privilege_escalation_persistence

detections/endpoint/disable_uac_remote_restriction.yml

@@ -0,0 +1,70 @@
+name: Disable UAC Remote Restriction
+id: 9928b732-210e-11ec-b65e-acde48001122
+version: 1
+date: '2021-09-29'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious modification of registry to disable UAC remote restriction. 
+  This technique was well documented in Microsoft page where attacker may modify this registry value to bypassed UAC feature of windows host. 
+  This is a good indicator that some tries to bypassed UAC to suspicious process or gain privilege escalation.
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path ="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001"
+  by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
+  | `security_content_ctime(lastTime)`  
+  | `security_content_ctime(firstTime)`
+  | `drop_dm_object_name(Registry)` 
+  | `disable_uac_remote_restriction_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: admin may set this policy for non-critical machine.
+references:
+-  https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Suspicious Windows Registry Activities
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1548.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest 
+  - Registry.user 
+  - Registry.registry_path 
+  - Registry.registry_key_name 
+  - Registry.registry_value_name 
+  - Registry.registry_value_data
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  
+  

detections/endpoint/time_provider_persistence_registry.yml

@@ -0,0 +1,69 @@
+name: Time Provider Persistence Registry
+id: 5ba382c4-2105-11ec-8d8f-acde48001122
+version: 1
+date: '2021-09-29'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspiciouos modification of time provider registry for persistence and autostart. 
+  This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. 
+  This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin.
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" 
+  by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name 
+  | `security_content_ctime(lastTime)`  
+  | `security_content_ctime(firstTime)`
+  | `drop_dm_object_name(Registry)`
+  | `time_provider_persistence_registry_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: unknown
+references:
+- https://pentestlab.blog/2019/10/22/persistence-time-providers/
+- https://attack.mitre.org/techniques/T1547/003/
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  - Windows Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1547.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest 
+  - Registry.user 
+  - Registry.registry_path 
+  - Registry.registry_key_name 
+  - Registry.registry_value_name 
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  

tests/endpoint/disable_uac_remote_restriction.test.yml

@@ -0,0 +1,12 @@
+name: Disable UAC Remote Restriction Unit Test
+tests:
+- name: Disable UAC Remote Restriction
+  file: endpoint/disable_uac_remote_restriction.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/time_provider_persistence_registry.test.yml

@@ -0,0 +1,12 @@
+name: Time Provider Persistence Registry Unit Test
+tests:
+- name: Time Provider Persistence Registry 
+  file: endpoint/time_provider_persistence_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog