Branch was auto-updated.

bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/detection/attacker_tools_on_endpoint.yml

@@ -1,13 +1,22 @@
 name: Attacker Tools On Endpoint
 id: a51bfe1a-94f0-48cc-b4e4-16a110145893
-version: 2
-date: '2021-11-04'
+version: 3
+date: '2023-08-25'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search looks for execution of commonly used attacker tools on an
-  endpoint.
+description: This search looks for the execution of commonly used attacker tools on an
+  endpoint. These tools, listed in the attacker_tools.csv, include remcom.exe, an open-source
+  replacement for psexec, pwdump.exe and pwdump2.exe, which are used to dump password hashes
+  on a Windows system, and nc.exe, an open-source tool used for network communications. Other
+  tools like wce.exe, used for dumping hashes and executing pass-the-hash and pass-the-ticket
+  attacks, and cain.exe, used for collecting user credentials and executing attacks, are also
+  monitored. The search also tracks tools like nmap.exe, an open-source network mapping tool,
+  and kidlogger.exe, used for collecting keyboard input on a host. The list also includes
+  tools that are used by attackers to hide in plain sight and look like legitimate Windows
+  system processes, such as isass.exe and svch0st.exe. The search is designed to provide
+  comprehensive monitoring of potential threats and unauthorized software on an endpoint.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime values(Processes.process) as process values(Processes.parent_process)
   as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown

detections/endpoint/bitsadmin_download_file.yml

@@ -43,6 +43,7 @@ tags:
   - BITS Jobs
   - DarkSide Ransomware
   - Living Off The Land
+  - Flax Typhoon
   asset_type: Endpoint
   confidence: 70
   impact: 70

detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml

@@ -38,6 +38,7 @@ tags:
   - Living Off The Land
   - ProxyNotShell
   - CISA AA22-277A
+  - Flax Typhoon
   asset_type: Endpoint
   confidence: 100
   impact: 90

detections/endpoint/detect_webshell_exploit_behavior.yml

@@ -44,6 +44,7 @@ tags:
   - BlackByte Ransomware
   - CISA AA22-264A
   - Citrix ShareFile RCE CVE-2023-24489
+  - Flax Typhoon
   asset_type: Endpoint
   confidence: 80
   impact: 100

detections/endpoint/dump_lsass_via_comsvcs_dll.yml

@@ -35,6 +35,7 @@ tags:
   - Suspicious Rundll32 Activity
   - Data Destruction
   - Volt Typhoon
+  - Flax Typhoon
   asset_type: Endpoint
   confidence: 100
   impact: 80

detections/endpoint/overwriting_accessibility_binaries.yml

@@ -31,6 +31,7 @@ tags:
   - Data Destruction
   - Hermetic Wiper
   - Windows Privilege Escalation
+  - Flax Typhoon
   asset_type: Endpoint
   confidence: 90
   impact: 80

detections/endpoint/powershell_4104_hunting.yml

@@ -59,6 +59,7 @@ tags:
   - Malicious PowerShell
   - Hermetic Wiper
   - Data Destruction
+  - Flax Typhoon
   asset_type: Endpoint
   confidence: 100
   impact: 80

detections/endpoint/w3wp_spawning_shell.yml

@@ -44,6 +44,7 @@ tags:
   - HAFNIUM Group
   - BlackByte Ransomware
   - CISA AA22-264A
+  - Flax Typhoon
   asset_type: Endpoint
   confidence: 80
   cve:

detections/endpoint/windows_mimikatz_binary_execution.yml

@@ -38,6 +38,7 @@ tags:
   - CISA AA22-320A
   - Sandworm Tools
   - Volt Typhoon
+  - Flax Typhoon
   asset_type: Endpoint
   confidence: 100
   impact: 100

detections/endpoint/windows_service_created_with_suspicious_service_path.yml

@@ -33,6 +33,7 @@ tags:
   - Brute Ratel C4
   - Qakbot
   - Snake Malware
+  - Flax Typhoon
   asset_type: Endpoint
   confidence: 80
   impact: 70

detections/endpoint/windows_sql_spawning_certutil.yml

@@ -0,0 +1,58 @@
+name: Windows SQL Spawning CertUtil
+id: dfc18a5a-946e-44ee-a373-c0f60d06e676
+version: 1
+date: '2023-08-25'
+author: Michael Haag, Splunk
+status: experimental
+type: TTP
+data_source:
+- Sysmon Event ID 1
+description: 'The following analytic detects the use of certutil to download software, a behavior exhibited by the threat actor Flax Typhoon. This actor deploys a VPN connection by downloading an executable file for SoftEther VPN from their network infrastructure using one of several LOLBins, including certutil. The actor then uses the Service Control Manager (SCM) to create a Windows service that launches the VPN connection automatically when the system starts. This behavior allows the actor to monitor the availability of the compromised system and establish an RDP connection. This analytic identifies this behavior by monitoring for the use of certutil in conjunction with the downloading of software. This behavior is worth identifying for a SOC as it indicates a potential compromise of the system and the establishment of a persistent threat. If a true positive is found, it suggests an attacker has gained access to the environment and is attempting to maintain that access, potentially leading to further malicious activities such as data theft or ransomware attacks. Be aware of potential false positives - legitimate uses of certutil in your environment may cause benign activities to be flagged. Upon triage, review the command executed and look for concurrent processes to identify the attack source. This approach helps analysts detect potential threats earlier and mitigate the risks.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("sqlservr.exe", "sqlagent.exe", "sqlps.exe", "launchpad.exe", "sqldumper.exe") `process_certutil` (Processes.process=*urlcache* Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_sql_spawning_certutil_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: The occurrence of false positives should be minimal, given that the SQL agent does not typically download software using CertUtil.
+references:
+- https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/
+tags:
+  analytic_story:
+  - Flax Typhoon
+  asset_type: Endpoint
+  atomic_guid: []
+  confidence: 100
+  impact: 90
+  message: '$process_name$ was launched on $dest$ by $user$. This behavior is uncommon with the SQL process identified.'
+  mitre_attack_id:
+  - T1105
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Target
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 90
+  required_fields:
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.original_file_name
+  - Processes.parent_process_id
+  security_domain: endpoint

stories/flax_typhoon.yml

@@ -0,0 +1,18 @@
+name: Flax Typhoon
+id: 78fadce9-a07f-4508-8d14-9b20052a62cc
+version: 1
+date: '2023-08-25'
+author: Michael Haag, Splunk
+description: Microsoft has identified a nation-state activity group, Flax Typhoon, based in China, targeting Taiwanese organizations for espionage. The group maintains long-term access to networks with minimal use of malware, relying on built-in OS tools and benign software. The group's activities are primarily focused on Taiwan, but the techniques used could be easily reused in other operations outside the region. Microsoft has not observed Flax Typhoon using this access to conduct additional actions.
+narrative: Flax Typhoon has been active since mid-2021, targeting government agencies, education, critical manufacturing, and IT organizations in Taiwan. The group uses the China Chopper web shell, Metasploit, Juicy Potato privilege escalation tool, Mimikatz, and SoftEther VPN client. However, they primarily rely on living-off-the-land techniques and hands-on-keyboard activity. Initial access is achieved by exploiting known vulnerabilities in public-facing servers and deploying web shells. Following initial access, Flax Typhoon uses command-line tools to establish persistent access over the remote desktop protocol, deploy a VPN connection to actor-controlled network infrastructure, and collect credentials from compromised systems. The group also uses this VPN access to scan for vulnerabilities on targeted systems and organizations from the compromised systems.
+references: 
+- https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/
+tags:
+  analytic_story: Flax Typhoon
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection