-11-12'
+author: Michael Haag, Splunk
+description: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility.
+narrative: 'InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. InstallUtil is digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v\InstallUtil.exe. \
+
+  There are multiple ways to instantiate InstallUtil and they are all outlined within Atomic Red Team - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md. Two specific ways may be used and that includes invoking via  installer assembly class constructor through .NET and via InstallUtil.exe. \
+
+  Typically, adversaries will utilize the most commonly found way to invoke via InstallUtil Uninstall method. \
+
+  Note that parallel processes, and parent process, play a role in how InstallUtil is being used. In particular, a developer using InstallUtil will spawn from VisualStudio. Adversaries, will spawn from non-standard processes like Explorer.exe, cmd.exe or PowerShell.exe. It''s important to review the command-line to identify the DLL being loaded. \
+
+  Parallel processes may also include csc.exe being used to compile a local `.cs` file. This file will be the input to the output. Developers usually do not build direct on the command shell, therefore this should raise suspicion.'
+references:
+- https://attack.mitre.org/techniques/T1218/004/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
+tags:
+  analytic_story:
+  - Signed Binary Proxy Execution InstallUtil
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/windows_diskcryptor_usage.test.yml

@@ -0,0 +1,12 @@
+name: Windows DiskCryptor Usage Unit Test
+tests:
+- name: Windows DiskCryptor Usage
+  file: endpoint/windows_diskcryptor_usage.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/dcrypt/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_installutil_credential_theft.test.yml

@@ -0,0 +1,12 @@
+name: Windows InstallUtil Credential Theft Unit Test
+tests:
+- name: Windows InstallUtil Credential Theft
+  file: endpoint/windows_installutil_credential_theft.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_installutil_remote_network_connection.test.yml

@@ -0,0 +1,12 @@
+name: Windows InstallUtil Remote Network Connection Unit Test
+tests:
+- name: Windows InstallUtil Remote Network Connection
+  file: endpoint/windows_installutil_remote_network_connection.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_installutil_uninstall_option.test.yml

@@ -0,0 +1,12 @@
+name: Windows InstallUtil Uninstall Option Unit Test
+tests:
+- name: Windows InstallUtil Uninstall Option
+  file: endpoint/windows_installutil_uninstall_option.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_installutil_uninstall_option_with_network.test.yml

@@ -0,0 +1,12 @@
+name: Windows InstallUtil Uninstall Option with Network Unit Test
+tests:
+- name: Windows InstallUtil Uninstall Option with Network
+  file: endpoint/windows_installutil_uninstall_option_with_network.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_installutil_url_in_command_line.test.yml

@@ -0,0 +1,12 @@
+name: Windows InstallUtil URL in Command Line Unit Test
+tests:
+- name: Windows InstallUtil URL in Command Line
+  file: endpoint/windows_installutil_url_in_command_line.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/wmic_xsl_execution_via_url.test.yml

@@ -0,0 +1,12 @@
+name: WMIC XSL Execution via URL Unit Test
+tests:
+- name: WMIC XSL Execution via URL
+  file: endpoint/wmic_xsl_execution_via_url.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1220/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog