From 6dba7cc848e8de861d3d49e8fb83f63f5f3c4ae1 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 7 Jul 2022 15:24:13 -0600 Subject: [PATCH 1/2] mav --- ...roxy_execution_mavinject_dll_injection.yml | 84 +++++++++++++++++++ ...execution_mavinject_dll_injection.test.yml | 13 +++ 2 files changed, 97 insertions(+) create mode 100644 detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml create mode 100644 tests/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.test.yml diff --git a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml new file mode 100644 index 0000000000..1108f1fe66 --- /dev/null +++ b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml @@ -0,0 +1,84 @@ +name: Windows Binary Proxy Execution Mavinject DLL Injection +id: ccf4b61b-1b26-4f2e-a089-f2009c569c57 +version: 1 +date: '2022-07-07' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. Dynamic-link Library Injection), allowing for arbitrary code execution (ex. C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL). + In addition to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import descriptor injection via its /HMODULE command-line parameter (ex. mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). This command would inject an import table entry consisting of the specified DLL into the module at the given base address. + During triage, review file modifcations and parallel processes. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mavinject.exe Processes.process IN ("*injectrunning*", "*hmodule=0x*") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_binary_proxy_execution_mavinject_dll_injection_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may be present, filter on DLL name or parent process. +references: + - https://attack.mitre.org/techniques/T1218/013/ + - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-1---mavinject---inject-dll-into-running-process +tags: + analytic_story: + - Living Off The Land + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.013/atomic_red_team/windows-sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting load a DLL. + mitre_attack_id: + - T1218.013 + - T1218 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process Name + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.test.yml b/tests/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.test.yml new file mode 100644 index 0000000000..b6dcd07f75 --- /dev/null +++ b/tests/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.test.yml @@ -0,0 +1,13 @@ +name: Windows Binary Proxy Execution Mavinject DLL Injection Unit Test +tests: +- name: Windows Binary Proxy Execution Mavinject DLL Injection + file: endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.013/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 43cb63d853a9847d3ab9f91f2ab6c6a5119bc0ea Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 19 Jul 2022 11:46:05 -0700 Subject: [PATCH 2/2] Update windows_binary_proxy_execution_mavinject_dll_injection.yml --- ...windows_binary_proxy_execution_mavinject_dll_injection.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml index 1108f1fe66..dd84570d4d 100644 --- a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml +++ b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml @@ -51,7 +51,7 @@ tags: type: User role: - Victim - - name: Computer + - name: dest type: Hostname role: - Victim @@ -81,4 +81,4 @@ tags: - Processes.process_path - Processes.parent_process_id risk_score: 49 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint