From 391cded0c73e43b920b2f1c9221f52e846568200 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 25 Aug 2023 09:30:30 -0600 Subject: [PATCH 1/3] Flax Typhoon --- .../detection/attacker_tools_on_endpoint.yml | 17 ++++-- .../endpoint/bitsadmin_download_file.yml | 1 + ...load_with_urlcache_and_split_arguments.yml | 1 + .../detect_webshell_exploit_behavior.yml | 1 + .../endpoint/dump_lsass_via_comsvcs_dll.yml | 1 + .../overwriting_accessibility_binaries.yml | 1 + .../endpoint/powershell_4104_hunting.yml | 1 + detections/endpoint/w3wp_spawning_shell.yml | 1 + .../windows_mimikatz_binary_execution.yml | 1 + ...e_created_with_suspicious_service_path.yml | 1 + .../windows_sql_spawning_certutil.yml | 59 +++++++++++++++++++ stories/flax_typhoon.yml | 18 ++++++ 12 files changed, 99 insertions(+), 4 deletions(-) create mode 100644 detections/endpoint/windows_sql_spawning_certutil.yml create mode 100644 stories/flax_typhoon.yml diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/detection/attacker_tools_on_endpoint.yml b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/detection/attacker_tools_on_endpoint.yml index 87f34878e4..7d9dec8ae9 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/detection/attacker_tools_on_endpoint.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/detection/attacker_tools_on_endpoint.yml @@ -1,13 +1,22 @@ name: Attacker Tools On Endpoint id: a51bfe1a-94f0-48cc-b4e4-16a110145893 -version: 2 -date: '2021-11-04' +version: 3 +date: '2023-08-25' author: Bhavin Patel, Splunk type: TTP datamodel: - Endpoint -description: This search looks for execution of commonly used attacker tools on an - endpoint. +description: This search looks for the execution of commonly used attacker tools on an + endpoint. These tools, listed in the attacker_tools.csv, include remcom.exe, an open-source + replacement for psexec, pwdump.exe and pwdump2.exe, which are used to dump password hashes + on a Windows system, and nc.exe, an open-source tool used for network communications. Other + tools like wce.exe, used for dumping hashes and executing pass-the-hash and pass-the-ticket + attacks, and cain.exe, used for collecting user credentials and executing attacks, are also + monitored. The search also tracks tools like nmap.exe, an open-source network mapping tool, + and kidlogger.exe, used for collecting keyboard input on a host. The list also includes + tools that are used by attackers to hide in plain sight and look like legitimate Windows + system processes, such as isass.exe and svch0st.exe. The search is designed to provide + comprehensive monitoring of potential threats and unauthorized software on an endpoint. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index 9fcf19a863..9adebd11d9 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -43,6 +43,7 @@ tags: - BITS Jobs - DarkSide Ransomware - Living Off The Land + - Flax Typhoon asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml index 7cf0f390fb..422da9cbf9 100644 --- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml @@ -38,6 +38,7 @@ tags: - Living Off The Land - ProxyNotShell - CISA AA22-277A + - Flax Typhoon asset_type: Endpoint confidence: 100 impact: 90 diff --git a/detections/endpoint/detect_webshell_exploit_behavior.yml b/detections/endpoint/detect_webshell_exploit_behavior.yml index 567e1d055f..216d7dc674 100644 --- a/detections/endpoint/detect_webshell_exploit_behavior.yml +++ b/detections/endpoint/detect_webshell_exploit_behavior.yml @@ -44,6 +44,7 @@ tags: - BlackByte Ransomware - CISA AA22-264A - Citrix ShareFile RCE CVE-2023-24489 + - Flax Typhoon asset_type: Endpoint confidence: 80 impact: 100 diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index 385ac36c5b..0dffb958bd 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -35,6 +35,7 @@ tags: - Suspicious Rundll32 Activity - Data Destruction - Volt Typhoon + - Flax Typhoon asset_type: Endpoint confidence: 100 impact: 80 diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index c0dc52acf1..dbfe3a023d 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -31,6 +31,7 @@ tags: - Data Destruction - Hermetic Wiper - Windows Privilege Escalation + - Flax Typhoon asset_type: Endpoint confidence: 90 impact: 80 diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index d90a27e503..38f68b2011 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -59,6 +59,7 @@ tags: - Malicious PowerShell - Hermetic Wiper - Data Destruction + - Flax Typhoon asset_type: Endpoint confidence: 100 impact: 80 diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml index 36bb5e4074..0068073ae8 100644 --- a/detections/endpoint/w3wp_spawning_shell.yml +++ b/detections/endpoint/w3wp_spawning_shell.yml @@ -44,6 +44,7 @@ tags: - HAFNIUM Group - BlackByte Ransomware - CISA AA22-264A + - Flax Typhoon asset_type: Endpoint confidence: 80 cve: diff --git a/detections/endpoint/windows_mimikatz_binary_execution.yml b/detections/endpoint/windows_mimikatz_binary_execution.yml index 9a876ef214..5fca729b57 100644 --- a/detections/endpoint/windows_mimikatz_binary_execution.yml +++ b/detections/endpoint/windows_mimikatz_binary_execution.yml @@ -38,6 +38,7 @@ tags: - CISA AA22-320A - Sandworm Tools - Volt Typhoon + - Flax Typhoon asset_type: Endpoint confidence: 100 impact: 100 diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index df1174cda0..7831cd17b8 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -33,6 +33,7 @@ tags: - Brute Ratel C4 - Qakbot - Snake Malware + - Flax Typhoon asset_type: Endpoint confidence: 80 impact: 70 diff --git a/detections/endpoint/windows_sql_spawning_certutil.yml b/detections/endpoint/windows_sql_spawning_certutil.yml new file mode 100644 index 0000000000..de74aee1eb --- /dev/null +++ b/detections/endpoint/windows_sql_spawning_certutil.yml @@ -0,0 +1,59 @@ +name: Windows SQL Spawning CertUtil +id: dfc18a5a-946e-44ee-a373-c0f60d06e676 +version: 1 +date: '2023-08-25' +author: Michael Haag, Splunk +status: Experimental +type: TTP +data_source: +- Sysmon Event ID 1 +description: 'The following analytic detects the use of certutil to download software, a behavior exhibited by the threat actor Flax Typhoon. This actor deploys a VPN connection by downloading an executable file for SoftEther VPN from their network infrastructure using one of several LOLBins, including certutil. The actor then uses the Service Control Manager (SCM) to create a Windows service that launches the VPN connection automatically when the system starts. This behavior allows the actor to monitor the availability of the compromised system and establish an RDP connection. This analytic identifies this behavior by monitoring for the use of certutil in conjunction with the downloading of software. This behavior is worth identifying for a SOC as it indicates a potential compromise of the system and the establishment of a persistent threat. If a true positive is found, it suggests an attacker has gained access to the environment and is attempting to maintain that access, potentially leading to further malicious activities such as data theft or ransomware attacks. Be aware of potential false positives - legitimate uses of certutil in your environment may cause benign activities to be flagged. Upon triage, review the command executed and look for concurrent processes to identify the attack source. This approach helps analysts detect potential threats earlier and mitigate the risks.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("sqlservr.exe", "sqlagent.exe", "sqlps.exe", "launchpad.exe", "sqldumper.exe") `process_certutil` (Processes.process=*urlcache* Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_sql_spawning_certutil_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: The occurrence of false positives should be minimal, given that the SQL agent does not typically download software using CertUtil. +references: +- https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/ +tags: + analytic_story: + - Flax Typhoon + asset_type: Endpoint + atomic_guid: [] + confidence: 100 + impact: 90 + message: '$process_name$ was launched on $dest$ by $user$. This behavior is uncommon with the SQL process identified.' + mitre_attack_id: + - T1105 + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + - name: process_name + type: Process + role: + - Target + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 90 + required_fields: + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.original_file_name + - Processes.parent_process_id + security_domain: endpoint +tests: [] diff --git a/stories/flax_typhoon.yml b/stories/flax_typhoon.yml new file mode 100644 index 0000000000..922b09ef8d --- /dev/null +++ b/stories/flax_typhoon.yml @@ -0,0 +1,18 @@ +name: Flax Typhoon +id: 78fadce9-a07f-4508-8d14-9b20052a62cc +version: 1 +date: '2023-08-25' +author: Michael Haag, Splunk +description: Microsoft has identified a nation-state activity group, Flax Typhoon, based in China, targeting Taiwanese organizations for espionage. The group maintains long-term access to networks with minimal use of malware, relying on built-in OS tools and benign software. The group's activities are primarily focused on Taiwan, but the techniques used could be easily reused in other operations outside the region. Microsoft has not observed Flax Typhoon using this access to conduct additional actions. +narrative: Flax Typhoon has been active since mid-2021, targeting government agencies, education, critical manufacturing, and IT organizations in Taiwan. The group uses the China Chopper web shell, Metasploit, Juicy Potato privilege escalation tool, Mimikatz, and SoftEther VPN client. However, they primarily rely on living-off-the-land techniques and hands-on-keyboard activity. Initial access is achieved by exploiting known vulnerabilities in public-facing servers and deploying web shells. Following initial access, Flax Typhoon uses command-line tools to establish persistent access over the remote desktop protocol, deploy a VPN connection to actor-controlled network infrastructure, and collect credentials from compromised systems. The group also uses this VPN access to scan for vulnerabilities on targeted systems and organizations from the compromised systems. +references: +- https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/ +tags: + analytic_story: Flax Typhoon + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From 5df6e6379e6d70ffabf1a697d1e736c10ef66aae Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 25 Aug 2023 09:32:43 -0600 Subject: [PATCH 2/3] Update windows_sql_spawning_certutil.yml --- detections/endpoint/windows_sql_spawning_certutil.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_sql_spawning_certutil.yml b/detections/endpoint/windows_sql_spawning_certutil.yml index de74aee1eb..c046180240 100644 --- a/detections/endpoint/windows_sql_spawning_certutil.yml +++ b/detections/endpoint/windows_sql_spawning_certutil.yml @@ -3,7 +3,7 @@ id: dfc18a5a-946e-44ee-a373-c0f60d06e676 version: 1 date: '2023-08-25' author: Michael Haag, Splunk -status: Experimental +status: experimental type: TTP data_source: - Sysmon Event ID 1 From 073af28374126ab9e65eb771e5586605cbe73f68 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 25 Aug 2023 09:39:38 -0600 Subject: [PATCH 3/3] Update windows_sql_spawning_certutil.yml --- detections/endpoint/windows_sql_spawning_certutil.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/endpoint/windows_sql_spawning_certutil.yml b/detections/endpoint/windows_sql_spawning_certutil.yml index c046180240..3c9689795c 100644 --- a/detections/endpoint/windows_sql_spawning_certutil.yml +++ b/detections/endpoint/windows_sql_spawning_certutil.yml @@ -55,5 +55,4 @@ tags: - Processes.process_id - Processes.original_file_name - Processes.parent_process_id - security_domain: endpoint -tests: [] + security_domain: endpoint \ No newline at end of file