admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-07-24 14:12:31 -07:00
committed by GitHub
parent e942ada298 b133cf8888
commit db21cfe904
20 changed files with 191 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
+11 -5
View File
@@ -1,11 +1,13 @@
name: Allow File And Printing Sharing In Firewall
id: ce27646e-d411-11eb-8a00-acde48001122
version: 3
date: '2023-07-13'
version: 2
date: '2021-06-23'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic is designed to detect any suspicious modification of the firewall settings that enables file and printer sharing. This behavior is commonly seen in ransomware attacks, where the attackers attempt to discover more machines connected to the compromised host in order to encrypt more files. The analytic is implemented using a Splunk query that leverages the `Endpoint.Processes` datamodel and `process_netsh` to search for any processes related to firewall settings modifications. The query specifically looks for processes that contain the keywords "*firewall*", "*group="File and Printer Sharing"*", and "*enable=Yes*". If a true positive is found, it indicates that an attacker has attempted to modify the firewall settings to enable file and printer sharing, which could lead to data theft or further damage. Therefore, it is important for a SOC to identify this behavior and take immediate action to prevent any potential threats. In conclusion, this analytic is crucial for detecting any suspicious firewall settings modifications and helps SOC analysts to identify potential threats earlier, allowing them to take necessary measures to mitigate the risks.
description: This search is to detect a suspicious modification of firewall to allow
file and printer sharing. This technique was seen in ransomware to be able to discover
more machine connected to the compromised host to encrypt more files
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -15,7 +17,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `allow_file_and_printing_sharing_in_firewall_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: network admin may modify this firewall feature that may cause
this rule to be triggered.
references:
@@ -28,7 +34,7 @@ tags:
asset_type: Endpoint
confidence: 50
impact: 50
message: Suspicious modification of the firewall settings that enables file and printer sharing detected on $dest$
message: ''
mitre_attack_id:
- T1562.007
- T1562
detections/endpoint/allow_network_discovery_in_firewall.yml
+13 -6
View File
@@ -1,11 +1,14 @@
name: Allow Network Discovery In Firewall
id: ccd6a38c-d40b-11eb-85a5-acde48001122
version: 3
date: '2023-07-13'
version: 2
date: '2021-06-23'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic aims to detect suspicious modifications to the firewall that allow network discovery on a machine. This behavior is commonly used by ransomware, such as Revil and Reddot, to discover other machines connected to the compromised host and encrypt more files. The analytic is implemented using a Splunk query that utilizes the datamodel "Endpoint.Processes" and looks for processes that include the terms "*firewall*", "*group=\"Network Discovery\"*", "*enable*", and "*Yes*". The query counts the occurrences of these processes and provides information on the destination, user, parent process, process name, process ID, and parent process ID. Identifying this behavior is crucial for a SOC because it can indicate that an attacker is attempting to spread their attack across the network. If a true positive is detected, it suggests that the attacker has compromised the machine and is attempting to discover other machines to infect. The impact of the attack could result in the encryption of more files, data theft, or other malicious outcomes. To implement this analytic, ensure that you are collecting firewall logs and ingesting them into Splunk. It is important to note that legitimate uses of network discovery may cause false positives, so triage is necessary to confirm the activity is malicious. Upon triage, review the source of the process and investigate any relevant on-disk artifacts. Identifying this behavior early can help mitigate the risk of further damage and prevent the spread of the attack to other machines on the network.
description: This search is to detect a suspicious modification to the firewall to
allow network discovery on a machine. This technique was seen in couple of ransomware
(revil, reddot) to discover other machine connected to the compromised host to encrypt
more files.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -15,7 +18,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.original_file_name Processes.process_name Processes.process Processes.process_id
Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_network_discovery_in_firewall_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: network admin may modify this firewall feature that may cause
this rule to be triggered.
references:
@@ -29,7 +36,7 @@ tags:
asset_type: Endpoint
confidence: 50
impact: 50
message: Suspicious modifications to the firewall that allow network discovery detected on host $dest$
message: ''
mitre_attack_id:
- T1562.007
- T1562
@@ -55,7 +62,7 @@ tags:
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 25
risk_score: 25.0
security_domain: endpoint
tests:
- name: True Positive Test
detections/endpoint/attacker_tools_on_endpoint.yml
+9 -4
View File
@@ -1,11 +1,11 @@
name: Attacker Tools On Endpoint
id: a51bfe1a-94f0-48cc-b4e4-16a110145893
version: 3
date: '2023-07-13'
version: 2
date: '2021-11-04'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic is designed to detect the use of tools that are commonly exploited by cybercriminals. These tools are often associated with malicious activities such as unauthorized access, network scanning, or data exfiltration, posing a significant threat to an organization's security infrastructure. To identify these activities, the analytic examines the process activity on the host, specifically focusing on processes that are known to be associated with attacker tool names. By doing so, it acts as an early warning system for potential security incidents, allowing security operations teams to respond promptly. However, it's important to note that while this analytic is effective in detecting malicious behavior, it may also generate false positives due to legitimate administrative activities that may resemble malicious actions. Therefore, it is crucial for cyber analysts to have a comprehensive understanding of typical endpoint activities and behaviors within their organization. This knowledge enables them to accurately interpret and respond to the alerts generated by this analytic, ensuring a proper balance between precision and minimizing false positives. Overall, implementing this analytic provides organizations with enhanced visibility into potential security threats, enabling proactive detection and response to mitigate the risks associated with cybercriminal activities.
description: The following analytic aims to identify the use of tools commonly exploited by cybercriminals. The use of these tools often signals nefarious activities like unauthorized access, network scanning, or data exfiltration, representing a significant threat to an organization's security infrastructure. By examining process activity on the host, particularly those processes corresponding to known attacker tool names, this analytic serves as an early warning system for potential security incidents. However, its precision must be balanced with the understanding that some administrative activities might also trigger alerts, resulting in false positives. This underlines the importance of cyber analysts having a clear understanding of typical endpoint activities and behaviors within their organization, enabling them to accurately interpret and respond to these alerts.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -15,7 +15,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `drop_dm_object_name(Processes)` | lookup attacker_tools attacker_tool_names AS
process_name OUTPUT description | search description !=false| `attacker_tools_on_endpoint_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: To successfully implement this search, you must be ingesting data
that records process activity from your hosts to populate the endpoint data model
in the processes node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is usually generated via logs that report process tracking
in your Windows audit settings.
known_false_positives: Some administrator activity can be potentially triggered, please
add those users to the filter macro.
references: []
detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml
+8 -4
View File
@@ -1,11 +1,11 @@
name: Attempt To Add Certificate To Untrusted Store
id: 6bc5243e-ef36-45dc-9b12-f4a6be131159
version: 8
date: '2023-07-13'
version: 7
date: '2021-09-16'
author: Patrick Bareiss, Rico Valdez, Splunk
status: production
type: TTP
description: The identified behavior that this analytic detects is when a process attempts to add a certificate to the untrusted certificate store. This action is often associated with disabling security tools and is considered a potential security threat. The analytic focuses on process activities and command-line arguments related to the 'certutil -addstore' command. By monitoring and analyzing this data, the analytic can identify instances where this behavior occurs. Identifying this behavior is worth it for a Security Operations Center (SOC) because it can indicate potential malicious activities. Adding a certificate to the untrusted certificate store is often done by attackers to disable security tools and gain unauthorized access to a system. By detecting and investigating these instances, the SOC can take appropriate action to prevent further compromise and protect the organization's assets. If a true positive is detected, it suggests that an attacker is attempting to subvert the system's trust mechanisms and potentially disable security tools. The impact of such an attack can be severe, including unauthorized access, data theft, and potential compromise of the entire system or network. By identifying and responding to these threats promptly, the SOC can mitigate the risks and minimize the potential damage. It is important to note that there may be legitimate reasons for a process to add a certificate to the untrusted certificate store, such as system administration tasks. However, the value of this analytic lies in detecting isolated or unexpected instances of this behavior, which are indicative of potential malicious activities. In order to effectively implement this analytic, it is crucial to ingest data that records process activity and logs containing process names and command lines. This will provide the necessary information for the analytic to analyze and detect potential threats. Analysts should also be aware of the possibility of false positives and should conduct thorough triage and investigation before taking any action. Overall, this analytic helps cybersecurity analysts detect and respond to potential threats involving the misuse of system trust mechanisms. By understanding the importance of trust and its subversion in system security, analysts can better protect their organizations from malicious activities.
description: The following analytic is designed to detect potential security threats involving the misuse of system trust. It works by detecting events where a process attempts to add a certificate to the untrusted certificate store, an action often associated with disabling security tools. The analytic uses Sysmon Event ID 1 data source, particularly focusing on process activities and command-line arguments related to 'certutil -addstore'. It's essential to ingest data that records process activity and logs containing process names and command lines for its effective operation. Be aware, sometimes administrators might legitimately perform this action. The analytic's value lies in detecting isolated or unexpected instances, indicative of potential malicious activities. Cybersecurity analysts should understand the importance of trust mechanisms and their subversion in system security.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
@@ -14,7 +14,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
| `attempt_to_add_certificate_to_untrusted_store_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
known_false_positives: There may be legitimate reasons for administrators to add a
certificate to the untrusted certificate store. In such cases, this will typically
be done on a large number of systems.
