From df736d2d087c4d5feff914fd653f3e8a32c45658 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 14 Apr 2023 10:32:12 -0600 Subject: [PATCH] HVCI Disable and story --- .../windows_impair_defenses_disable_hvci.yml | 52 +++++++++++++++++++ stories/blacklotus_campaign.yml | 20 +++++++ 2 files changed, 72 insertions(+) create mode 100644 detections/endpoint/windows_impair_defenses_disable_hvci.yml create mode 100644 stories/blacklotus_campaign.yml diff --git a/detections/endpoint/windows_impair_defenses_disable_hvci.yml b/detections/endpoint/windows_impair_defenses_disable_hvci.yml new file mode 100644 index 0000000000..b9f54b7d12 --- /dev/null +++ b/detections/endpoint/windows_impair_defenses_disable_hvci.yml @@ -0,0 +1,52 @@ +name: Windows Impair Defenses Disable HVCI +id: b061dfcc-f0aa-42cc-a6d4-a87f172acb79 +version: 1 +date: '2023-04-13' +author: Michael Haag, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 13 +description: The following analytic refers to a detection mechanism designed to identify when the Hypervisor-protected Code Integrity (HVCI) feature is disabled within the Windows registry. HVCI is a security feature in Windows 10 and Windows Server 2016 that helps protect the kernel and system processes from being tampered with by malicious code. +HVCI relies on hardware-assisted virtualization and Microsoft's Hyper-V hypervisor to ensure that only kernel-mode code that has been signed by Microsoft or the system's hardware manufacturer can be executed. This prevents attackers from exploiting vulnerabilities to run unsigned code, like kernel-mode rootkits or other malicious software, at the kernel level. +Disabling HVCI may expose the system to security risks and could be an indicator of a potential compromise or unauthorized activity. The analytic aims to detect and report events or configurations that lead to the disabling of HVCI. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity\\Enabled" Registry.registry_value_data="0x00000000" by Registry.registry_path Registry.registry_value_name + Registry.registry_value_data Registry.process_guid Registry.action Registry.user + Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_hvci_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives will be limited to administrative scripts disabling HVCI. Filter as needed. +references: + - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ +tags: + analytic_story: + - BlackLotus Campaign + - Windows Defense Evasion Tactics + - Windows Registry Abuse + asset_type: Endpoint + atomic_guid: + - 70bd71e6-eba4-4e00-92f7-617911dbe020 + confidence: 100 + impact: 70 + message: HVCI has been disabled on $dest$. + mitre_attack_id: + - T1562.001 + - T1562 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 70 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/hvci_windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/stories/blacklotus_campaign.yml b/stories/blacklotus_campaign.yml new file mode 100644 index 0000000000..41b8b6e651 --- /dev/null +++ b/stories/blacklotus_campaign.yml @@ -0,0 +1,20 @@ +name: BlackLotus Campaign +id: 8eb0e418-a2b6-4327-a387-85c976662c8f +version: 1 +date: '2023-04-14' +author: Michael Haag, Splunk +description: The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality +narrative: "The number of UEFI vulnerabilities discovered in recent years and the failures in patching them or revoking vulnerable binaries within a reasonable time window hasn't gone unnoticed by threat actors. As a result, the first publicly known UEFI bootkit bypassing the essential platform security feature UEFI Secure Boot is now a reality. present the first public analysis of this UEFI bootkit, which is capable of running on even fully-up-to-date Windows 11 systems with UEFI Secure Boot enabled. Functionality of the bootkit and its individual features leads us to believe that we are dealing with a bootkit known as BlackLotus, the UEFI bootkit being sold on hacking forums for $5,000 since at least October 2022. (ESET, 2023) + The following content aims to aid defenders in detecting suspicious bootloaders and understanding the diverse techniques employed in this campaign." +references: + - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ + - https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/ +tags: + analytic_story: BlackLotus Campaign + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection