Branch was auto-updated.

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -1,7 +1,7 @@
 name: Executables Or Script Creation In Suspicious Path
 id: a7e3f0f0-ae42-11eb-b245-acde48001122
 version: 1
-date: '2021-05-06'
+date: '2021-10-06'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
@@ -33,6 +33,7 @@ known_false_positives: Administrators may allow creation of script or exe in the
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+- https://twitter.com/pr0xylife/status/1590394227758104576
 tags:
   analytic_story:
   - Double Zero Destructor
@@ -47,6 +48,7 @@ tags:
   - Brute Ratel C4
   - AgentTesla
   - Qakbot
+  - IcedID
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/office_document_executing_macro_code.yml

@@ -26,6 +26,8 @@ known_false_positives: Normal Office Document macro use for automation
 references:
 - https://www.joesandbox.com/analysis/386500/0/html
 - https://www.joesandbox.com/analysis/702680/0/html
+- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/
+- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing
 tags:
   analytic_story:
   - Spearphishing Attachments
@@ -34,6 +36,8 @@ tags:
   - DarkCrystal RAT
   - AgentTesla
   - Qakbot
+  - Azorult
+  - Remcos
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/office_product_spawn_cmd_process.yml

@@ -27,10 +27,14 @@ known_false_positives: IT or network admin may create an document automation tha
   will run shell script.
 references:
 - https://twitter.com/cyb3rops/status/1416050325870587910?s=21
+- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/
+- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing
 tags:
   analytic_story:
   - Trickbot
   - DarkCrystal RAT
+  - Azorult
+  - Remcos
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/office_product_spawning_windows_script_host.yml

@@ -18,9 +18,11 @@ how_to_implement: To successfully implement this search you need to be ingesting
 known_false_positives: False positives may be present based on macro based approved documents in the organization. Filtering may be needed.
 references:
   - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
+  - https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing
 tags:
   analytic_story:
   - Spearphishing Attachments
+  - Remcos
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml

@@ -30,10 +30,12 @@ known_false_positives: This detection should yield little or no false positive r
 references:
 - https://attack.mitre.org/techniques/T1566/001/
 - https://www.trendmicro.com/en_us/research/17/e/rising-trend-attackers-using-lnk-files-download-malware.html
+- https://twitter.com/pr0xylife/status/1590394227758104576
 tags:
   analytic_story:
   - Spearphishing Attachments
   - Qakbot
+  - IcedID
   asset_type: Endpoint
   cis20:
   - CIS 7

detections/endpoint/rundll_loading_dll_by_ordinal.yml

@@ -30,11 +30,13 @@ known_false_positives: False positives are possible with native utilities and th
 references:
   - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
   - https://twitter.com/M_haggis/status/1491109262428635136
+  - https://twitter.com/pr0xylife/status/1590394227758104576
 tags:
   analytic_story:
   - Unusual Processes
   - Suspicious Rundll32 Activity
   - Living Off The Land
+  - IcedID
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/suspicious_process_file_path.yml

@@ -30,6 +30,7 @@ known_false_positives: Administrators may allow execution of specific binaries i
 references:
 - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+- https://twitter.com/pr0xylife/status/1590394227758104576
 tags:
   analytic_story:
   - Data Destruction 
@@ -43,6 +44,7 @@ tags:
   - Brute Ratel C4
   - AgentTesla
   - Qakbot
+  - IcedID
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml

@@ -0,0 +1,72 @@
+name: Windows App Layer Protocol Qakbot NamedPipe
+id: 63a2c15e-9448-43c5-a4a8-9852266aaada
+version: 1
+date: '2022-11-10'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies a suspicious process creating or connecting to a possible Qakbot named pipe .
+  This technique was seen in Qakbot malware that creates named pipe after injecting its code in legitimate process to communicate 
+  on other process that also has an injected code to steal information on the compromised host. This Anomaly detection can be a 
+  good pivot for possible Qakbot infection. This detection looks for possible random generated named pipe (in GUID form) created by known process 
+  being abused by Qakbot.
+search: '`sysmon` EventCode IN (17, 18) EventType IN ( "CreatePipe", "ConnectPipe") 
+  Image IN ("*\\calc.exe", "*\\notepad.exe", "*\\rdpclip.exe", "*\\explorer.exe", "*\\wermgr.exe", "*\\ping.exe", "*\\OneDriveSetup.exe", "*\\dxdiag.exe", "*\\mobsync.exe", "*\\msra.exe", "*\\xwizard.exe")
+  | regex PipeName="^\\\{[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{8}"
+  | stats  min(_time) as firstTime max(_time) as lastTime count by Image EventType ProcessGuid ProcessId PipeName SecurityID EventCode Computer UserID
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_app_layer_protocol_qakbot_namedpipe_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, pipename, processguid and named pipe event type from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: unknown
+references:
+- https://strontic.github.io/xcyclopedia/library/wermgr.exe-0F652BF7ADA772981E8AAB0D108FCC92.html
+- https://www.trellix.com/en-us/about/newsroom/stories/research/demystifying-qbot-malware.html
+- https://www.elastic.co/security-labs/qbot-malware-analysis
+tags:
+  analytic_story:
+  - Qakbot
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Command And Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: $Image$ is creating or connecting to a named pipe $PipeName$ in $Computer$
+  mitre_attack_id:
+  - T1071
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image 
+  - EventType
+  - ProcessGuid 
+  - ProcessId 
+  - PipeName 
+  - Computer 
+  - UserID
+  - SecurityID
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/windows_iso_lnk_file_creation.yml

@@ -19,11 +19,17 @@ known_false_positives: False positives may be high depending on the environment
 references:
 - https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
 - https://github.com/MHaggis/notes/blob/master/utilities/ISOBuilder.ps1
+- https://isc.sans.edu/diary/Recent+AZORult+activity/25120
+- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
 tags:
   analytic_story:
   - Spearphishing Attachments
   - Brute Ratel C4
   - AgentTesla
+  - Qakbot
+  - IcedID
+  - Azorult
+  - Remcos
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml

@@ -1,7 +1,7 @@
 name: Windows Modify Registry Qakbot Binary Data Registry
 id: 2e768497-04e0-4188-b800-70dd2be0e30d
 version: 1
-date: '2022-10-21'
+date: '2022-11-10'
 author: Teoderick Contreras, Bhavin Patel, Splunk
 type: Anomaly
 datamodel:
@@ -21,7 +21,7 @@ search: '| tstats `security_content_summariesonly` count dc(registry_value_name)
   | where registry_key_name_len < 80 AND registry_value_name_len == 8 
   | join proc_guid, _time  
     [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes 
-        where Processes.process_name IN  ("explorer.exe", "wermgr.exe","dxdiag.exe")
+        where Processes.process_name IN  ("explorer.exe", "wermgr.exe","dxdiag.exe", "OneDriveSetup.exe", "mobsync.exe", "msra.exe", "xwizard.exe")
         by _time span=1m Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid Processes.process_path 
     | `drop_dm_object_name(Processes)` 
     | rename process_guid as proc_guid 

detections/endpoint/windows_phishing_recent_iso_exec_registry.yml

@@ -26,10 +26,16 @@ known_false_positives: False positives may be high depending on the environment
 references:
 - https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
 - https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/
+- https://isc.sans.edu/diary/Recent+AZORult+activity/25120
+- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
 tags:
   analytic_story:
   - Brute Ratel C4
   - AgentTesla
+  - Qakbot
+  - IcedID
+  - Azorult
+  - Remcos
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/windows_process_injection_remote_thread.yml

@@ -1,7 +1,7 @@
 name: Windows Process Injection Remote Thread
 id: 8a618ade-ca8f-4d04-b972-2d526ba59924
 version: 1
-date: '2022-10-27'
+date: '2022-11-10'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -10,7 +10,7 @@ description: The following analytic identifies a suspicious remote thread execut
   qakbot. Qakbot is one of the malware using this technique to load its malicious dll module or malicious code in the targeted host. 
   This TTP can be a good pivot to verify what is the behavior of the targeted Image process after this detection trigger. 
   look for network connection, child process execution, file access and many more that helps to verify the indication of malware infection.
-search: '`sysmon` EventCode=8 TargetImage IN ("*\\Taskmgr.exe", "*\\calc.exe", "*\\notepad.exe", "*\\rdpclip.exe", "*\\explorer.exe", "*\\wermgr.exe", "*\\ping.exe") 
+search: '`sysmon` EventCode=8 TargetImage IN ("*\\Taskmgr.exe", "*\\calc.exe", "*\\notepad.exe", "*\\rdpclip.exe", "*\\explorer.exe", "*\\wermgr.exe", "*\\ping.exe", "*\\OneDriveSetup.exe", "*\\dxdiag.exe", "*\\mobsync.exe", "*\\msra.exe", "*\\xwizard.exe") 
   | stats count min(_time) as firstTime max(_time) as lastTime by  TargetImage TargetProcessId SourceProcessId  EventCode StartAddress SourceImage Computer 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 

tests/endpoint/windows_app_layer_protocol_qakbot_namedpipe.test.yml

@@ -0,0 +1,13 @@
+name: Windows App Layer Protocol Qakbot NamedPipe Unit Test
+tests:
+- name: Windows App Layer Protocol Qakbot NamedPipe
+  file: endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true