admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inBcdedit Command Back To Normal Mode Boot

Browse Source
This commit is contained in:
root
2021-09-07 12:40:43 +00:00
parent ba61023e49
commit e39b2ff3b9
1 changed files with 21 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
+21 -20
View File
@@ -6,25 +6,25 @@ author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: This search is to detect a suspicious bcdedit commandline to configure the host from safe mode back to normal boot configuration.
This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue its encryption and bring back to normal boot using
bcdedit deletevalue command.
This TTP can be a good alert for host that booted from safe mode forcefully since it need to modify the boot configuration to bring it back to normal.
description: This search is to detect a suspicious bcdedit commandline to configure
the host from safe mode back to normal boot configuration. This technique was seen
in blackMatter ransomware where it force the compromised host to boot in safe mode
to continue its encryption and bring back to normal boot using bcdedit deletevalue
command. This TTP can be a good alert for host that booted from safe mode forcefully
since it need to modify the boot configuration to bring it back to normal.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe
Processes.process="*/deletevalue*" Processes.process="*{current}*" Processes.process="*safeboot*" by Processes.process_name
Processes.process Processes.parent_process_name Processes.dest Processes.user
|`drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `bcdedit_command_back_to_normal_mode_boot_filter`'
Processes.process="*/deletevalue*" Processes.process="*{current}*" Processes.process="*safeboot*"
by Processes.process_name Processes.process Processes.parent_process_name Processes.dest
Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `bcdedit_command_back_to_normal_mode_boot_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives: unknown
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
tags:
analytic_story:
- BlackMatter Ransomware
@@ -41,20 +41,20 @@ tags:
required_fields:
- _time
- Processes.process_name
- Processes.process
- Processes.process
- Processes.parent_process_name
- Processes.parent_process
- Processes.dest
- Processes.user
- Processes.parent_process
- Processes.dest
- Processes.user
security_domain: endpoint
impact: 50
confidence: 70
# (impact * confidence)/100
risk_score: 35
context:
- Source:Endpoint
- Stage:Impact
message: bcdedit process with commandline $process$ to bring back to normal boot configuration the $dest$
- Source:Endpoint
- Stage:Impact
message: bcdedit process with commandline $process$ to bring back to normal boot
configuration the $dest$
observable:
- name: user
type: User
@@ -63,4 +63,5 @@ tags:
- name: dest
type: Hostname
role:
- Victim
- Victim
automated_detection_testing: passed