From 571efe638595e886d597470163e463919b942d1d Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 12 Oct 2022 14:12:34 -0600
Subject: [PATCH 1/3] analytics

---
 ...e_product_spawning_windows_script_host.yml | 83 ++++++++++++++++++
 ..._hijacking_inprocserver32_modification.yml | 85 +++++++++++++++++++
 ...duct_spawning_windows_script_host.test.yml | 10 +++
 ...cking_inprocserver32_modification.test.yml | 13 +++
 4 files changed, 191 insertions(+)
 create mode 100644 detections/endpoint/ssa___office_product_spawning_windows_script_host.yml
 create mode 100644 detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml
 create mode 100644 tests/endpoint/ssa___office_product_spawning_windows_script_host.test.yml
 create mode 100644 tests/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.test.yml

diff --git a/detections/endpoint/ssa___office_product_spawning_windows_script_host.yml b/detections/endpoint/ssa___office_product_spawning_windows_script_host.yml
new file mode 100644
index 0000000000..521c3eacd4
--- /dev/null
+++ b/detections/endpoint/ssa___office_product_spawning_windows_script_host.yml
@@ -0,0 +1,83 @@
+name: Office Product Spawning Windows Script Host
+id: 3ea3851a-8736-41a0-bc09-7e4485b48fa6
+version: 1
+date: '2022-10-12'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic will identify a Windows Office Product spawning WScript.exe or CScript.exe. Tuning may be required based on legitimate application usage that may spawn scripts from an Office product.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=lower(ucast(map_get(input_event, "parent_process_name"), "string",
+  null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT
+  NULL | where like(parent_process_name, "%\\\\mshta.exe") AND (process_name="wscript.exe" OR
+  process_name="cscript.exe")
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present based on macro based approved documents in the organization. Filtering may be needed.
+references:
+  - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  cis20:
+  - CIS 8
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: A Microsoft office parent process $parent_process_name$ has spawned a suspicious child
+    process $process_name$ on host $dest$.
+  mitre_attack_id:
+  - T1566
+  - T1566.001
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 63
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml
new file mode 100644
index 0000000000..54d23b79cf
--- /dev/null
+++ b/detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml
@@ -0,0 +1,85 @@
+name: Windows COM Hijacking InprocServer32 Modification
+id: 0ae05a0f-bc84-456b-822a-a5b9c081c7ca
+version: 1
+date: '2022-10-12'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies the use of reg.exe performing an add to the InProcServer32, which may be related to COM hijacking.
+  Adversaries can use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="reg.exe"
+  AND like (cmd_line, "%inprocserver32%") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present and some filtering may be required.
+references:
+  - https://attack.mitre.org/techniques/T1546/015/
+  - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md
+tags:
+  analytic_story:
+  - Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ has spawned $process_name$ attempting to modify InProcServer32 within the registry on $dest_device_id$ by $dest_user_id$.
+  mitre_attack_id:
+  - T1546.015
+  - T1546
+  nist:
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  risk_severity: 'medium'
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 64
+  security_domain: endpoint
diff --git a/tests/endpoint/ssa___office_product_spawning_windows_script_host.test.yml b/tests/endpoint/ssa___office_product_spawning_windows_script_host.test.yml
new file mode 100644
index 0000000000..893982f7b2
--- /dev/null
+++ b/tests/endpoint/ssa___office_product_spawning_windows_script_host.test.yml
@@ -0,0 +1,10 @@
+name: Office Product Spawning Windows Script Host Unit Test
+tests:
+- name: Office Product Spawning Windows Script Host
+  file: endpoint/ssa___office_product_spawning_windows_script_host.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-security.log
+    source: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.test.yml b/tests/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.test.yml
new file mode 100644
index 0000000000..f37284998d
--- /dev/null
+++ b/tests/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.test.yml
@@ -0,0 +1,13 @@
+name: Windows COM Hijacking InprocServer32 Modification Unit Test
+tests:
+- name: Windows COM Hijacking InprocServer32 Modification
+  file: endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-security.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

From 5ad0c5b3d66107cb429ce8e669b42158239190c7 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 13 Oct 2022 14:59:54 -0600
Subject: [PATCH 2/3] BA

---
 ...e_product_spawning_windows_script_host.yml |  3 +-
 ..._hijacking_inprocserver32_modification.yml |  2 +-
 ...ndows_exchange_powershell_module_usage.yml | 96 +++++++++++++++++++
 ..._exchange_powershell_module_usage.test.yml | 13 +++
 4 files changed, 111 insertions(+), 3 deletions(-)
 create mode 100644 detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml
 create mode 100644 tests/endpoint/ssa___windows_exchange_powershell_module_usage.test.yml

diff --git a/detections/endpoint/ssa___office_product_spawning_windows_script_host.yml b/detections/endpoint/ssa___office_product_spawning_windows_script_host.yml
index 521c3eacd4..10382c2285 100644
--- a/detections/endpoint/ssa___office_product_spawning_windows_script_host.yml
+++ b/detections/endpoint/ssa___office_product_spawning_windows_script_host.yml
@@ -14,7 +14,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   null), parent_process_name=lower(ucast(map_get(input_event, "parent_process_name"), "string",
   null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
   cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT
-  NULL | where like(parent_process_name, "%\\\\mshta.exe") AND (process_name="wscript.exe" OR
+  NULL | where (like(parent_process_name, "%\\\\winword.exe") OR like(parent_process_name, "%\\\\excel.exe") OR like(parent_process_name, "%\\\\powerpnt.exe") OR like(parent_process_name, "%\\\\mspub.exe") OR like(parent_process_name, "%\\\\visio.exe")) AND (process_name="wscript.exe" OR
   process_name="cscript.exe")
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
@@ -77,7 +77,6 @@ tags:
   - process_path
   - dest_user_id
   - process
-  - cmd_line
   risk_score: 63
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml
index 54d23b79cf..e2fcacbd6d 100644
--- a/detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml
+++ b/detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml
@@ -10,7 +10,7 @@ description: The following analytic identifies the use of reg.exe performing an
   Adversaries can use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead.
 search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=ucast(map_get(input_event,
   "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
   "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
   "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
diff --git a/detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml b/detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml
new file mode 100644
index 0000000000..de57c7e320
--- /dev/null
+++ b/detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml
@@ -0,0 +1,96 @@
+name: Windows Exchange PowerShell Module Usage
+id: 1118bc65-b0c7-4589-bc2f-ad6802fd0909
+version: 1
+date: '2022-10-12'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: 'The following analytic identifies the usage of Exchange PowerShell modules
+  that were recently used for a proof of concept related to ProxyShell. Currently,
+  there is no active data shared or data we could re-produce relate to this part of
+  the ProxyShell chain of exploits.  \
+
+  Inherently, the usage of the modules is not malicious, but reviewing parallel processes,
+  and user, of the session will assist with determining the intent. \
+
+  Module - New-MailboxExportRequest will begin the process of exporting contents of
+  a primary mailbox or archive to a .pst file. \
+
+  Module - New-managementroleassignment can assign a management role to a management
+  role group, management role assignment policy, user, or universal security group
+  (USG). \
+  
+  Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate of search results, place search results on In-Place Hold or copy them to a Discovery mailbox. You can also place all contents in a mailbox on hold by not specifying a search query, which accomplishes similar results as Litigation Hold. \
+  Module - Get-Recipient cmdlet to view existing recipient objects in your organization. This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).'
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where
+  (like (cmd_line, "%new-mailboxexportrequest%") OR like (cmd_line, "%new-managementroleassignment%") OR like (cmd_line,
+  "%new-mailboxsearch%") OR like (cmd_line,"%get-recipient%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators or power users may use this PowerShell commandlet
+references:
+  - https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps
+  - https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps
+  - https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html
+  - https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
+  - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
+  - https://www.cisa.gov/uscert/ncas/alerts/aa22-264a
+  - https://learn.microsoft.com/en-us/powershell/module/exchange/new-mailboxsearch?view=exchange-ps
+  - https://learn.microsoft.com/en-us/powershell/module/exchange/get-recipient?view=exchange-ps
+  - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
+tags:
+  analytic_story:
+  - ProxyShell
+  - CISA AA22-264A
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/exchange/windows-powershell.log
+  impact: 40
+  kill_chain_phases:
+  - Actions on Objectives
+  message:  Exchange enumeration using PowerShell on $dest_device_id$.
+  mitre_attack_id:
+  - T1059
+  - T1059.001
+  nist:
+  - DE.CM
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  risk_severity: 'medium'
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 32
+  security_domain: endpoint
diff --git a/tests/endpoint/ssa___windows_exchange_powershell_module_usage.test.yml b/tests/endpoint/ssa___windows_exchange_powershell_module_usage.test.yml
new file mode 100644
index 0000000000..be7661b6a4
--- /dev/null
+++ b/tests/endpoint/ssa___windows_exchange_powershell_module_usage.test.yml
@@ -0,0 +1,13 @@
+name: Windows Exchange PowerShell Module Usage Unit Test
+tests:
+- name: Windows Exchange PowerShell Module Usage
+  file: endpoint/ssa___windows_exchange_powershell_module_usage.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: pwsh_multipass.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/pwsh_multipass.log
+    source: WinEventLog
+    sourcetype: WinEventLog
+    update_timestamp: true
\ No newline at end of file

From 78c1d290c57ea9b126c67cd8d5632debc2f7263a Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 13 Oct 2022 15:10:26 -0600
Subject: [PATCH 3/3] Update ssa___windows_exchange_powershell_module_usage.yml

---
 .../endpoint/ssa___windows_exchange_powershell_module_usage.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml b/detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml
index de57c7e320..198092fb25 100644
--- a/detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml
+++ b/detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml
@@ -38,7 +38,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
-  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. This will only work with Multiline event logs, not XML.
 known_false_positives: Administrators or power users may use this PowerShell commandlet
 references:
   - https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps