From dfd210cf297cd43f11aa0618b7330574a7ee7ca9 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 25 Nov 2021 12:27:39 +0100 Subject: [PATCH] remcos_evasion --- .../add_or_set_windows_defender_exclusion.yml | 75 +++++++++++++++++++ ...ll_windows_defender_exclusion_commands.yml | 65 ++++++++++++++++ ...dows_defender_exclusion_registry_entry.yml | 68 +++++++++++++++++ ...or_set_windows_defender_exclusion.test.yml | 12 +++ ...ndows_defender_exclusion_commands.test.yml | 12 +++ ...defender_exclusion_registry_entry.test.yml | 12 +++ 6 files changed, 244 insertions(+) create mode 100644 detections/endpoint/add_or_set_windows_defender_exclusion.yml create mode 100644 detections/endpoint/powershell_windows_defender_exclusion_commands.yml create mode 100644 detections/endpoint/windows_defender_exclusion_registry_entry.yml create mode 100644 tests/endpoint/add_or_set_windows_defender_exclusion.test.yml create mode 100644 tests/endpoint/powershell_windows_defender_exclusion_commands.test.yml create mode 100644 tests/endpoint/windows_defender_exclusion_registry_entry.test.yml diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml new file mode 100644 index 0000000000..de9004167a --- /dev/null +++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml @@ -0,0 +1,75 @@ +name: Add or Set Windows Defender Exclusion +id: 773b66fe-4dd9-11ec-8289-acde48001122 +version: 1 +date: '2021-11-25' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic will detect a suspicious process commandline related to windows defender exclusion feature. + This command is abused by adversaries, malware author and red teams to bypassed Windows Defender Anti-Virus product + by excluding folder path, file path, process, extensions and etc. from its real time or schedule scan to execute their malicious code. + This is a good indicator for defense evasion and to look further for events after this behavior. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*Add-MpPreference *" OR Processes.process = "*Set-MpPreference *") + AND Processes.process="*-exclusion*" + by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `add_or_set_windows_defender_exclusion_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin or user may choose to use this windows features. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html +- https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/ +tags: + analytic_story: + - Remcos + - Windows Defense Evasion Tactics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: exclusion command $process$ executed on $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml new file mode 100644 index 0000000000..28477b8dd4 --- /dev/null +++ b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml @@ -0,0 +1,65 @@ +name: Powershell Windows Defender Exclusion Commands +id: 907ac95c-4dd9-11ec-ba2c-acde48001122 +version: 1 +date: '2021-11-25' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic will detect a suspicious process commandline related to windows defender exclusion feature. + This command is abused by adversaries, malware author and red teams to bypassed Windows Defender Anti-Virus product + by excluding folder path, file path, process, extensions and etc. from its real time or schedule scan to execute their malicious code. + This is a good indicator for defense evasion and to look further for events after this behavior. +search: '`powershell` EventCode=4104 (Message = "*Add-MpPreference *" OR Message = "*Set-MpPreference *") AND Message = "*-exclusion*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_windows_defender_exclusion_commands_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin or user may choose to use this windows features. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html +- https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/ +tags: + analytic_story: + - Remcos + - Windows Defense Evasion Tactics + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: exclusion command $Message$ executed on $ComputerName$ + observable: + - name: User + type: User + role: + - Victim + - name: ComputerName + type: Hostname + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml new file mode 100644 index 0000000000..b0ce42caef --- /dev/null +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -0,0 +1,68 @@ +name: Windows Defender Exclusion Registry Entry +id: 13395a44-4dd9-11ec-9df7-acde48001122 +version: 1 +date: '2021-11-25' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic will detect a suspicious process that modify a registry related to windows defender exclusion feature. + This registry is abused by adversaries, malware author and red teams to bypassed Windows Defender Anti-Virus product + by excluding folder path, file path, process, extensions and etc. from its real time or schedule scan to execute their malicious code. + This is a good indicator for a defense evasion and to look further for events after this behavior. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\*" + by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_defender_exclusion_registry_entry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: admin or user may choose to use this windows features. +references: +- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html +- https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/ +tags: + analytic_story: + - Remcos + - Windows Defense Evasion Tactics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.registry_value_data + security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: exclusion registry $registry_path$ modified or added on $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + \ No newline at end of file diff --git a/tests/endpoint/add_or_set_windows_defender_exclusion.test.yml b/tests/endpoint/add_or_set_windows_defender_exclusion.test.yml new file mode 100644 index 0000000000..0d300b72d6 --- /dev/null +++ b/tests/endpoint/add_or_set_windows_defender_exclusion.test.yml @@ -0,0 +1,12 @@ +name: Add or Set Windows Defender Exclusion Unit Test +tests: +- name: Add or Set Windows Defender Exclusion + file: endpoint/add_or_set_windows_defender_exclusion.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/powershell_windows_defender_exclusion_commands.test.yml b/tests/endpoint/powershell_windows_defender_exclusion_commands.test.yml new file mode 100644 index 0000000000..d26ea54f80 --- /dev/null +++ b/tests/endpoint/powershell_windows_defender_exclusion_commands.test.yml @@ -0,0 +1,12 @@ +name: Powershell Windows Defender Exclusion Commands Unit Test +tests: +- name: Powershell Windows Defender Exclusion Commands + file: endpoint/powershell_windows_defender_exclusion_commands.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/defender_exclusion_powershell/powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/windows_defender_exclusion_registry_entry.test.yml b/tests/endpoint/windows_defender_exclusion_registry_entry.test.yml new file mode 100644 index 0000000000..4fc9e0082f --- /dev/null +++ b/tests/endpoint/windows_defender_exclusion_registry_entry.test.yml @@ -0,0 +1,12 @@ +name: Windows Defender Exclusion Registry Entry Unit Test +tests: +- name: Windows Defender Exclusion Registry Entry + file: endpoint/windows_defender_exclusion_registry_entry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file