diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index f7ddc36c9d..aef81e69e8 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,7 +1,7 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 version: 1 -date: '2021-05-06' +date: '2021-10-06' author: Teoderick Contreras, Splunk type: Anomaly datamodel: @@ -33,6 +33,7 @@ known_false_positives: Administrators may allow creation of script or exe in the references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +- https://twitter.com/pr0xylife/status/1590394227758104576 tags: analytic_story: - Double Zero Destructor @@ -47,6 +48,7 @@ tags: - Brute Ratel C4 - AgentTesla - Qakbot + - IcedID automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index d1f9a35ae9..bc5e992a48 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -26,6 +26,8 @@ known_false_positives: Normal Office Document macro use for automation references: - https://www.joesandbox.com/analysis/386500/0/html - https://www.joesandbox.com/analysis/702680/0/html +- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/ +- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing tags: analytic_story: - Spearphishing Attachments @@ -34,6 +36,8 @@ tags: - DarkCrystal RAT - AgentTesla - Qakbot + - Azorult + - Remcos confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml index ee2c24c7c4..9cde991f53 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/endpoint/office_product_spawn_cmd_process.yml @@ -27,10 +27,14 @@ known_false_positives: IT or network admin may create an document automation tha will run shell script. references: - https://twitter.com/cyb3rops/status/1416050325870587910?s=21 +- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/ +- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing tags: analytic_story: - Trickbot - DarkCrystal RAT + - Azorult + - Remcos confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/office_product_spawning_windows_script_host.yml b/detections/endpoint/office_product_spawning_windows_script_host.yml index 9c2dba2783..5794eb6433 100644 --- a/detections/endpoint/office_product_spawning_windows_script_host.yml +++ b/detections/endpoint/office_product_spawning_windows_script_host.yml @@ -18,9 +18,11 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present based on macro based approved documents in the organization. Filtering may be needed. references: - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ + - https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing tags: analytic_story: - Spearphishing Attachments + - Remcos confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index 87e4c99fa4..f586c5da48 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -30,10 +30,12 @@ known_false_positives: This detection should yield little or no false positive r references: - https://attack.mitre.org/techniques/T1566/001/ - https://www.trendmicro.com/en_us/research/17/e/rising-trend-attackers-using-lnk-files-download-malware.html +- https://twitter.com/pr0xylife/status/1590394227758104576 tags: analytic_story: - Spearphishing Attachments - Qakbot + - IcedID asset_type: Endpoint cis20: - CIS 7 diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index 9058357029..2deec4a798 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -30,11 +30,13 @@ known_false_positives: False positives are possible with native utilities and th references: - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ - https://twitter.com/M_haggis/status/1491109262428635136 + - https://twitter.com/pr0xylife/status/1590394227758104576 tags: analytic_story: - Unusual Processes - Suspicious Rundll32 Activity - Living Off The Land + - IcedID asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 6b4b5760a5..d094ae78b2 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -30,6 +30,7 @@ known_false_positives: Administrators may allow execution of specific binaries i references: - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +- https://twitter.com/pr0xylife/status/1590394227758104576 tags: analytic_story: - Data Destruction @@ -43,6 +44,7 @@ tags: - Brute Ratel C4 - AgentTesla - Qakbot + - IcedID automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml b/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml new file mode 100644 index 0000000000..6409d58423 --- /dev/null +++ b/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml @@ -0,0 +1,72 @@ +name: Windows App Layer Protocol Qakbot NamedPipe +id: 63a2c15e-9448-43c5-a4a8-9852266aaada +version: 1 +date: '2022-11-10' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies a suspicious process creating or connecting to a possible Qakbot named pipe . + This technique was seen in Qakbot malware that creates named pipe after injecting its code in legitimate process to communicate + on other process that also has an injected code to steal information on the compromised host. This Anomaly detection can be a + good pivot for possible Qakbot infection. This detection looks for possible random generated named pipe (in GUID form) created by known process + being abused by Qakbot. +search: '`sysmon` EventCode IN (17, 18) EventType IN ( "CreatePipe", "ConnectPipe") + Image IN ("*\\calc.exe", "*\\notepad.exe", "*\\rdpclip.exe", "*\\explorer.exe", "*\\wermgr.exe", "*\\ping.exe", "*\\OneDriveSetup.exe", "*\\dxdiag.exe", "*\\mobsync.exe", "*\\msra.exe", "*\\xwizard.exe") + | regex PipeName="^\\\{[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{8}" + | stats min(_time) as firstTime max(_time) as lastTime count by Image EventType ProcessGuid ProcessId PipeName SecurityID EventCode Computer UserID + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_app_layer_protocol_qakbot_namedpipe_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, pipename, processguid and named pipe event type from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://strontic.github.io/xcyclopedia/library/wermgr.exe-0F652BF7ADA772981E8AAB0D108FCC92.html +- https://www.trellix.com/en-us/about/newsroom/stories/research/demystifying-qbot-malware.html +- https://www.elastic.co/security-labs/qbot-malware-analysis +tags: + analytic_story: + - Qakbot + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Command And Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: $Image$ is creating or connecting to a named pipe $PipeName$ in $Computer$ + mitre_attack_id: + - T1071 + nist: + - DE.CM + observable: + - name: Computer + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - EventType + - ProcessGuid + - ProcessId + - PipeName + - Computer + - UserID + - SecurityID + risk_score: 49 + security_domain: endpoint diff --git a/detections/endpoint/windows_iso_lnk_file_creation.yml b/detections/endpoint/windows_iso_lnk_file_creation.yml index c2c8f98add..50a6a9e226 100644 --- a/detections/endpoint/windows_iso_lnk_file_creation.yml +++ b/detections/endpoint/windows_iso_lnk_file_creation.yml @@ -19,11 +19,17 @@ known_false_positives: False positives may be high depending on the environment references: - https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ - https://github.com/MHaggis/notes/blob/master/utilities/ISOBuilder.ps1 +- https://isc.sans.edu/diary/Recent+AZORult+activity/25120 +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html tags: analytic_story: - Spearphishing Attachments - Brute Ratel C4 - AgentTesla + - Qakbot + - IcedID + - Azorult + - Remcos asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml b/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml index c8752f24d6..6ed96c32e3 100644 --- a/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml +++ b/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml @@ -1,7 +1,7 @@ name: Windows Modify Registry Qakbot Binary Data Registry id: 2e768497-04e0-4188-b800-70dd2be0e30d version: 1 -date: '2022-10-21' +date: '2022-11-10' author: Teoderick Contreras, Bhavin Patel, Splunk type: Anomaly datamodel: @@ -21,7 +21,7 @@ search: '| tstats `security_content_summariesonly` count dc(registry_value_name) | where registry_key_name_len < 80 AND registry_value_name_len == 8 | join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name IN ("explorer.exe", "wermgr.exe","dxdiag.exe") + where Processes.process_name IN ("explorer.exe", "wermgr.exe","dxdiag.exe", "OneDriveSetup.exe", "mobsync.exe", "msra.exe", "xwizard.exe") by _time span=1m Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid Processes.process_path | `drop_dm_object_name(Processes)` | rename process_guid as proc_guid diff --git a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml index cd534de3c2..2261d05d7a 100644 --- a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml +++ b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml @@ -26,10 +26,16 @@ known_false_positives: False positives may be high depending on the environment references: - https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ - https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ +- https://isc.sans.edu/diary/Recent+AZORult+activity/25120 +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html tags: analytic_story: - Brute Ratel C4 - AgentTesla + - Qakbot + - IcedID + - Azorult + - Remcos asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_process_injection_remote_thread.yml b/detections/endpoint/windows_process_injection_remote_thread.yml index 004d3e9656..1357bd973e 100644 --- a/detections/endpoint/windows_process_injection_remote_thread.yml +++ b/detections/endpoint/windows_process_injection_remote_thread.yml @@ -1,7 +1,7 @@ name: Windows Process Injection Remote Thread id: 8a618ade-ca8f-4d04-b972-2d526ba59924 version: 1 -date: '2022-10-27' +date: '2022-11-10' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -10,7 +10,7 @@ description: The following analytic identifies a suspicious remote thread execut qakbot. Qakbot is one of the malware using this technique to load its malicious dll module or malicious code in the targeted host. This TTP can be a good pivot to verify what is the behavior of the targeted Image process after this detection trigger. look for network connection, child process execution, file access and many more that helps to verify the indication of malware infection. -search: '`sysmon` EventCode=8 TargetImage IN ("*\\Taskmgr.exe", "*\\calc.exe", "*\\notepad.exe", "*\\rdpclip.exe", "*\\explorer.exe", "*\\wermgr.exe", "*\\ping.exe") +search: '`sysmon` EventCode=8 TargetImage IN ("*\\Taskmgr.exe", "*\\calc.exe", "*\\notepad.exe", "*\\rdpclip.exe", "*\\explorer.exe", "*\\wermgr.exe", "*\\ping.exe", "*\\OneDriveSetup.exe", "*\\dxdiag.exe", "*\\mobsync.exe", "*\\msra.exe", "*\\xwizard.exe") | stats count min(_time) as firstTime max(_time) as lastTime by TargetImage TargetProcessId SourceProcessId EventCode StartAddress SourceImage Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/tests/endpoint/windows_app_layer_protocol_qakbot_namedpipe.test.yml b/tests/endpoint/windows_app_layer_protocol_qakbot_namedpipe.test.yml new file mode 100644 index 0000000000..3b36af067d --- /dev/null +++ b/tests/endpoint/windows_app_layer_protocol_qakbot_namedpipe.test.yml @@ -0,0 +1,13 @@ +name: Windows App Layer Protocol Qakbot NamedPipe Unit Test +tests: +- name: Windows App Layer Protocol Qakbot NamedPipe + file: endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true