From e6e1004bd4e507a5150d27ff2d98488aa9855159 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 30 Sep 2021 10:29:01 +0200 Subject: [PATCH] privilege_escalation_persistence --- .../disable_uac_remote_restriction.yml | 70 +++++++++++++++++++ .../time_provider_persistence_registry.yml | 69 ++++++++++++++++++ .../disable_uac_remote_restriction.test.yml | 12 ++++ ...ime_provider_persistence_registry.test.yml | 12 ++++ 4 files changed, 163 insertions(+) create mode 100644 detections/endpoint/disable_uac_remote_restriction.yml create mode 100644 detections/endpoint/time_provider_persistence_registry.yml create mode 100644 tests/endpoint/disable_uac_remote_restriction.test.yml create mode 100644 tests/endpoint/time_provider_persistence_registry.test.yml diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml new file mode 100644 index 0000000000..b4edf0f040 --- /dev/null +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -0,0 +1,70 @@ +name: Disable UAC Remote Restriction +id: 9928b732-210e-11ec-b65e-acde48001122 +version: 1 +date: '2021-09-29' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious modification of registry to disable UAC remote restriction. + This technique was well documented in Microsoft page where attacker may modify this registry value to bypassed UAC feature of windows host. + This is a good indicator that some tries to bypassed UAC to suspicious process or gain privilege escalation. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path ="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" + by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `disable_uac_remote_restriction_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: admin may set this policy for non-critical machine. +references: +- https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Suspicious Windows Registry Activities + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1548.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.registry_value_data + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + + \ No newline at end of file diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml new file mode 100644 index 0000000000..2361331d40 --- /dev/null +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -0,0 +1,69 @@ +name: Time Provider Persistence Registry +id: 5ba382c4-2105-11ec-8d8f-acde48001122 +version: 1 +date: '2021-09-29' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspiciouos modification of time provider registry for persistence and autostart. + This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. + This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" + by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `time_provider_persistence_registry_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://pentestlab.blog/2019/10/22/persistence-time-providers/ +- https://attack.mitre.org/techniques/T1547/003/ +tags: + analytic_story: + - Windows Persistence Techniques + - Windows Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1547.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + \ No newline at end of file diff --git a/tests/endpoint/disable_uac_remote_restriction.test.yml b/tests/endpoint/disable_uac_remote_restriction.test.yml new file mode 100644 index 0000000000..4adb6f2d25 --- /dev/null +++ b/tests/endpoint/disable_uac_remote_restriction.test.yml @@ -0,0 +1,12 @@ +name: Disable UAC Remote Restriction Unit Test +tests: +- name: Disable UAC Remote Restriction + file: endpoint/disable_uac_remote_restriction.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/time_provider_persistence_registry.test.yml b/tests/endpoint/time_provider_persistence_registry.test.yml new file mode 100644 index 0000000000..4de49c3411 --- /dev/null +++ b/tests/endpoint/time_provider_persistence_registry.test.yml @@ -0,0 +1,12 @@ +name: Time Provider Persistence Registry Unit Test +tests: +- name: Time Provider Persistence Registry + file: endpoint/time_provider_persistence_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file