mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
srv-rr-gh-researchbt
+1
-1
@@ -180,7 +180,7 @@
|
||||
" role:",
|
||||
" - Victim",
|
||||
" - name: parent_process_name",
|
||||
" type: Parent Process",
|
||||
" type: Process",
|
||||
" role:",
|
||||
" - Parent Process",
|
||||
" - name: process_name",
|
||||
|
||||
@@ -0,0 +1,57 @@
|
||||
name: PowerShell Enable PowerShell Remoting
|
||||
id: 40e3b299-19a5-4460-96e9-e1467f714f8e
|
||||
version: 1
|
||||
date: '2023-03-22'
|
||||
author: Michael Haag, Splunk
|
||||
type: Anomaly
|
||||
datamodel: []
|
||||
description: This analytic utilizes PowerShell Script Block Logging (EventCode 4104) to identify the use of Enable-PSRemoting cmdlet. This cmdlet allows users to enable PowerShell remoting on a local or remote computer, which allows other computers to run commands on the target computer. The ability to remotely execute commands can be abused by attackers to take control of compromised systems and pivot to other systems on the network.
|
||||
By detecting the use of Enable-PSRemoting cmdlet via script block logging, this analytic can help organizations identify potential malicious activity related to attackers attempting to gain remote control of compromised systems.
|
||||
search: '`powershell` EventCode=4104 ScriptBlockText="*Enable-PSRemoting*"
|
||||
| stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ScriptBlockText
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`| `powershell_enable_powershell_remoting_filter`'
|
||||
how_to_implement: To successfully implement this analytic, you will need to enable
|
||||
PowerShell Script Block Logging on some or all endpoints. Additional setup here
|
||||
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
|
||||
known_false_positives: Note that false positives may occur due to the use of the Enable-PSRemoting cmdlet by legitimate users, such as system administrators. It is recommended to apply appropriate filters as needed to minimize the number of false positives.
|
||||
references:
|
||||
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.3
|
||||
tags:
|
||||
analytic_story:
|
||||
- Malicious PowerShell
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 50
|
||||
context:
|
||||
- Source:Endpoint
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/4104-psremoting-windows-powershell.log
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerShell was identified running a Invoke-PSremoting on $Computer$.
|
||||
mitre_attack_id:
|
||||
- T1059.001
|
||||
- T1059
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: Computer
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- ScriptBlockText
|
||||
- Computer
|
||||
risk_score: 25
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,57 @@
|
||||
name: PowerShell Invoke CIMMethod CIMSession
|
||||
id: 651ee958-a433-471c-b264-39725b788b83
|
||||
version: 1
|
||||
date: '2023-03-22'
|
||||
author: Michael Haag, Splunk
|
||||
type: Anomaly
|
||||
datamodel: []
|
||||
description: This analytic identifies the use of the New-CIMSession cmdlet being created along with the Invoke-CIMMethod cmdlet being used within PowerShell. This particular behavior is similar to the usage of the Invoke-WMIMethod cmdlet, which is known for executing WMI commands on targets using NTLMv2 pass-the-hash authentication. The New-CIMSession cmdlet allows users to create a new CIM session object for a specified computer system, which can then be used to execute CIM operations remotely. Similarly, the Invoke-CIMMethod cmdlet is used to invoke a specified method on one or more CIM objects. Therefore, the combination of New-CIMSession and Invoke-CIMMethod cmdlets in PowerShell can potentially indicate malicious behavior, and this analytic can help detect such activity.
|
||||
search: '`powershell` EventCode=4104 ScriptBlockText IN ("*invoke-CIMMethod*", "*New-CimSession*")
|
||||
| stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ScriptBlockText
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `powershell_invoke_cimmethod_cimsession_filter`'
|
||||
how_to_implement: To successfully implement this analytic, you will need to enable
|
||||
PowerShell Script Block Logging on some or all endpoints. Additional setup here
|
||||
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
|
||||
known_false_positives: False positives may be present based on third-party applications or administrators using CIM. It is recommended to apply appropriate filters as needed to minimize the number of false positives.
|
||||
references:
|
||||
- https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/invoke-cimmethod?view=powershell-7.3
|
||||
tags:
|
||||
analytic_story:
|
||||
- Malicious PowerShell
|
||||
- Active Directory Lateral Movement
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 50
|
||||
context:
|
||||
- Source:Endpoint
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/4104-cimmethod-windows-powershell.log
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
- Installation
|
||||
message: PowerShell was identified running a Invoke-CIMMethod Invoke-CIMSession on $Computer$.
|
||||
mitre_attack_id:
|
||||
- T1047
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: Computer
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- ScriptBlockText
|
||||
- Computer
|
||||
risk_score: 25
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,55 @@
|
||||
name: PowerShell Invoke WmiExec Usage
|
||||
id: 0734bd21-2769-4972-a5f1-78bb1e011224
|
||||
version: 1
|
||||
date: '2023-03-22'
|
||||
author: Michael Haag, Splunk
|
||||
type: TTP
|
||||
datamodel: []
|
||||
description: This analytic detects the usage of the Invoke-WMIExec utility within PowerShell Script Block Logging (EventCode 4104). The utility is used for executing WMI commands on targets using NTLMv2 pass-the-hash authentication.
|
||||
search: '`powershell` EventCode=4104 ScriptBlockText IN ("*invoke-wmiexec*")
|
||||
| stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ScriptBlockText
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `powershell_invoke_wmiexec_usage_filter`'
|
||||
how_to_implement: To successfully implement this analytic, you will need to enable
|
||||
PowerShell Script Block Logging on some or all endpoints. Additional setup here
|
||||
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
|
||||
known_false_positives: False positives should be limited as this analytic is designed to detect a specific utility. It is recommended to apply appropriate filters as needed to minimize the number of false positives.
|
||||
references:
|
||||
- https://github.com/Kevin-Robertson/Invoke-TheHash/blob/master/Invoke-WMIExec.ps1
|
||||
tags:
|
||||
analytic_story:
|
||||
- Suspicious WMI Use
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/invokewmiexec_windows-powershell.log
|
||||
impact: 100
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: PowerShell was identified running a Invoke-WmiExec on $Computer$.
|
||||
mitre_attack_id:
|
||||
- T1047
|
||||
observable:
|
||||
- name: Computer
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- ScriptBlockText
|
||||
- Computer
|
||||
risk_score: 100
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,58 @@
|
||||
name: PowerShell Start or Stop Service
|
||||
id: 04207f8a-e08d-4ee6-be26-1e0c4488b04a
|
||||
version: 1
|
||||
date: '2023-03-24'
|
||||
author: Michael Haag, Splunk
|
||||
type: Anomaly
|
||||
datamodel: []
|
||||
description: This analytic identifies the use of PowerShell's Start-Service or Stop-Service cmdlets on an endpoint. These cmdlets allow users to start or stop a specified Windows service. The ability to manipulate services can be leveraged by attackers to disable or stop critical services, which can cause system instability or disrupt business operations.
|
||||
By detecting the use of Start-Service or Stop-Service cmdlets via PowerShell, this analytic can help organizations identify potential malicious activity related to attackers attempting to manipulate services on compromised systems. However, note that this behavior may be noisy, as these cmdlets are commonly used by system administrators or other legitimate users to manage services. Therefore, it is recommended not to enable this analytic as a direct notable or TTP. Instead, it should be used as part of a broader set of security controls to detect and investigate potential threats.
|
||||
search: '`powershell` EventCode=4104 ScriptBlockText IN ("*start-service*", "*stop-service*")
|
||||
| stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ScriptBlockText
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `powershell_start_or_stop_service_filter`'
|
||||
how_to_implement: To successfully implement this analytic, you will need to enable
|
||||
PowerShell Script Block Logging on some or all endpoints. Additional setup here
|
||||
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
|
||||
known_false_positives: This behavior may be noisy, as these cmdlets are commonly used by system administrators or other legitimate users to manage services. Therefore, it is recommended not to enable this analytic as a direct notable or TTP. Instead, it should be used as part of a broader set of security controls to detect and investigate potential threats.
|
||||
references:
|
||||
- https://learn-powershell.net/2012/01/15/startingstopping-and-restarting-remote-services-with-powershell/
|
||||
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/start-service?view=powershell-7.3
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Lateral Movement
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 20
|
||||
context:
|
||||
- Source:Endpoint
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/start_stop_service_windows-powershell.log
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerShell was identified attempting to start or stop a service on $Computer$.
|
||||
mitre_attack_id:
|
||||
- T1059.001
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: Computer
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- ScriptBlockText
|
||||
- Computer
|
||||
risk_score: 10
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,63 @@
|
||||
name: Windows Enable Win32 ScheduledJob via Registry
|
||||
id: 12c80db8-ef62-4456-92df-b23e1b3219f6
|
||||
version: 1
|
||||
date: '2023-03-27'
|
||||
author: Michael Haag, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: 'This analytic searches for a registry modification that enables the use of the at.exe or wmi Win32_ScheduledJob command to add scheduled tasks on a Windows endpoint. Specifically, it looks for the creation of a new DWORD value named "EnableAt" in the following registry path: "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration". If this value is set to 1, it enables the at.exe and wmi Win32_ScheduledJob commands to schedule tasks on the system. Detecting this registry modification is important because it may indicate that an attacker has enabled the ability to add scheduled tasks to the system, which can be used to execute malicious code at specific times or intervals.'
|
||||
search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
|
||||
as registry_key_name values(Registry.registry_path) as registry_path min(_time)
|
||||
as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\CurrentVersion\\Schedule\\Configuration*" Registry.registry_value_name=EnableAt by
|
||||
Registry.dest, Registry.user, Registry.registry_value_name, Registry.registry_value_type | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
|
||||
| `drop_dm_object_name(Registry)` | `windows_enable_win32_scheduledjob_via_registry_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
||||
known_false_positives: In some cases, an automated script or system may enable this setting continuously, leading to false positives. To avoid such situations, it is recommended to monitor the frequency and context of the registry modification and modify or filter the detection rules as needed. This can help to reduce the number of false positives and ensure that only genuine threats are identified. Additionally, it is important to investigate any detected instances of this modification and analyze them in the broader context of the system and network to determine if further action is necessary.
|
||||
references:
|
||||
- https://securityonline.info/wmiexec-regout-get-outputdata-response-from-registry/
|
||||
- https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Lateral Movement
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 50
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Lateral Movement
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/enableat_windows-sysmon.log
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Installation
|
||||
message: A process has modified the schedule task registry value - EnableAt - on endpoint $dest$ by user $user$.
|
||||
mitre_attack_id:
|
||||
- T1053.005
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: user
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.registry_path
|
||||
- Registry.dest
|
||||
- Registry.user
|
||||
- Registry.registry_value_name
|
||||
- Registry.registry_value_type
|
||||
risk_score: 25
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,54 @@
|
||||
name: Windows PowerShell Get CIMInstance Remote Computer
|
||||
id: d8c972eb-ed84-431a-8869-ca4bd83257d1
|
||||
version: 1
|
||||
date: '2023-03-27'
|
||||
author: Michael Haag, Splunk
|
||||
type: Anomaly
|
||||
datamodel: []
|
||||
description: This analytic identifies the use of Get-CimInstance cmdlet with the -ComputerName parameter, which indicates that the cmdlet is being used to retrieve information from a remote computer. This can be useful for detecting instances of remote access, such as when an attacker uses PowerShell to connect to a remote system and gather information. By monitoring for this cmdlet with the -ComputerName parameter, security analysts can identify potential malicious activity on remote systems and take appropriate action to mitigate any threats.
|
||||
search: '`powershell` EventCode=4104 ScriptBlockText="*get-ciminstance*" AND ScriptBlockText="*computername*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `windows_powershell_get_ciminstance_remote_computer_filter`'
|
||||
how_to_implement: To successfully implement this analytic, you will need to enable
|
||||
PowerShell Script Block Logging on some or all endpoints. Additional setup here
|
||||
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
|
||||
known_false_positives: This is meant to be a low risk RBA anomaly analytic or to be used for hunting. Enable this with a low risk score and let it generate risk in the risk index.
|
||||
references:
|
||||
- https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/get-ciminstance?view=powershell-7.3
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Lateral Movement
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 50
|
||||
context:
|
||||
- Source:Endpoint
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/get_ciminstance_windows-powershell.log
|
||||
impact: 30
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: A PowerShell Cmdlet Get-CIMInstnace was ran on $Computer$, attempting to connect to a remote host.
|
||||
mitre_attack_id:
|
||||
- T1059.001
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: Computer
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- ScriptBlockText
|
||||
- Computer
|
||||
- EventCode
|
||||
risk_score: 15
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,58 @@
|
||||
name: Windows PowerShell WMI Win32 ScheduledJob
|
||||
id: 47c69803-2c09-408b-b40a-063c064cbb16
|
||||
version: 1
|
||||
date: '2023-03-27'
|
||||
author: Michael Haag, Splunk
|
||||
type: TTP
|
||||
datamodel: []
|
||||
description: The following analytic detects the use of the PowerShell script block logging mechanism to detect the use of the Win32_ScheduledJob WMI class. This class allows the creation and management of scheduled tasks on Windows systems. However, due to security concerns, the class has been disabled by default in Windows systems, and its use must be explicitly enabled by modifying the registry. As a result, the detection of the use of this class may indicate malicious activity, especially if the class was enabled on the system by the attacker. Therefore, it is recommended to monitor the use of Win32_ScheduledJob through PowerShell script block logging and to investigate any suspicious activity.
|
||||
search: '`powershell` EventCode=4104 ScriptBlockText="*win32_scheduledjob*"
|
||||
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `windows_powershell_wmi_win32_scheduledjob_filter`'
|
||||
how_to_implement: To successfully implement this analytic, you will need to enable
|
||||
PowerShell Script Block Logging on some or all endpoints. Additional setup here
|
||||
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
|
||||
known_false_positives: False positives may be present based on legacy applications or utilities. Win32_ScheduledJob uses the Remote Procedure Call (RPC) protocol to create scheduled tasks on remote computers. It uses the DCOM (Distributed Component Object Model) infrastructure to establish a connection with the remote computer and invoke the necessary methods. The RPC service needs to be running on both the local and remote computers for the communication to take place.
|
||||
references:
|
||||
- https://securityonline.info/wmiexec-regout-get-outputdata-response-from-registry/
|
||||
- https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Lateral Movement
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 50
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Lateral Movement
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/win32_scheduledjob_windows-powershell.log
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Installation
|
||||
message: PowerShell attempting to create a task via WMI - Win32_ScheduledJob, was ran on $dest$.
|
||||
mitre_attack_id:
|
||||
- T1059.001
|
||||
- T1059
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- ScriptBlockText
|
||||
- dest
|
||||
- EventCode
|
||||
risk_score: 40
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,79 @@
|
||||
name: Windows Remote Create Service
|
||||
id: 0dc44d03-8c00-482d-ba7c-796ba7ab18c9
|
||||
version: 1
|
||||
date: '2023-03-20'
|
||||
author: Michael Haag, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This analytic identifies an endpoint that remotely connects to another endpoint to create a new service using sc.exe. On the remote endpoint, the new service will be created and this action will trigger the creation of EventCode 7045 along with all the resulting service information.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=sc.exe Processes.process IN ("*create*") Processes.process="*\\\\*"
|
||||
by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
|
||||
Processes.process Processes.process_id Processes.parent_process_id
|
||||
| `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `windows_remote_create_service_filter`'
|
||||
how_to_implement: To implement this search, it is necessary to ingest information on processes that include the name of the process responsible for the changes from your endpoints into the Endpoint data model within the Processes node. Additionally, it is recommended to confirm that the latest version of CIM App (4.20 or higher) and the latest TA for the endpoint product are installed.
|
||||
known_false_positives: Note that false positives may occur, and filtering may be necessary, especially when it comes to remote service creation by administrators or software management utilities.
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1543/003/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Lateral Movement
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 50
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/remote_service_create_windows-sysmon.log
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a remote service.
|
||||
mitre_attack_id:
|
||||
- T1543
|
||||
- T1543.003
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: user
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: Computer
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: parent_process_name
|
||||
type: Process
|
||||
role:
|
||||
- Parent Process
|
||||
- name: process_name
|
||||
type: Process
|
||||
role:
|
||||
- Child Process
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process_name #parent process name
|
||||
- Processes.parent_process #parent cmdline
|
||||
- Processes.original_file_name
|
||||
- Processes.process_name #process name
|
||||
- Processes.process #process cmdline
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_path
|
||||
- Processes.process_path
|
||||
- Processes.parent_process_id
|
||||
risk_score: 25
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,82 @@
|
||||
name: Windows Service Create with Tscon
|
||||
id: c13b3d74-6b63-4db5-a841-4206f0370077
|
||||
version: 1
|
||||
date: '2023-03-29'
|
||||
author: Michael Haag, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: 'The following analytic detects potential RDP Hijacking attempts by monitoring a series of actions taken by an attacker to gain unauthorized access to a remote system. The attacker first runs the quser command to query the remote host for disconnected user sessions. Upon identifying a disconnected session, they use the sc.exe command to create a new Windows service with a binary path that launches tscon.exe. By specifying the disconnected session ID and a destination ID, the attacker can transfer the disconnected session to a new RDP session, effectively hijacking the user''s session. This analytic allows security teams to detect and respond to RDP Hijacking attempts, mitigating potential risks and impacts on targeted systems.'
