Branch was auto-updated.

detections/endpoint/change_default_file_association.yml

@@ -7,10 +7,10 @@ type: TTP
 datamodel:
 - Endpoint
 description: This analytic is developed to detect suspicious registry modification
-  to change the default file association of windows to malicious payload. This techninique
+  to change the default file association of windows to malicious payload. This technique
   was seen in some APT where it modify the default process to run file association,
   like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other
-  payload that will load malicious command to the compromised host.
+  payload that will load malicious commands to the compromised host.
 search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
   max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
   ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest  Registry.user
@@ -32,6 +32,7 @@ tags:
   - Windows Privilege Escalation
   - Windows Registry Abuse
   - Hermetic Wiper
+  - Prestige Ransomware
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml

@@ -27,6 +27,8 @@ tags:
   analytic_story:
   - Hidden Cobra Malware
   - CISA AA22-277A
+  - Windows Post-Exploitation
+  - Prestige Ransomware
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/domain_group_discovery_with_net.yml

@@ -25,6 +25,8 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Windows Post-Exploitation
+  - Prestige Ransomware
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/excessive_usage_of_cacls_app.yml

@@ -28,6 +28,8 @@ tags:
   analytic_story:
   - XMRig
   - Azorult
+  - Windows Post-Exploitation
+  - Prestige Ransomware
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/excessive_usage_of_net_app.yml

@@ -29,6 +29,8 @@ tags:
   - XMRig
   - Ransomware
   - Azorult
+  - Windows Post-Exploitation
+  - Prestige Ransomware
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/net_localgroup_discovery.yml

@@ -30,6 +30,8 @@ tags:
   - Active Directory Discovery
   - Windows Discovery Techniques
   - Azorult
+  - Windows Post-Exploitation
+  - Prestige Ransomware
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/network_connection_discovery_arp.yml

@@ -25,6 +25,8 @@ tags:
   analytic_story:
   - Active Directory Discovery
   - Qakbot
+  - Windows Post-Exploitation
+  - Prestige Ransomware
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/network_connection_discovery_net.yml

@@ -26,6 +26,8 @@ tags:
   analytic_story:
   - Active Directory Discovery
   - Azorult
+  - Windows Post-Exploitation
+  - Prestige Ransomware
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/network_connection_discovery_netstat.yml

@@ -27,6 +27,8 @@ tags:
   - Active Directory Discovery
   - Qakbot
   - CISA AA22-277A
+  - Windows Post-Exploitation
+  - Prestige Ransomware
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/network_discovery_using_route_windows_app.yml

@@ -30,6 +30,8 @@ tags:
   - Active Directory Discovery
   - Qakbot
   - CISA AA22-277A
+  - Windows Post-Exploitation
+  - Prestige Ransomware
   confidence: 30
   context:
   - Source:Endpoint

detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml

@@ -35,6 +35,8 @@ tags:
   - Ransomware
   - Malicious PowerShell
   - Qakbot
+  - Windows Post-Exploitation
+  - Prestige Ransomware
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/windows_change_default_file_association_for_no_file_ext.yml

@@ -0,0 +1,78 @@
+name: Windows Change Default File Association For No File Ext
+id: dbdf52ad-d6a1-4b68-975f-0a10939d8e38
+version: 1
+date: '2022-11-30'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is developed to detect suspicious process commandline 
+  to change or set the default file association of a file without file extension with notepad.exe. This technique
+  was seen in some APT and ransomware Prestige where it set/modify the default process to run file association,
+  like .txt to notepad.exe. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime  from datamodel=Endpoint.Processes 
+  where `process_reg` AND Processes.process="* add *" AND Processes.process="* HKCR\\*" AND Processes.process="*\\shell\\open\\command*" AND  Processes.process= *Notepad.exe*
+  by  Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)` 
+  | rex field=process "Notepad\.exe (?<file_name_association>.*$)" 
+  | rex field=file_name_association "\.(?<extension>[^\.]*$)"
+  | where isnull(extension) and isnotnull(file_name_association)
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_change_default_file_association_for_no_file_ext_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: unknown
+references:
+- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
+tags:
+  analytic_story:
+  - Prestige Ransomware
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/prestige_ransomware/sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: process with commandline $process$ set or change the file association of a file with no file extension in $dest$
+  mitre_attack_id:
+  - T1546.001
+  - T1546
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 80
+  security_domain: endpoint

tests/endpoint/windows_change_default_file_association_for_no_file_ext.test.yml

@@ -0,0 +1,13 @@
+name: Windows Change Default File Association For No File Ext Unit Test
+tests:
+- name: Windows Change Default File Association For No File Ext
+  file: endpoint/windows_change_default_file_association_for_no_file_ext.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/prestige_ransomware/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true