mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
srv-rr-gh-researchbt
@@ -0,0 +1,82 @@
|
||||
name: Office Product Spawning Windows Script Host
|
||||
id: 3ea3851a-8736-41a0-bc09-7e4485b48fa6
|
||||
version: 1
|
||||
date: '2022-10-12'
|
||||
author: Michael Haag, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic will identify a Windows Office Product spawning WScript.exe or CScript.exe. Tuning may be required based on legitimate application usage that may spawn scripts from an Office product.
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
|
||||
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
|
||||
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
|
||||
null), parent_process_name=lower(ucast(map_get(input_event, "parent_process_name"), "string",
|
||||
null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
|
||||
cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT
|
||||
NULL | where (like(parent_process_name, "%\\\\winword.exe") OR like(parent_process_name, "%\\\\excel.exe") OR like(parent_process_name, "%\\\\powerpnt.exe") OR like(parent_process_name, "%\\\\mspub.exe") OR like(parent_process_name, "%\\\\visio.exe")) AND (process_name="wscript.exe" OR
|
||||
process_name="cscript.exe")
|
||||
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
|
||||
| into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: False positives may be present based on macro based approved documents in the organization. Filtering may be needed.
|
||||
references:
|
||||
- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Spearphishing Attachments
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 90
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: A Microsoft office parent process $parent_process_name$ has spawned a suspicious child
|
||||
process $process_name$ on host $dest$.
|
||||
mitre_attack_id:
|
||||
- T1566
|
||||
- T1566.001
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: parent_process_name
|
||||
type: Process
|
||||
role:
|
||||
- Parent Process
|
||||
- name: process_name
|
||||
type: Process
|
||||
role:
|
||||
- Child Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
risk_score: 63
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
@@ -0,0 +1,85 @@
|
||||
name: Windows COM Hijacking InprocServer32 Modification
|
||||
id: 0ae05a0f-bc84-456b-822a-a5b9c081c7ca
|
||||
version: 1
|
||||
date: '2022-10-12'
|
||||
author: Michael Haag, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies the use of reg.exe performing an add to the InProcServer32, which may be related to COM hijacking.
|
||||
Adversaries can use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead.
|
||||
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=ucast(map_get(input_event,
|
||||
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
|
||||
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
|
||||
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="reg.exe"
|
||||
AND like (cmd_line, "%inprocserver32%") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
|
||||
"process_name", process_name, "parent_process_name", parent_process_name, "process_path",
|
||||
process_path]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: False positives may be present and some filtering may be required.
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1546/015/
|
||||
- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md
|
||||
tags:
|
||||
analytic_story:
|
||||
- Living Off The Land
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 80
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Execution
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-security.log
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: An instance of $parent_process_name$ has spawned $process_name$ attempting to modify InProcServer32 within the registry on $dest_device_id$ by $dest_user_id$.
|
||||
mitre_attack_id:
|
||||
- T1546.015
|
||||
- T1546
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: parent_process_name
|
||||
type: Process
|
||||
role:
|
||||
- Parent Process
|
||||
- name: process_name
|
||||
type: Process
|
||||
role:
|
||||
- Child Process
|
||||
risk_severity: 'medium'
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 64
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,96 @@
|
||||
name: Windows Exchange PowerShell Module Usage
|
||||
id: 1118bc65-b0c7-4589-bc2f-ad6802fd0909
|
||||
version: 1
|
||||
date: '2022-10-12'
|
||||
author: Michael Haag, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: 'The following analytic identifies the usage of Exchange PowerShell modules
|
||||
that were recently used for a proof of concept related to ProxyShell. Currently,
|
||||
there is no active data shared or data we could re-produce relate to this part of
|
||||
the ProxyShell chain of exploits. \
|
||||
|
||||
Inherently, the usage of the modules is not malicious, but reviewing parallel processes,
|
||||
and user, of the session will assist with determining the intent. \
|
||||
|
||||
Module - New-MailboxExportRequest will begin the process of exporting contents of
|
||||
a primary mailbox or archive to a .pst file. \
|
||||
|
||||
Module - New-managementroleassignment can assign a management role to a management
|
||||
role group, management role assignment policy, user, or universal security group
|
||||
(USG). \
|
||||
|
||||
Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate of search results, place search results on In-Place Hold or copy them to a Discovery mailbox. You can also place all contents in a mailbox on hold by not specifying a search query, which accomplishes similar results as Litigation Hold. \
|
||||
Module - Get-Recipient cmdlet to view existing recipient objects in your organization. This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).'
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
|
||||
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
|
||||
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
|
||||
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
|
||||
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
|
||||
cmd_line IS NOT NULL AND process_name IS NOT NULL | where
|
||||
(like (cmd_line, "%new-mailboxexportrequest%") OR like (cmd_line, "%new-managementroleassignment%") OR like (cmd_line,
|
||||
"%new-mailboxsearch%") OR like (cmd_line,"%get-recipient%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
|
||||
| into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this analytic, you will need to enable
|
||||
PowerShell Script Block Logging on some or all endpoints. Additional setup here
|
||||
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. This will only work with Multiline event logs, not XML.
|
||||
known_false_positives: Administrators or power users may use this PowerShell commandlet
|
||||
references:
|
||||
- https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps
|
||||
- https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps
|
||||
- https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html
|
||||
- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
|
||||
- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
|
||||
- https://www.cisa.gov/uscert/ncas/alerts/aa22-264a
|
||||
- https://learn.microsoft.com/en-us/powershell/module/exchange/new-mailboxsearch?view=exchange-ps
|
||||
- https://learn.microsoft.com/en-us/powershell/module/exchange/get-recipient?view=exchange-ps
|
||||
- https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
|
||||
tags:
|
||||
analytic_story:
|
||||
- ProxyShell
|
||||
- CISA AA22-264A
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 80
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Discovery
|
||||
- Stage:Recon
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/exchange/windows-powershell.log
|
||||
impact: 40
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Exchange enumeration using PowerShell on $dest_device_id$.
|
||||
mitre_attack_id:
|
||||
- T1059
|
||||
- T1059.001
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
risk_severity: 'medium'
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 32
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,10 @@
|
||||
name: Office Product Spawning Windows Script Host Unit Test
|
||||
tests:
|
||||
- name: Office Product Spawning Windows Script Host
|
||||
file: endpoint/ssa___office_product_spawning_windows_script_host.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-security.log
|
||||
source: XmlWinEventLog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows COM Hijacking InprocServer32 Modification Unit Test
|
||||
tests:
|
||||
- name: Windows COM Hijacking InprocServer32 Modification
|
||||
file: endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-security.log
|
||||
source: XmlWinEventLog
|
||||
sourcetype: XmlWinEventLog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Exchange PowerShell Module Usage Unit Test
|
||||
tests:
|
||||
- name: Windows Exchange PowerShell Module Usage
|
||||
file: endpoint/ssa___windows_exchange_powershell_module_usage.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: pwsh_multipass.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/pwsh_multipass.log
|
||||
source: WinEventLog
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: true
|
||||
Reference in New Issue
Block a user