detections/endpoint/attempt_to_stop_security_service.yml
+9 -4
View File
@@ -1,11 +1,12 @@
name: Attempt To Stop Security Service
id: c8e349c6-b97c-486e-8949-bd7bcd1f3910
version: 5
date: '2023-07-13'
version: 4
date: '2023-06-13'
author: Rico Valdez, Splunk
status: production
type: TTP
description: The following analytic detects attempts to stop security-related services on the endpoint. It is implemented using a Splunk query that searches for processes that involve the "sc.exe" command and include the phrase "stop" in their command. The query collects information such as the process name, process ID, parent process, user, destination, and timestamps. Identifying attempts to stop security-related services is crucial for a Security Operations Center (SOC) because it can indicate malicious activity or an attacker's attempt to disable security measures. If a true positive is found, it suggests that an attacker is actively trying to bypass or disable security controls, which can have severe consequences for the organization's security posture. The impact of such an attack can be significant, as it can lead to the compromise of the endpoint and potentially the entire network. Disabling security services can allow attackers to gain unauthorized access, exfiltrate sensitive data, or launch further attacks, such as malware installation or privilege escalation. To effectively respond to a true positive, SOC analysts should review the identified process and its associated details. They should also investigate any on-disk artifacts related to the process and look for concurrent processes to determine the source of the attack. This approach helps analysts detect and mitigate potential threats earlier, minimizing the impact on the organization's security. It's important to note that while this analytic is effective in detecting attempts to stop security services, there may be legitimate reasons for stopping these services in certain situations. Therefore, SOC analysts should exercise caution and consider the context of the activity before taking any action.
description: This search looks for attempts to stop security-related services on the
endpoint.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
@@ -16,7 +17,11 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|lookup security_services_lookup service as process OUTPUTNEW category, description
| search category=security | `attempt_to_stop_security_service_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: None identified. Attempts to disable security-related services
should be identified and understood.
references:
detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
+9 -4
View File
@@ -1,11 +1,12 @@
name: Attempted Credential Dump From Registry via Reg exe
id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911
version: 8
date: '2023-07-13'
version: 7
date: '2023-04-14'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects the execution of reg.exe with parameters that specify an export of keys containing hashed credentials that attackers may attempt to crack offline. This behavior is commonly used by attackers to dump and exfiltrate password hashes from the Windows Registry. The analytic leverages the datamodel=Endpoint.Processes and looks for processes with names containing "reg" or "cmd" and parameters containing "save" and specific registry keys related to security, SAM, and system. Identifying this behavior is crucial for a SOC as it can indicate that an attacker is attempting to escalate privileges or move laterally within the network. If a true positive is found, it suggests that an attacker has successfully obtained password hashes, which can be used to gain access to sensitive information, systems, and applications. To mitigate the risks associated with this attack, it is recommended to monitor for the execution of reg.exe with the specific parameters mentioned above. Upon detection, it is essential to investigate the source of the attack, review the registry keys accessed, and inspect any relevant on-disk artifacts to determine the scope of the attack. It is important to note that legitimate uses of reg.exe with the specified parameters may occur in the environment, leading to potential false positives. Therefore, it is crucial to understand the context of the activity and determine whether it is malicious or benign. Overall, monitoring for the execution of reg.exe with the specified parameters can help detect potential threats earlier and mitigate the risks associated with credential dumping attacks.
description: Monitor for execution of reg.exe with parameters specifying an export
of keys that contain hashed credentials that attackers may try to crack offline.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -17,7 +18,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `attempted_credential_dump_from_registry_via_reg_exe_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: None identified.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
+6 -3
View File
@@ -1,7 +1,7 @@
name: Bcdedit Command Back To Normal Mode Boot
id: dc7a8004-0f18-11ec-8c54-acde48001122
version: 2
date: '2023-07-14'
version: 1
date: '2021-09-06'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -19,7 +19,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
by Processes.process_name Processes.process Processes.parent_process_name Processes.dest
Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `bcdedit_command_back_to_normal_mode_boot_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives: unknown
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
detections/endpoint/bcdedit_failure_recovery_modification.yml
+8 -4
View File
@@ -1,11 +1,13 @@
name: BCDEdit Failure Recovery Modification
id: 809b31d2-5462-11eb-ae93-0242ac130002
version: 2
date: '2023-07-13'
version: 1
date: '2020-12-21'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic is designed to detect modifications made to the built-in Windows error recovery boot configurations by searching for flags passed to bcdedit.exe. This behavior is commonly used by ransomware to prevent recovery and further damage the system. The analytic is implemented using a Splunk query that utilizes the Endpoint.Processes datamodel. It counts the occurrences of bcdedit.exe processes that include the "*recoveryenabled*" flag and exclude the "*no*" flag, and groups them by process name, parent process name, destination, and user. Identifying this behavior is important for a SOC as it can indicate the presence of ransomware or other malicious activity that aims to disrupt recovery efforts and potentially cause further damage to the system. If a true positive is detected, it suggests that an attacker has already compromised the system and is attempting to prevent recovery, which can lead to data loss or other negative outcomes. To investigate a potential true positive, analysts should review the details of the process, such as the source and the user who initiated it. They should also inspect any relevant on-disk artifacts and monitor for any concurrent processes that may indicate the source of the attack. By detecting this behavior early, analysts can take action to prevent further damage and mitigate the risks associated with ransomware attacks.
description: This search looks for flags passed to bcdedit.exe modifications to the
built-in Windows error recovery boot configurations. This is typically used by ransomware
to prevent recovery.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -14,7 +16,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process Processes.parent_process_name Processes.dest Processes.user |
`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `bcdedit_failure_recovery_modification_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including parent-child relationships from your endpoints to populate the Endpoint
data model in the Processes node. Tune based on parent process names.
known_false_positives: Administrators may modify the boot configuration.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
detections/endpoint/certutil_exe_certificate_extraction.yml
+8 -4
View File
@@ -1,11 +1,13 @@
name: Certutil exe certificate extraction
id: 337a46be-600f-11eb-ae93-0242ac130002
version: 3
date: '2023-07-13'
version: 2
date: '2022-07-15'
author: Rod Soto, Splunk
status: production
type: TTP
description: The following analytic detects the manipulation or extraction of certificates using certutil.exe. Specifically, it looks for arguments passed to certutil.exe that indicate the extraction or manipulation of certificates. This behavior is worth identifying as it can be used to sign new authentication tokens, especially in federated environments such as Windows ADFS. The analytic is implemented using a Splunk query that searches for instances where certutil.exe is used with the "*-exportPFX*" argument. The query also captures information about the endpoint, user, parent process, process name, process ID, and parent process ID. If a true positive is found, it suggests that an attacker is attempting to extract certificates for malicious purposes, which could lead to unauthorized access and data theft. It is important for a SOC to identify this behavior early on to prevent further damage. To implement this analytic, ensure that you are ingesting endpoint process data into your SIEM solution. It is also important to be aware of potential false positives, as legitimate uses of certutil.exe may cause benign activities to be flagged. Upon triage, review the captured information to identify the source of the attack and take appropriate action to mitigate the risk.
description: This search looks for arguments to certutil.exe indicating the manipulation
or extraction of Certificate. This certificate can then be used to sign new authentication
tokens specially inside Federated environments such as Windows ADFS.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -14,7 +16,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `certutil_exe_certificate_extraction_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: Unless there are specific use cases, manipulating or exporting
certificates using certutil is uncommon. Extraction of certificate has been observed
during attacks such as Golden SAML and other campaigns targeting Federated services.
detections/endpoint/child_processes_of_spoolsv_exe.yml
+11 -4
View File
@@ -1,11 +1,14 @@
name: Child Processes of Spoolsv exe
id: aa0c4aeb-5b18-41c4-8c07-f1442d7599df
version: 4
date: '2023-07-13'
version: 3
date: '2023-04-14'
author: Rico Valdez, Splunk
status: experimental
type: TTP
description: The following analytic detects child processes of spoolsv.exe, which is the process associated with the Print Spooler service in Windows and typically runs as SYSTEM. This behavior is associated with a proof-of-concept privilege-escalation exploit linked to CVE-2018-8440. The purpose of this analytic is to identify any potential exploitation of this vulnerability in the environment. If a true positive is found, it suggests that an attacker is attempting to escalate privileges in the system, which could lead to further compromise of the system and potentially the entire network. Therefore, it is crucial for a SOC to identify this behavior as early as possible. To implement this analytic, ensure that you are ingesting endpoint process data and logs that contain information about spoolsv.exe and its child processes. Upon detection, investigate the child processes to determine their legitimacy and potential impact on the system. This approach helps analysts detect potential threats earlier and mitigate the risks associated with this vulnerability.
description: This search looks for child processes of spoolsv.exe. This activity is
associated with a POC privilege-escalation exploit associated with CVE-2018-8440.
Spoolsv.exe is the process associated with the Print Spooler service in Windows
and typically runs as SYSTEM.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
@@ -14,7 +17,11 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
AND Processes.process_name!=regsvr32.exe by Processes.dest Processes.parent_process
Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `child_processes_of_spoolsv_exe_filter` '
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including parent-child relationships from your endpoints to populate the Endpoint
data model in the Processes node. The command-line arguments are mapped to the "process"
field in the Endpoint data model. Update the `children_of_spoolsv_filter` macro
to filter out legitimate child processes spawned by spoolsv.exe.
known_false_positives: Some legitimate printer-related processes may show up as children
of spoolsv.exe. You should confirm that any activity as legitimate and may be added
as exclusions in the search.
detections/endpoint/common_ransomware_extensions.yml
+9 -4
View File
@@ -1,11 +1,12 @@
name: Common Ransomware Extensions
id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec
version: 6
date: '2023-07-13'
version: 5
date: '2022-11-10'
author: David Dorsey, Michael Haag, Splunk, Steven Dick
status: production
type: Hunting
description: The following analytic searches for file modifications that commonly occur with Ransomware. The analytic detects modifications to files with extensions that are commonly used by Ransomware. It does this by searching for changes in the datamodel=Endpoint.Filesystem, specifically modifications to file extensions that match those commonly used by Ransomware. Identifying this behavior is important for a Security Operations Center (SOC) because Ransomware is a common and dangerous type of malware that can cause significant damage to an organization's data and systems. If the search identifies a true positive, it suggests that an attacker is attempting to encrypt or otherwise modify files in the environment, potentially leading to data loss or other negative outcomes. To respond to a true positive, the SOC should investigate the affected system to determine the source of the modification and take appropriate action to contain and remediate the attack.
description: The search looks for file modifications with extensions commonly used
by Ransomware
data_source:
- Sysmon Event ID 11
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
@@ -17,7 +18,11 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_
path_count dc(file_name) as file_count latest(file_name) as file_name latest(true_file_path)
as file_path by dest file_extension | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
| `ransomware_extensions` | where path_count > 1 OR file_count > 20 | `common_ransomware_extensions_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, file path and file name. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Filesystem` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: 'You must be ingesting data that records the filesystem activity
from your hosts to populate the Endpoint Filesystem data model node. To see the
additional metadata, add the following fields, if not already present, please review
the detailed documentation on how to create a new field within Incident Review may
be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`'
known_false_positives: It is possible for a legitimate file with these extensions
to be created. If this is a true ransomware attack, there will be a large number
of files created with these extensions.
detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+9 -4
View File
@@ -1,11 +1,12 @@
name: Create local admin accounts using net exe
id: b89919ed-fe5f-492c-b139-151bb162040e
version: 7
date: '2023-07-13'
version: 6
date: '2021-09-08'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic detects the creation of local administrator accounts using the net.exe command. It uses a Splunk query to search for processes with the name net.exe or net1.exe that include the "/add" parameter and have specific keywords related to administrator accounts in their process name. This behavior is worth identifying for a Security Operations Center (SOC) because the creation of unauthorized local administrator accounts can be indicative of an attacker trying to gain persistent access to a system or escalate their privileges. If this analytic identifies a true positive, it suggests that an attacker has successfully created a new administrator account, which can lead to unauthorized access, data theft, or other malicious activities. To investigate further, SOC analysts should review the details of the identified process, including the user, parent process, and parent process name. They should also examine any relevant on-disk artifacts and look for concurrent processes to determine the source of the attack. By detecting and responding to the creation of local administrator accounts, SOC analysts can mitigate the risks associated with unauthorized access and prevent further damage to the environment. It is important to note that there may be legitimate uses of the net.exe command and the creation of administrator accounts in certain circumstances, so false positives are possible. Analysts should consider the context of the activity and other indicators of compromise before taking any action. Overall, this analytic helps SOC teams detect and respond to potential threats earlier, allowing them to take appropriate actions to protect their organization's systems and data.
description: This search looks for the creation of local administrator accounts using
net.exe .
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count values(Processes.user) as
@@ -17,7 +18,11 @@ search: '| tstats `security_content_summariesonly` count values(Processes.user)
OR Processes.process=*administratorer*) by Processes.process Processes.process_name
Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `create_local_admin_accounts_using_net_exe_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
known_false_positives: Administrators often leverage net.exe to create admin accounts.
references: []
tags:
detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
+9 -4
View File
@@ -1,11 +1,12 @@
name: Create or delete windows shares using net exe
id: 743a322c-9a68-4a0f-9c17-85d9cce2a27c
version: 7
date: '2023-07-13'
version: 6
date: '2020-09-16'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic detects the creation or deletion of hidden shares using the net.exe command. It searches for processes that involve the use of net.exe and filters for actions related to creating or deleting shares. This behavior is worth identifying for a Security Operations Center (SOC) because the creation or deletion of hidden shares can be indicative of malicious activity. Attackers may use hidden shares to exfiltrate data, distribute malware, or establish persistence within a network. By detecting and investigating these actions, the SOC can identify and mitigate potential threats before they cause significant damage. If a true positive is found, it suggests that an attacker is attempting to manipulate or exploit the network by creating or deleting hidden shares. The impact of such an attack can vary, but it often involves unauthorized access to sensitive information, disruption of services, or the introduction of malware. To implement this analytic, ensure that you are collecting and ingesting endpoint process logs that include information about the net.exe command. It is important to note that there may be false positives, as legitimate actions may also involve the use of net.exe. Therefore, thorough triage and investigation are necessary to determine the intent and nature of the detected activity. During the triage process, analysts should review the details of the process involving the net.exe command, including the user, parent process, and timestamps. Additionally, it is important to capture and inspect any relevant on-disk artifacts and look for concurrent processes to identify the source of the attack. By employing this analytic, SOC analysts can detect potential threats earlier, allowing for prompt response and mitigation. This proactive approach helps to enhance the overall security posture of the organization and protect against potential data breaches, malware infections, and other damaging outcomes.
description: This search looks for the creation or deletion of hidden shares using
net.exe.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count values(Processes.user) as
@@ -14,7 +15,11 @@ search: '| tstats `security_content_summariesonly` count values(Processes.user)
Processes.process Processes.process_name Processes.original_file_name Processes.dest
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| search process=*share* | `create_or_delete_windows_shares_using_net_exe_filter` '
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Administrators often leverage net.exe to create or delete network
shares. You should verify that the activity was intentional and is legitimate.
references:
detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
+9 -4
View File
@@ -1,11 +1,12 @@
name: Creation of Shadow Copy with wmic and powershell
id: 2ed8b538-d284-449a-be1d-82ad1dbd186b
version: 4
date: '2023-07-13'
version: 3
date: '2021-09-16'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects the use of two specific tools, wmic and Powershell, to create a shadow copy. It uses a Splunk query that searches for processes in the Endpoint.Processes datamodel where either the process name contains "wmic" or "Powershell" and the process command contains "shadowcopy" and "create". Identifying this behavior is important for a Security Operations Center (SOC) because the creation of shadow copies using these tools can be indicative of malicious activity. Attackers may use shadow copies to backup and exfiltrate sensitive data or to hide their tracks by restoring files to a previous state after an attack. If a true positive is detected, it suggests that an attacker is attempting to manipulate or access data in an unauthorized manner. This could lead to data theft, data manipulation, or other malicious activities. To investigate a potential true positive, SOC analysts should review the user associated with the process, the process name, the original file name, the process command, and the destination of the process. They should also examine any relevant on-disk artifacts and look for other concurrent processes to determine the source of the attack. By detecting the creation of shadow copies using wmic and Powershell, analysts can identify potential threats earlier and take appropriate actions to mitigate the risks.
description: This search detects the use of wmic and Powershell to create a shadow
copy.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -13,7 +14,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process=*shadowcopy* Processes.process=*create* by Processes.user Processes.process_name
Processes.original_file_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_with_wmic_and_powershell_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Legtimate administrator usage of wmic to create a shadow copy.
references:
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
+9 -4
View File
@@ -1,11 +1,12 @@
name: Credential Dumping via Copy Command from Shadow Copy
id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b
version: 3
date: '2023-07-13'
version: 2
date: '2021-09-16'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects the use of the copy command to dump credentials from a shadow copy. It utilizes a Splunk query to search for specific processes that indicate credential dumping activity. The query looks for processes with command lines that include references to certain files, such as "sam", "security", "system", and "ntds.dit", located in system directories like "system32" or "windows". Identifying this behavior is crucial for a Security Operations Center (SOC) because credential dumping is a common technique used by attackers to obtain sensitive login information and gain unauthorized access to systems. By detecting this activity, the SOC can quickly respond and prevent further compromise. If this analytic identifies a true positive, it suggests that an attacker is attempting to extract credentials from a shadow copy. This can lead to serious security breaches, as compromised credentials can be used to escalate privileges, move laterally within the network, or gain unauthorized access to sensitive data. To effectively implement this analytic, ensure that you are ingesting endpoint process logs into your Splunk instance. It is important to note that there may be false positives, as legitimate processes may also reference these files. Therefore, during triage, it is crucial to review the process details, including the source and the command being executed. Additionally, capture and analyze any relevant on-disk artifacts and investigate concurrent processes to determine the source of the attack. By following these steps, analysts can detect potential threats earlier and mitigate the risks associated with credential dumping.
description: This search detects credential dumping using copy command from a shadow
copy.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -15,7 +16,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process_name Processes.process Processes.parent_process Processes.original_file_name
Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_copy_command_from_shadow_copy_filter` '
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: unknown
references:
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
+8 -4
View File
@@ -1,11 +1,11 @@
name: Credential Dumping via Symlink to Shadow Copy
id: c5eac648-fae0-4263-91a6-773df1f4c903
version: 3
date: '2023-07-13'
version: 2
date: '2021-09-16'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects the creation of a symlink to a shadow copy. It is implemented using a Splunk query that searches for processes with commands containing "mklink" and "HarddiskVolumeShadowCopy". It retrieves information such as the destination, user, process name, process ID, parent process, original file name, and parent process ID from the Endpoint.Processes datamodel. Detecting the creation of a symlink to a shadow copy is worth identifying for a Security Operations Center (SOC) because it can indicate potential malicious activity. Attackers may use this technique to manipulate or delete shadow copies, which are used for system backup and recovery. By detecting this behavior, SOC analysts can investigate further to determine if an attacker is attempting to cover their tracks or prevent data recovery in the event of an incident. If the search identifies a true positive, it suggests that an attacker is actively trying to undermine the integrity of the system or hide their actions. The impact of such an attack can be significant, as it can hinder incident response efforts, prevent data restoration, and potentially lead to data loss or compromise. To respond to a true positive, SOC analysts should review the details of the process, such as the destination and the user responsible for creating the symlink. They should also examine the parent process and any relevant on-disk artifacts. Concurrent processes should be examined to identify the source of the attack. By taking these steps, analysts can detect potential threats earlier and mitigate the risks associated with symlink creation to shadow copies.
