From 1b835f0d08df6a79851f92cc21f5bbfec26bce7d Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 11 May 2023 13:34:18 -0600 Subject: [PATCH 1/9] Guardians of the Haag: A Cosmic Adventure --- .../endpoint/windows_bootloader_inventory.yml | 1 + ...dows_registry_bootexecute_modification.yml | 56 ++++++++++++++++ ...snake_malware_file_modification_crmlog.yml | 53 +++++++++++++++ ...s_snake_malware_kernel_driver_comadmin.yml | 54 +++++++++++++++ ...istry_modification_wav_openwithprogids.yml | 55 +++++++++++++++ .../windows_snake_malware_service_create.yml | 60 +++++++++++++++++ ...inlogon_with_public_network_connection.yml | 67 +++++++++++++++++++ stories/snake_malware.yml | 35 ++++++++++ stories/windows_bootkits.yml | 22 ++++++ 9 files changed, 403 insertions(+) create mode 100644 detections/endpoint/windows_registry_bootexecute_modification.yml create mode 100644 detections/endpoint/windows_snake_malware_file_modification_crmlog.yml create mode 100644 detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml create mode 100644 detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml create mode 100644 detections/endpoint/windows_snake_malware_service_create.yml create mode 100644 detections/endpoint/windows_winlogon_with_public_network_connection.yml create mode 100644 stories/snake_malware.yml create mode 100644 stories/windows_bootkits.yml diff --git a/detections/endpoint/windows_bootloader_inventory.yml b/detections/endpoint/windows_bootloader_inventory.yml index a2b277fe1f..fa016fb29e 100644 --- a/detections/endpoint/windows_bootloader_inventory.yml +++ b/detections/endpoint/windows_bootloader_inventory.yml @@ -19,6 +19,7 @@ references: tags: analytic_story: - BlackLotus Campaign + - Windows BootKits asset_type: Endpoint atomic_guid: [] confidence: 90 diff --git a/detections/endpoint/windows_registry_bootexecute_modification.yml b/detections/endpoint/windows_registry_bootexecute_modification.yml new file mode 100644 index 0000000000..30734c22f4 --- /dev/null +++ b/detections/endpoint/windows_registry_bootexecute_modification.yml @@ -0,0 +1,56 @@ +name: Windows Registry BootExecute Modification +id: eabbac3a-45aa-4659-920f-6b8cff383fb8 +version: 1 +date: '2023-05-03' +author: Michael Haag, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 13 +description: This analytic monitors the BootExecute registry key for any modifications from its default value, which could indicate potential malicious activity. The BootExecute registry key, located at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager, manages the list of applications and services that are executed during system boot. By default, the BootExecute value is set to "autocheck autochk *". Attackers might attempt to modify this value to achieve persistence, load malicious code, or tamper with the system's boot process. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry + WHERE Registry.registry_path="HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\BootExecute" BY _time span=1h Registry.dest Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.registry_value_data Registry.process_guid, Registry.action + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_registry_bootexecute_modification_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on Windows Registry that include the name of the path and key responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may be present and will need to be filtered. +references: + - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ +tags: + analytic_story: + - Windows BootKits + asset_type: Endpoint + atomic_guid: [] + confidence: 100 + impact: 100 + message: The Registry BootExecute value was modified on $dest$ and should be reviewed immediately. + mitre_attack_id: + - T1542 + - T1547.001 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - Registry.dest + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.registry_value_data + - Registry.process_guid + - Registry.action + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/bootexecute-windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml new file mode 100644 index 0000000000..7cb441be9a --- /dev/null +++ b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml @@ -0,0 +1,53 @@ +name: Windows Snake Malware File Modification crmlog +id: 27187e0e-c221-471d-a7bd-04f698985ff6 +version: 1 +date: '2023-05-10' +author: Michael Haag, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 11 +description: The following analytic identfies a .crmlog written to windows\registration. Per the report, typically, this file has been found within the %windows%\Registration directory with the format of ..crmlog and is decrypted by Snake's kernel driver. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\windows\\registration\\*" AND Filesystem.file_name="*.crmlog" by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name + Filesystem.file_path Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `windows_snake_malware_file_modification_crmlog_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may be present as the file pattern does match legitimate files on disk. It is possible other native tools write the same file name scheme. +references: +- https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF +tags: + analytic_story: + - Snake Malware + asset_type: Endpoint + atomic_guid: + - UPDATE atomic_guid + confidence: 50 + impact: 50 + message: A file related to Snake Malware has been identified on $dest$. + mitre_attack_id: + - T1027 + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 25 + required_fields: + - _time + - Filesystem.file_create_time + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.file_path + - Filesystem.dest + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/snakemalware/snake_crmlog-windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml new file mode 100644 index 0000000000..a4d6a0a698 --- /dev/null +++ b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml @@ -0,0 +1,54 @@ +name: Windows Snake Malware Kernel Driver Comadmin +id: 628d9c7c-3242-43b5-9620-7234c080a726 +version: 1 +date: '2023-05-11' +author: Michael Haag, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 13 +description: The following analytic identifies the comadmin.dat file written to disk, which is related to Snake Malware. From the report, Snake's installer drops the kernel driver and a custom DLL which is used to load the driver into a + single AES encrypted file on disk. Typically, this file is named “comadmin.dat” and is stored in the %windows%\system32\Com directory. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\windows\\system32\\com\\*" AND Filesystem.file_name="comadmin.dat" by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name + Filesystem.file_path Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_snake_malware_kernel_driver_comadmin_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may be present, filter as needed. +references: +- https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF +tags: + analytic_story: + - Snake Malware + asset_type: Endpoint + atomic_guid: + - UPDATE atomic_guid + confidence: 80 + impact: 70 + message: A kernel driver comadmin.dat related to Snake Malware was written to disk on $dest$. + mitre_attack_id: + - T1547.006 + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 56 + required_fields: + - _time + - Filesystem.file_create_time + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.file_path + - Filesystem.dest + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/snakemalware/comadmin_windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml new file mode 100644 index 0000000000..c19688f512 --- /dev/null +++ b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml @@ -0,0 +1,55 @@ +name: Windows Snake Malware Registry Modification wav OpenWithProgIds +id: 13cf8b79-805d-443c-bf52-f55bd7610dfd +version: 1 +date: '2023-05-10' +author: Michael Haag, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 13 +description: The follow analytic identifies the registry being modified at .wav\\OpenWithProgIds\, which is related to the Snake Malware campaign. Upon execution, Snake's WerFault.exe will attempt to decrypt an encrypted blob within the Windows + registry that is typically found at HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds. The encrypted data includes the AES key, IV, and path that is used to find and decrypt the file containing Snake's kernel driver and kernel driver loader. +search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) + as registry_key_name values(Registry.registry_path) as registry_path min(_time) + as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\.wav\\OpenWithProgIds\\*" by Registry.dest Registry.user + Registry.registry_path Registry.registry_key_name Registry.registry_value_name | + `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_snake_malware_registry_modification_wav_openwithprogids_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may be present and will require tuning based on program Ids in large organizations. +references: +- https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF +tags: + analytic_story: + - Snake Malware + asset_type: Endpoint + atomic_guid: + - UPDATE atomic_guid + confidence: 50 + impact: 50 + message: A registry modification related to Snake Malware has been identified on $dest$. + mitre_attack_id: + - T1112 + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 25 + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/snakemalware/snake_malware_regblob-windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_snake_malware_service_create.yml b/detections/endpoint/windows_snake_malware_service_create.yml new file mode 100644 index 0000000000..f2a1443646 --- /dev/null +++ b/detections/endpoint/windows_snake_malware_service_create.yml @@ -0,0 +1,60 @@ +name: Windows Snake Malware Service Create +id: 64eb091f-8cab-4b41-9b09-8fb4942377df +version: 1 +date: '2023-05-11' +author: Michael Haag, Splunk +status: production +type: TTP +data_source: +- Windows System 7045 +description: The following analytic identifies a new service, WerFaultSvc, being created with a binary path located in the windows\winsxs\ path. Per the report - The Snake version primarily discussed in this advisory registers a service to maintain persistence on a system. Typically, this service is named "WerFaultSvc," which we assess was used to blend in with the legitimate Windows service WerSvc. On boot, this service will execute Snake's WerFault.exe, + which Snake developers chose to hide among the numerous valid Windows “WerFault.exe” files in the %windows%\WinSxS\ directory. Executing WerFault.exe will start the process of decrypting Snake's components and loading them into memory +search: '`wineventlog_system` EventCode=7045 ImagePath="*\\windows\\winSxS\\*" ImagePath="*\Werfault.exe" + | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ImagePath ServiceName ServiceType + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_snake_malware_service_create_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows System logs with the Service name, Service File Name Service Start type, + and Service Type from your endpoints. +known_false_positives: False positives should be limited as this is a strict primary indicator used by Snake Malware. +references: +- https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF +tags: + analytic_story: + - Snake Malware + asset_type: Endpoint + atomic_guid: + - UPDATE atomic_guid + confidence: 90 + impact: 80 + message: A service, WerFaultSvc, was created on $dest$ and is related to Snake Malware. + mitre_attack_id: + - T1547.006 + - T1569.002 + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 72 + required_fields: + - EventCode + - Service_File_Name + - Service_Type + - _time + - Service_Name + - Service_Start_Type + - Service_Account + - user + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/snakemalware/snake-service-windows-system.log + source: WinEventLog:System + sourcetype: WinEventLog + diff --git a/detections/endpoint/windows_winlogon_with_public_network_connection.yml b/detections/endpoint/windows_winlogon_with_public_network_connection.yml new file mode 100644 index 0000000000..160dc40fdf --- /dev/null +++ b/detections/endpoint/windows_winlogon_with_public_network_connection.yml @@ -0,0 +1,67 @@ +name: Windows WinLogon with Public Network Connection +id: 65615b3a-62ea-4d65-bb9f-6f07c17df4ea +version: 1 +date: '2023-05-03' +author: Michael Haag, Splunk +status: production +type: Hunting +data_source: + - Sysmon Event ID 1 + - Sysmon Event ID 3 +description: The following analytic is designed to detect anomalous behavior associated with the BlackLotus Campaign, a sophisticated bootkit attack reported by ESET and further investigated in a blog by Microsoft, which provided hunting queries for security analysts. The primary focus of this analytic is to identify instances of Winlogon.exe, a critical Windows process, connecting to public IP space, which is indicative of potential malicious activity. + The BlackLotus Campaign is a bootkit-based attack that compromises system integrity by infecting the Master Boot Record (MBR) and Volume Boot Record (VBR). This malware variant can bypass traditional security measures, load before the operating system, and maintain persistence on the target system. + + Winlogon.exe is a critical Windows process responsible for managing user logon and logoff processes. Under normal circumstances, Winlogon.exe should not be connecting to public IP addresses. However, if it does, it may indicate that the process has been compromised as part of the BlackLotus Campaign or another malicious operation. + + This analytic monitors network connections made by Winlogon.exe and triggers an alert if it detects connections to public IP space. By identifying such anomalous behavior, security analysts can investigate further and respond swiftly to potential threats. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN (winlogon.exe) Processes.process!=unknown + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | join process_id [| tstats `security_content_summariesonly` + count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 NOT (All_Traffic.dest IN (127.0.0.1,10.0.0.0/12,172.16.0.0/12, 192.168.0.0/16, 0:0:0:0:0:0:0:1)) by All_Traffic.process_id + All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as publicIp ] + | table dest parent_process_name process_name process_path process process_id dest_port publicIp + | `windows_winlogon_with_public_network_connection_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and Network_Traffic datamodel under All Traffic. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives will be present and filtering will be required. Legitimate IPs will be present and need to be filtered. +references: + - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ +tags: + analytic_story: + - BlackLotus Campaign + asset_type: Endpoint + atomic_guid: [] + confidence: 50 + impact: 50 + message: Winlogon.exe has generated a network connection to a remote destination on endpoint $dest$. + mitre_attack_id: + - T1542.003 + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: UPDATE (impact * confidence)/100 + required_fields: + - dest + - parent_process_name + - process_name + - process_path + - process + - process_id + - dest_port + - publicIp + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1542.003/bootkits/network-winlogon-windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/stories/snake_malware.yml b/stories/snake_malware.yml new file mode 100644 index 0000000000..f0821ea962 --- /dev/null +++ b/stories/snake_malware.yml @@ -0,0 +1,35 @@ +name: Snake Malware +id: 032bacbb-f90d-43aa-bbcc-d87f169a29c8 +version: 1 +date: '2023-05-10' +author: Michael Haag, Splunk +description: The Snake implant is considered the most sophisticated cyber espionage tool designed and used by Center 16 of Russia's Federal Security Service (FSB) for long-term intelligence collection on sensitive targets. +narrative: The Snake implant is considered the most sophisticated cyber espionage tool designed and used by + Center 16 of Russia's Federal Security Service (FSB) for long-term intelligence collection on sensitive + targets. To conduct operations using this tool, the FSB created a covert peer-to-peer (P2P) network of + numerous Snake-infected computers worldwide. Many systems in this P2P network serve as relay + nodes which route disguised operational traffic to and from Snake implants on the FSB's ultimate + targets. Snake's custom communications protocols employ encryption and fragmentation for + confidentiality and are designed to hamper detection and collection efforts. + We consider Snake to be the most sophisticated cyber espionage tool in the FSB's arsenal. The + sophistication of Snake stems from three principal areas. First, Snake employs means to achieve a + rare level of stealth in its host components and network communications. Second, Snake's internal + technical architecture allows for easy incorporation of new or replacement components. This design + also facilitates the development and interoperability of Snake instances running on different host + operating systems. We have observed interoperable Snake implants for Windows, MacOS, and Linux + operating systems. Lastly, Snake demonstrates careful software engineering design and + implementation, with the implant containing surprisingly few bugs given its complexity. (CISA, 2023) +references: + - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF +tags: + analytic_story: Snake Malware + category: + - Adversary Tactics + - Account Compromise + - Lateral Movement + - Privilege Escalation + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/stories/windows_bootkits.yml b/stories/windows_bootkits.yml new file mode 100644 index 0000000000..db7d1cf9e9 --- /dev/null +++ b/stories/windows_bootkits.yml @@ -0,0 +1,22 @@ +name: Windows BootKits +id: 1bef004d-23b2-4c49-8ceb-b59af0745317 +version: 1 +date: '2023-05-03' +author: Michael Haag, Splunk +description: Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly. +narrative: A bootkit is a sophisticated type of malware that targets the boot sectors of a hard drive, specifically the Master Boot Record (MBR) and Volume Boot Record (VBR). The MBR is the initial section of the disk that is loaded following the hardware initialization process executed by the Basic Input/Output System (BIOS). It houses the boot loader, which is responsible for loading the operating system. In contrast, the VBR is located at the beginning of each partition and contains the boot code for that specific partition. + When an adversary gains raw access to the boot drive, they can overwrite the MBR or VBR, effectively diverting the execution during startup from the standard boot loader to the malicious code injected by the attacker. This tampering allows the malware to load before the operating system, enabling it to execute malicious activities stealthily and maintain persistence on the compromised system. + Bootkits are particularly dangerous because they can bypass security measures implemented by the operating system and antivirus software. Since they load before the operating system, they can easily evade detection and manipulate the system's behavior from the earliest stages of the boot process. This capability makes bootkits a potent tool in an attacker's arsenal for gaining unauthorized access, stealing sensitive information, or launching further attacks on other systems. + To defend against bootkit attacks, organizations should implement multiple layers of security, including strong endpoint protection, regular software updates, user awareness training, and monitoring for unusual system behavior. Additionally, hardware-based security features, such as Unified Extensible Firmware Interface (UEFI) Secure Boot and Trusted Platform Module (TPM), can help protect the integrity of the boot process and reduce the risk of bootkit infections. +references: + - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ + - https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/ +tags: + analytic_story: Windows BootKits + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From 41df5fea27d4e4147c3f95081ec5870617345e0a Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 11 May 2023 14:05:51 -0600 Subject: [PATCH 2/9] fixes --- .../endpoint/windows_snake_malware_kernel_driver_comadmin.yml | 4 ++-- detections/endpoint/windows_snake_malware_service_create.yml | 4 ++-- .../windows_winlogon_with_public_network_connection.yml | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml index a4d6a0a698..f60d0fdd6b 100644 --- a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml +++ b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml @@ -7,8 +7,8 @@ status: production type: TTP data_source: - Sysmon Event ID 13 -description: The following analytic identifies the comadmin.dat file written to disk, which is related to Snake Malware. From the report, Snake's installer drops the kernel driver and a custom DLL which is used to load the driver into a - single AES encrypted file on disk. Typically, this file is named “comadmin.dat” and is stored in the %windows%\system32\Com directory. +description: 'The following analytic identifies the comadmin.dat file written to disk, which is related to Snake Malware. From the report, Snakes installer drops the kernel driver and a custom DLL which is used to load the driver into a + single AES encrypted file on disk. Typically, this file is named comadmin.dat and is stored in the %windows%\system32\Com directory.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\windows\\system32\\com\\*" AND Filesystem.file_name="comadmin.dat" by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` diff --git a/detections/endpoint/windows_snake_malware_service_create.yml b/detections/endpoint/windows_snake_malware_service_create.yml index f2a1443646..eefa69cc05 100644 --- a/detections/endpoint/windows_snake_malware_service_create.yml +++ b/detections/endpoint/windows_snake_malware_service_create.yml @@ -7,8 +7,8 @@ status: production type: TTP data_source: - Windows System 7045 -description: The following analytic identifies a new service, WerFaultSvc, being created with a binary path located in the windows\winsxs\ path. Per the report - The Snake version primarily discussed in this advisory registers a service to maintain persistence on a system. Typically, this service is named "WerFaultSvc," which we assess was used to blend in with the legitimate Windows service WerSvc. On boot, this service will execute Snake's WerFault.exe, - which Snake developers chose to hide among the numerous valid Windows “WerFault.exe” files in the %windows%\WinSxS\ directory. Executing WerFault.exe will start the process of decrypting Snake's components and loading them into memory +description: 'The following analytic identifies a new service WerFaultSvc being created with a binary path located in the windows winsxs path. Per the report, the Snake version primarily discussed in this advisory registers a service to maintain persistence on a system. Typically this service is named WerFaultSvc which we assess was used to blend in with the legitimate Windows service WerSvc. On boot, this service will execute Snakes WerFault.exe, + which Snake developers chose to hide among the numerous valid Windows WerFault.exe files in the windows WinSxS directory. Executing WerFault.exe will start the process of decrypting Snakes components and loading them into memory.' search: '`wineventlog_system` EventCode=7045 ImagePath="*\\windows\\winSxS\\*" ImagePath="*\Werfault.exe" | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ImagePath ServiceName ServiceType | `security_content_ctime(firstTime)` diff --git a/detections/endpoint/windows_winlogon_with_public_network_connection.yml b/detections/endpoint/windows_winlogon_with_public_network_connection.yml index 160dc40fdf..bf2f7c048a 100644 --- a/detections/endpoint/windows_winlogon_with_public_network_connection.yml +++ b/detections/endpoint/windows_winlogon_with_public_network_connection.yml @@ -48,7 +48,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: UPDATE (impact * confidence)/100 + risk_score: 25 required_fields: - dest - parent_process_name From 5eb042fb6441af2ebbebf540dae3a75afa0b8425 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 15 May 2023 09:17:57 -0600 Subject: [PATCH 3/9] Atomic GUIDs --- .../endpoint/windows_snake_malware_file_modification_crmlog.yml | 2 +- .../endpoint/windows_snake_malware_kernel_driver_comadmin.yml | 2 +- ..._snake_malware_registry_modification_wav_openwithprogids.yml | 2 +- detections/endpoint/windows_snake_malware_service_create.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml index 7cb441be9a..4f0e729352 100644 --- a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml +++ b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml @@ -21,7 +21,7 @@ tags: - Snake Malware asset_type: Endpoint atomic_guid: - - UPDATE atomic_guid + - 7e47ee60-9dd1-4269-9c4f-97953b183268 confidence: 50 impact: 50 message: A file related to Snake Malware has been identified on $dest$. diff --git a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml index f60d0fdd6b..b71f4fb3de 100644 --- a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml +++ b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml @@ -22,7 +22,7 @@ tags: - Snake Malware asset_type: Endpoint atomic_guid: - - UPDATE atomic_guid + - e5cb5564-cc7b-4050-86e8-f2d9eec1941f confidence: 80 impact: 70 message: A kernel driver comadmin.dat related to Snake Malware was written to disk on $dest$. diff --git a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml index c19688f512..c4cb696858 100644 --- a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml +++ b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml @@ -23,7 +23,7 @@ tags: - Snake Malware asset_type: Endpoint atomic_guid: - - UPDATE atomic_guid + - 8318ad20-0488-4a64-98f4-72525a012f6b confidence: 50 impact: 50 message: A registry modification related to Snake Malware has been identified on $dest$. diff --git a/detections/endpoint/windows_snake_malware_service_create.yml b/detections/endpoint/windows_snake_malware_service_create.yml index eefa69cc05..eccc77b28e 100644 --- a/detections/endpoint/windows_snake_malware_service_create.yml +++ b/detections/endpoint/windows_snake_malware_service_create.yml @@ -24,7 +24,7 @@ tags: - Snake Malware asset_type: Endpoint atomic_guid: - - UPDATE atomic_guid + - b8db787e-dbea-493c-96cb-9272296ddc49 confidence: 90 impact: 80 message: A service, WerFaultSvc, was created on $dest$ and is related to Snake Malware. From 72ab3d1e08b669c7421a5eec0d9d879d2acfcba5 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 15 May 2023 13:19:56 -0600 Subject: [PATCH 4/9] last of snake --- .../windows_service_created_with_suspicious_service_path.yml | 1 + .../endpoint/windows_service_created_within_public_path.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index 3c9d6e33fa..df1174cda0 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -32,6 +32,7 @@ tags: - Active Directory Lateral Movement - Brute Ratel C4 - Qakbot + - Snake Malware asset_type: Endpoint confidence: 80 impact: 70 diff --git a/detections/endpoint/windows_service_created_within_public_path.yml b/detections/endpoint/windows_service_created_within_public_path.yml index ac0ff51d64..d721c55a99 100644 --- a/detections/endpoint/windows_service_created_within_public_path.yml +++ b/detections/endpoint/windows_service_created_within_public_path.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - Active Directory Lateral Movement + - Snake Malware asset_type: Endpoint confidence: 60 impact: 90 From c51fe800a9d43b7f24efb9ac9c34bef16a832469 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 15 May 2023 15:22:22 -0700 Subject: [PATCH 5/9] Update windows_snake_malware_file_modification_crmlog.yml --- .../endpoint/windows_snake_malware_file_modification_crmlog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml index 4f0e729352..bcf9f33b4a 100644 --- a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml +++ b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml @@ -1,4 +1,4 @@ -name: Windows Snake Malware File Modification crmlog +name: Windows Snake Malware File Modification Crmlog id: 27187e0e-c221-471d-a7bd-04f698985ff6 version: 1 date: '2023-05-10' From 7cc2746c76a93a75d70248ef7fb939140e0a701c Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 16 May 2023 10:17:41 -0600 Subject: [PATCH 6/9] fix for bootexecute --- .../endpoint/windows_registry_bootexecute_modification.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_registry_bootexecute_modification.yml b/detections/endpoint/windows_registry_bootexecute_modification.yml index 30734c22f4..5a5a1ee41c 100644 --- a/detections/endpoint/windows_registry_bootexecute_modification.yml +++ b/detections/endpoint/windows_registry_bootexecute_modification.yml @@ -51,6 +51,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/bootexecute-windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/bootexecute-windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog From b5765c546e7a349e1f9bb1030406fe81637fa8b1 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 16 May 2023 10:27:26 -0600 Subject: [PATCH 7/9] Update windows_winlogon_with_public_network_connection.yml --- .../windows_winlogon_with_public_network_connection.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_winlogon_with_public_network_connection.yml b/detections/endpoint/windows_winlogon_with_public_network_connection.yml index bf2f7c048a..d0a9be45b0 100644 --- a/detections/endpoint/windows_winlogon_with_public_network_connection.yml +++ b/detections/endpoint/windows_winlogon_with_public_network_connection.yml @@ -16,7 +16,7 @@ description: The following analytic is designed to detect anomalous behavior ass This analytic monitors network connections made by Winlogon.exe and triggers an alert if it detects connections to public IP space. By identifying such anomalous behavior, security analysts can investigate further and respond swiftly to potential threats. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN (winlogon.exe) Processes.process!=unknown - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 987863ef46fa2ed27cc836b72142a56d92171304 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 16 May 2023 10:54:36 -0700 Subject: [PATCH 8/9] Fix source and sourcetype of detection --- detections/endpoint/windows_snake_malware_service_create.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_snake_malware_service_create.yml b/detections/endpoint/windows_snake_malware_service_create.yml index eccc77b28e..9ca3fed699 100644 --- a/detections/endpoint/windows_snake_malware_service_create.yml +++ b/detections/endpoint/windows_snake_malware_service_create.yml @@ -55,6 +55,6 @@ tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/snakemalware/snake-service-windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog + source: XmlWinEventLog:System + sourcetype: XmlWinEventLog From 11e84e3839cec8cf566b6ed4662070073b5af81e Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 16 May 2023 11:03:00 -0700 Subject: [PATCH 9/9] Update windows_winlogon_with_public_network_connection.yml --- .../windows_winlogon_with_public_network_connection.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_winlogon_with_public_network_connection.yml b/detections/endpoint/windows_winlogon_with_public_network_connection.yml index d0a9be45b0..924eeec18d 100644 --- a/detections/endpoint/windows_winlogon_with_public_network_connection.yml +++ b/detections/endpoint/windows_winlogon_with_public_network_connection.yml @@ -3,7 +3,7 @@ id: 65615b3a-62ea-4d65-bb9f-6f07c17df4ea version: 1 date: '2023-05-03' author: Michael Haag, Splunk -status: production +status: experimental type: Hunting data_source: - Sysmon Event ID 1