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=sc.exe
|
||||
Processes.process="*/dest:rdp-tcp*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
|
||||
Processes.process Processes.process_id Processes.parent_process_id
|
||||
| `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `windows_service_create_with_tscon_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
||||
known_false_positives: False positives may arise in the RDP Hijacking analytic when legitimate administrators access remote sessions for maintenance or troubleshooting purposes. These activities might resemble an attacker''s attempt to hijack a disconnected session, leading to false alarms. To mitigate the risk of false positives and improve the overall security posture, organizations can implement Group Policy to automatically disconnect RDP sessions when they are complete. By enforcing this policy, administrators ensure that disconnected sessions are promptly terminated, reducing the window of opportunity for an attacker to hijack a session. Additionally, organizations can also implement access control mechanisms and monitor the behavior of privileged accounts to further enhance security and reduce the chances of false positives in RDP Hijacking detection.
|
||||
references:
|
||||
- https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1563.002/T1563.002.md
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Lateral Movement
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 80
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Lateral Movement
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1563.002/rdphijack/tscon_windows-sysmon.log
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
- Installation
|
||||
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to hijack a RDP session.
|
||||
mitre_attack_id:
|
||||
- T1563.002
|
||||
- T1563
|
||||
- T1543.003
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: user
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: parent_process_name
|
||||
type: Process
|
||||
role:
|
||||
- Parent Process
|
||||
- name: process_name
|
||||
type: Process
|
||||
role:
|
||||
- Child Process
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process_name
|
||||
- Processes.parent_process #parent cmdline
|
||||
- Processes.original_file_name
|
||||
- Processes.process_name #process name
|
||||
- Processes.process #process cmdline
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_path
|
||||
- Processes.process_path
|
||||
- Processes.parent_process_id
|
||||
risk_score: 64
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,13 @@
|
||||
name: PowerShell Enable PowerShell Remoting Unit Test
|
||||
tests:
|
||||
- name: PowerShell Enable PowerShell Remoting
|
||||
file: endpoint/powershell_enable_powershell_remoting.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: 4104-psremoting-windows-powershell.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/4104-psremoting-windows-powershell.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: PowerShell Invoke CIMMethod CIMSession Unit Test
|
||||
tests:
|
||||
- name: PowerShell Invoke CIMMethod CIMSession
|
||||
file: endpoint/powershell_invoke_cimmethod_cimsession.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: 4104-cimmethod-windows-powershell.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/4104-cimmethod-windows-powershell.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: PowerShell Invoke WmiExec Usage Unit Test
|
||||
tests:
|
||||
- name: PowerShell Invoke WmiExec Usage
|
||||
file: endpoint/powershell_invoke_wmiexec_usage.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: invokewmiexec_windows-powershell.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/invokewmiexec_windows-powershell.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: PowerShell Start or Stop Service Unit Test
|
||||
tests:
|
||||
- name: PowerShell Start or Stop Service
|
||||
file: endpoint/powershell_start_or_stop_service.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: start_stop_service_windows-powershell.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/start_stop_service_windows-powershell.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Enable Win32 ScheduledJob via Registry Unit Test
|
||||
tests:
|
||||
- name: Windows Enable Win32 ScheduledJob via Registry
|
||||
file: endpoint/windows_enable_win32_scheduledjob_via_registry.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: enableat_windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/enableat_windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows PowerShell Get CIMInstance Remote Computer Unit Test
|
||||
tests:
|
||||
- name: Windows PowerShell Get-CIMInstance Remote Computer
|
||||
file: endpoint/windows_powershell_get_ciminstance_remote_computer.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: get_ciminstance_windows-powershell.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/get_ciminstance_windows-powershell.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows PowerShell WMI Win32 ScheduledJob Unit Test
|
||||
tests:
|
||||
- name: Windows PowerShell WMI Win32 ScheduledJob
|
||||
file: endpoint/windows_powershell_wmi_win32_scheduledjob.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: win32_scheduledjob_windows-powershell.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/win32_scheduledjob_windows-powershell.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Remote Create Service Unit Test
|
||||
tests:
|
||||
- name: Windows Remote Create Service
|
||||
file: endpoint/windows_remote_create_service.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: remote_service_create_windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/remote_service_create_windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Service Create with Tscon Unit Test
|
||||
tests:
|
||||
- name: Windows Service Create with Tscon
|
||||
file: endpoint/windows_service_create_with_tscon.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: tscon_windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1563.002/rdphijack/tscon_windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
Reference in New Issue
Block a user