description: This search detects the creation of a symlink to a shadow copy.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -14,7 +14,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.process Processes.parent_process Processes.original_file_name Processes.process_id
Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: unknown
references:
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
detections/endpoint/curl_download_and_bash_execution.yml
+11 -4
View File
@@ -1,11 +1,13 @@
name: Curl Download and Bash Execution
id: 900bc324-59f3-11ec-9fb4-acde48001122
version: 3
date: '2023-07-13'
version: 1
date: '2021-12-10'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic uses a Splunk query to detect the use of the curl command on Linux or MacOS, where it attempts to download a file from a remote source and pipe it to bash. This behavior is commonly associated with coinminers and has been observed in recent attacks leveraging the CVE-2021-44228 vulnerability in Log4j. The analytic searches for this behavior by analyzing process data using the Endpoint Processes datamodel and filtering for processes with the curl command and the use of the pipe to bash. It then aggregates this data by destination, user, parent process name, process name, process ID, and parent process ID. Identifying this behavior is crucial for a SOC as it can indicate the presence of a coinminer or other malicious activity. If the analytic identifies a true positive, it suggests that an attacker is attempting to download and execute malicious code on the victim's machine. This can result in the theft of sensitive data, damage to the system, or the installation of additional malware. To mitigate the risks associated with this behavior, it is recommended to monitor and restrict the use of the curl command and to patch systems to address known vulnerabilities, such as CVE-2021-44228. It is also important to investigate any identified incidents promptly and thoroughly to prevent further damage.
description: The following analytic identifies the use of curl on Linux or MacOS attempting
to download a file from a remote source and pipe it to bash. This is typically found
with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -14,7 +16,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `curl_download_and_bash_execution_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is
occurring correctly. If the EDR is not parsing the pipe bash in the command-line,
modifying the analytic will be required. Add parent process name (Processes.parent_process_name)
as needed to filter.
known_false_positives: False positives should be limited, however filtering may be
required.
references:
detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml
+8 -4
View File
@@ -1,11 +1,12 @@
name: Detect Outlook exe writing a zip file
id: a51bfe1a-94f0-4822-b1e4-16ae10145893
version: 5
date: '2023-07-13'
version: 4
date: 2023-2-07
author: Bhavin Patel, Splunk
status: experimental
type: TTP
description: The following analytic searches for an instance where the `outlook.exe` process is being executed and writing a `.zip` file to the disk. The search is implemented using a Splunk query that utilizes the `Endpoint.Processes` and `Endpoint.Filesystem` datamodels. The search looks for instances where the `outlook.exe` process is being executed and writing a `.zip` file to the disk. It then joins the results with information on the file path, file name, and file hash from the `Endpoint.Filesystem` datamodel. Identifying this behavior is important for a SOC as it could indicate a potential data exfiltration attempt. If a true positive is found, it suggests that an attacker may be using the `outlook.exe` process to compress and transfer sensitive data from the victim's system. To implement this analytic, ensure that you are ingesting logs containing process and filesystem information from your endpoints. It is important to note that there may be legitimate uses of the `outlook.exe` process that involve writing `.zip` files to the disk, so be aware of potential false positives. Upon triage, review the file path and file name of the `.zip` file to determine if it contains sensitive information. Additionally, investigate the source of the `outlook.exe` process to identify any potential malicious activity.
description: This search looks for execution of process `outlook.exe` where the process
is writing a `.zip` file to the disk.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
@@ -23,7 +24,10 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(
malicious_id outlook_id dest file_path file_name file_hash count file_id] | table
firstTime lastTime user malicious_id outlook_id process_name parent_process_name
file_name file_path | where file_name != "" | `detect_outlook_exe_writing_a_zip_file_filter` '
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process, file name, and file path. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` and `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: You must be ingesting data that records filesystem and process activity
from your hosts to populate the Endpoint data model. This is typically populated
via endpoint detection-and-response product, such as Carbon Black, or endpoint data
sources, such as Sysmon.
known_false_positives: It is not uncommon for outlook to write legitimate zip files
to the disk.
references: []
detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml
+13 -4
View File
@@ -1,11 +1,12 @@
name: Detect Prohibited Applications Spawning cmd exe
id: dcfd6b40-42f9-469d-a433-2e53f7486664
version: 7
date: '2023-07-14'
version: 6
date: '2020-11-10'
author: Bhavin Patel, Splunk
status: production
type: Hunting
description: The following analytic searches for instances of cmd.exe execution that are spawned by a process that is commonly abused by attackers and does not usually launch cmd.exe. This behavior is worth identifying as it is often used by attackers to execute malicious commands on a compromised system. If a true positive is detected, it could indicate that an attacker is attempting to gain unauthorized access to the system or exfiltrate sensitive data. It is important to note that this search may generate false positives, as there may be legitimate use cases for cmd.exe execution by certain processes. Therefore, further investigation and analysis is necessary to determine whether the identified behavior is truly malicious. In summary, this analytic is a useful tool for identifying potentially malicious behavior on a system and can help security analysts detect and respond to threats in a timely manner.
description: This search looks for executions of cmd.exe spawned by a process that
is often abused by attackers and that does not typically launch cmd.exe.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count values(Processes.process)
@@ -13,7 +14,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
where `process_cmd` by Processes.parent_process_name Processes.process_name Processes.original_file_name
Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` |search [`prohibited_apps_launching_cmd`] | `detect_prohibited_applications_spawning_cmd_exe_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: You must be ingesting data that records process activity from your
hosts and populates the Endpoint data model with the resultant dataset. This search
includes a lookup file, `prohibited_apps_launching_cmd.csv`, that contains a list
of processes that should not be spawning cmd.exe. You can modify this lookup to
better suit your environment. To successfully implement this search you need to
be ingesting information on process that include the name of the process responsible
for the changes from your endpoints into the `Endpoint` datamodel in the `Processes`
node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
latest TA for the endpoint product.
known_false_positives: There are circumstances where an application may legitimately
execute and interact with the Windows command-line interface. Investigate and modify
the lookup file, as appropriate.
detections/endpoint/detect_rare_executables.yml
+14 -4
View File
@@ -1,11 +1,13 @@
name: Detect Rare Executables
id: 44fddcb2-8d3b-454c-874e-7c6de5a4f7ac
version: 4
date: '2023-07-13'
version: 3
date: '2022-11-10'
author: Bhavin Patel, Splunk
status: experimental
type: Anomaly
description: The following analytic is designed to detect rare processes that are executed on different hosts within a specified time window. The analytic uses a Splunk query that returns a table of processes, removes process names that are in the allowed list, and lists out the top 30 rare processes. The analytic detects rare processes that are not commonly executed within the specified time window. The query looks for processes that are executed on different hosts and removes process names that are in the allowed list. The remaining processes are sorted by count and the top 30 rare processes are listed. Identifying rare processes can be useful for a SOC as it can indicate potential threats or suspicious activity. Malware and attackers often use rare or uncommon processes to avoid detection. By identifying these processes, the SOC can investigate further to determine if they are malicious or not. If a true positive is detected, the impact could be significant as it suggests an attacker is attempting to execute a rare process on multiple hosts. This could be an indication of a larger attack or data exfiltration attempt. It is important to note that false positives may occur, as some legitimate applications may use rare processes. Therefore, it is recommended to investigate further before taking any actions.
description: This search will return a table of processes in the a given window, remove
process names which are in the allowed list and list out the top 30 rare processes
discovered on different hosts.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count values(Processes.dest) as
@@ -14,7 +16,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.dest)
as process | `filter_rare_process_allow_list` | sort count | head 30 | rex field=user
"(?<user_domain>.*)\\\\(?<user_name>.*)" | `security_content_ctime(firstTime)` |
`security_content_ctime(lastTime)` | `detect_rare_executables_filter` '
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The macro `filter_rare_process_allow_list` searches two lookup files for allowed processes. These consist of `rare_process_allow_list_default.csv` and `rare_process_allow_list_local.csv`. To add your own processes to the allow list, add them to `rare_process_allow_list_local.csv`. If you wish to remove an entry from the default lookup file, you will have to modify the macro itself to set the allow_list value for that process to false. You can modify the limit parameter and search scheduling to better suit your environment.
how_to_implement: To successfully implement this search, you must be ingesting data
that records process activity from your hosts and populating the `Endpoint` data
model with the resultant dataset. The macro `filter_rare_process_allow_list` searches
two lookup files for allowed processes. These consist of `rare_process_allow_list_default.csv`
and `rare_process_allow_list_local.csv`. To add your own processes to the allow
list, add them to `rare_process_allow_list_local.csv`. If you wish to remove an
entry from the default lookup file, you will have to modify the macro itself to
set the allow_list value for that process to false. You can modify the limit parameter
and search scheduling to better suit your environment.
known_false_positives: Some legitimate processes may be only rarely executed in your
environment. As these are identified, update `rare_process_allow_list_local.csv`
to filter them out of your search results.