diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index 74d4aeab10..4c99832ebe 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -18,7 +18,7 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - pip install contentctl==v5.0.0-alpha.2 + pip install contentctl==v5.0.0-alpha.3 git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 2437aea9fe..752e516e3f 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -19,7 +19,7 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - pip install contentctl==v5.0.0-alpha.2 + pip install contentctl==v5.0.0-alpha.3 git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 4de315ba24..925207f4cb 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -23,7 +23,7 @@ jobs: - name: Install Python Dependencies and ContentCTL run: | python -m pip install --upgrade pip - pip install contentctl==v5.0.0-alpha.2 + pip install contentctl==v5.0.0-alpha.3 # Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop # Make sure we check out the PR, even if it actually lives in a fork diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/deprecated/account_discovery_with_net_app.yml similarity index 82% rename from detections/endpoint/account_discovery_with_net_app.yml rename to detections/deprecated/account_discovery_with_net_app.yml index 701fa8a6f1..ce8d2fa45f 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/deprecated/account_discovery_with_net_app.yml @@ -1,18 +1,11 @@ name: Account Discovery With Net App id: 339805ce-ac30-11eb-b87d-acde48001122 version: 8 -date: '2024-11-13' +date: '2025-01-13' author: Teoderick Contreras, Splunk, TheLawsOfChaos, Github Community -status: production +status: deprecated type: TTP -description: The following analytic detects potential account discovery activities - using the 'net' command, commonly employed by malware like Trickbot for reconnaissance. - It leverages Endpoint Detection and Response (EDR) data, focusing on specific command-line - patterns and process relationships. This activity is significant as it often precedes - further malicious actions, such as lateral movement or privilege escalation. If - confirmed malicious, attackers could gain valuable information about user accounts, - enabling them to escalate privileges or move laterally within the network, posing - a significant security risk. +description: The following analytic has been deprecated in favour of the more generic "45e52536-ae42-11eb-b5c6-acde48001122". The following analytic detects potential account discovery activities using the 'net' command, commonly employed by malware like Trickbot for reconnaissance. It leverages Endpoint Detection and Response (EDR) data, focusing on specific command-line patterns and process relationships. This activity is significant as it often precedes further malicious actions, such as lateral movement or privilege escalation. If confirmed malicious, attackers could gain valuable information about user accounts, enabling them to escalate privileges or move laterally within the network, posing a significant security risk. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/deprecated/attempted_credential_dump_from_registry_via_reg_exe.yml similarity index 95% rename from detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml rename to detections/deprecated/attempted_credential_dump_from_registry_via_reg_exe.yml index 20436f2388..409c21747b 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/deprecated/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -1,11 +1,12 @@ name: Attempted Credential Dump From Registry via Reg exe id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911 version: 12 -date: '2024-12-10' +date: '2025-01-15' author: Patrick Bareiss, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the execution of reg.exe with parameters +description: The following analytic has been deprecated in favour of "8bbb7d58-b360-11eb-ba21-acde48001122". + The following analytic detects the execution of reg.exe with parameters that export registry keys containing hashed credentials. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving reg.exe or cmd.exe with specific registry paths. This activity is significant diff --git a/detections/endpoint/detect_critical_alerts_from_security_tools.yml b/detections/deprecated/detect_critical_alerts_from_security_tools.yml similarity index 50% rename from detections/endpoint/detect_critical_alerts_from_security_tools.yml rename to detections/deprecated/detect_critical_alerts_from_security_tools.yml index d0f931f849..79ba56809d 100644 --- a/detections/endpoint/detect_critical_alerts_from_security_tools.yml +++ b/detections/deprecated/detect_critical_alerts_from_security_tools.yml @@ -1,45 +1,17 @@ name: Detect Critical Alerts from Security Tools id: 483e8a68-f2f7-45be-8fc9-bf725f0e22fd version: 2 -date: '2024-11-13' +date: '2025-01-13' author: Gowthamaraj Rajendran, Patrick Bareiss, Bhavin Patel, Bryan Pluta, Splunk -status: production +status: deprecated type: TTP data_source: - Windows Defender Alerts - MS365 Defender Incident Alerts -description: The following analytics is to detect high and critical alerts from endpoint - security tools such as Microsoft Defender, Carbon Black, and Crowdstrike. This query - aggregates and summarizes critical severity alerts from the Alerts data model, providing - details such as the alert signature, application, description, source, destination, - and timestamps, while applying custom filters and formatting for enhanced analysis - in a SIEM environment.This capability allows security teams to efficiently allocate - resources and maintain a strong security posture, while also supporting compliance - with regulatory requirements by providing a clear record of critical security events. - We tested these detections with logs from Microsoft Defender, however this detection - should work for any security alerts that are ingested into the alerts data model. - **Note** - We are dynamically creating the risk_score field based on the severity - of the alert in the SPL and that supersedes the risk score set in the detection. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime values(Alerts.description) as description values(Alerts.mitre_technique_id) - as annotations.mitre_attack.mitre_technique_id values(Alerts.severity) as severity - values(Alerts.type) as type values(Alerts.severity_id) as severity_id values(Alerts.signature) - as signature values(Alerts.signature_id) as signature_id values(Alerts.dest) as - dest from datamodel=Alerts where Alerts.severity IN ("high","critical") by Alerts.src - Alerts.user Alerts.id Alerts.vendor sourcetype | `drop_dm_object_name("Alerts")` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | eval - risk_score=case(severity="informational", 2, severity="low", 5, severity="medium", - 10, severity="high", 50, severity="critical" , 100) | `detect_critical_alerts_from_security_tools_filter`' -how_to_implement: In order to properly run this search, you to ingest alerts data - from other security products such as Crowdstrike, Microsoft Defender, or Carbon - Black using appropriate TAs for that technology. Once ingested, the fields should - be mapped to the Alerts data model. Make sure to apply transformation on the data - if necessary. The risk_score field is used to calculate the risk score for the alerts - and the mitre_technique_id field is used to map the alerts to the MITRE ATT&CK framework - is dynamically created by the detection when this is triggered. These fields need - not be set in the adaptive response actions. -known_false_positives: False positives may vary by endpoint protection tool; monitor - and filter out the alerts that are not relevant to your environment. +description: The following analytic has been deprecated in favour of specific and dedicated product analytics such as "Microsoft Defender ATP Alerts". The following analytic is to detect high and critical alerts from endpoint security tools such as Microsoft Defender, Carbon Black, and Crowdstrike. This query aggregates and summarizes critical severity alerts from the Alerts data model, providing details such as the alert signature, application, description, source, destination, and timestamps, while applying custom filters and formatting for enhanced analysis in a SIEM environment.This capability allows security teams to efficiently allocate resources and maintain a strong security posture, while also supporting compliance with regulatory requirements by providing a clear record of critical security events. We tested these detections with logs from Microsoft Defender, however this detection should work for any security alerts that are ingested into the alerts data model. **Note** - We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Alerts.description) as description values(Alerts.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id values(Alerts.severity) as severity values(Alerts.type) as type values(Alerts.severity_id) as severity_id values(Alerts.signature) as signature values(Alerts.signature_id) as signature_id values(Alerts.dest) as dest from datamodel=Alerts where Alerts.severity IN ("high","critical") by Alerts.src Alerts.user Alerts.id Alerts.vendor sourcetype | `drop_dm_object_name("Alerts")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | eval risk_score=case(severity="informational", 2, severity="low", 5, severity="medium", 10, severity="high", 50, severity="critical" , 100) | `detect_critical_alerts_from_security_tools_filter`' +how_to_implement: In order to properly run this search, you to ingest alerts data from other security products such as Crowdstrike, Microsoft Defender, or Carbon Black using appropriate TAs for that technology. Once ingested, the fields should be mapped to the Alerts data model. Make sure to apply transformation on the data if necessary. The risk_score field is used to calculate the risk score for the alerts and the mitre_technique_id field is used to map the alerts to the MITRE ATT&CK framework is dynamically created by the detection when this is triggered. These fields need not be set in the adaptive response actions. +known_false_positives: False positives may vary by endpoint protection tool; monitor and filter out the alerts that are not relevant to your environment. references: - https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/accessing-microsoft-defender-for-cloud-alerts-in-splunk-using/ba-p/938228 - https://docs.splunk.com/Documentation/CIM/5.3.2/User/Alerts diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/deprecated/domain_account_discovery_with_net_app.yml similarity index 82% rename from detections/endpoint/domain_account_discovery_with_net_app.yml rename to detections/deprecated/domain_account_discovery_with_net_app.yml index ae6841c195..7299b21596 100644 --- a/detections/endpoint/domain_account_discovery_with_net_app.yml +++ b/detections/deprecated/domain_account_discovery_with_net_app.yml @@ -1,17 +1,11 @@ name: Domain Account Discovery With Net App id: 98f6a534-04c2-11ec-96b2-acde48001122 version: 5 -date: '2024-11-13' +date: '2025-01-13' author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the execution of `net.exe` or `net1.exe` - with command-line arguments used to query domain users. It leverages data from Endpoint - Detection and Response (EDR) agents, focusing on process names and command-line - executions. This activity is significant as it may indicate an attempt by adversaries - to enumerate domain users for situational awareness and Active Directory discovery. - If confirmed malicious, this behavior could allow attackers to map out user accounts, - potentially leading to further exploitation or lateral movement within the network. +description: This following analytic has been deprecated in favour of the generic version "5d0d4830-0133-11ec-bae3-acde48001122". The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments used to query domain users. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an attempt by adversaries to enumerate domain users for situational awareness and Active Directory discovery. If confirmed malicious, this behavior could allow attackers to map out user accounts, potentially leading to further exploitation or lateral movement within the network. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/deprecated/domain_group_discovery_with_net.yml similarity index 74% rename from detections/endpoint/domain_group_discovery_with_net.yml rename to detections/deprecated/domain_group_discovery_with_net.yml index db7bba1982..af3f1f4e79 100644 --- a/detections/endpoint/domain_group_discovery_with_net.yml +++ b/detections/deprecated/domain_group_discovery_with_net.yml @@ -1,18 +1,11 @@ name: Domain Group Discovery With Net id: f2f14ac7-fa81-471a-80d5-7eb65c3c7349 version: 6 -date: '2024-12-16' +date: '2025-01-13' author: Mauricio Velazco, Splunk -status: production +status: deprecated type: Hunting -description: The following analytic identifies the execution of `net.exe` with command-line - arguments used to query domain groups, specifically `group /domain`. It leverages - data from Endpoint Detection and Response (EDR) agents, focusing on process names - and command-line arguments. This activity is significant as it indicates potential - reconnaissance efforts by adversaries to enumerate domain groups, which is a common - step in Active Directory Discovery. If confirmed malicious, this behavior could - allow attackers to gain insights into the domain structure, aiding in further attacks - such as privilege escalation or lateral movement. +description: This search has been deprecated in favour of the more generic analytic "c5c8e0f3-147a-43da-bf04-4cfaec27dc44". The following analytic identifies the execution of `net.exe` with command-line arguments used to query domain groups, specifically `group /domain`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate domain groups, which is a common step in Active Directory Discovery. If confirmed malicious, this behavior could allow attackers to gain insights into the domain structure, aiding in further attacks such as privilege escalation or lateral movement. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/deprecated/excel_spawning_powershell.yml similarity index 94% rename from detections/endpoint/excel_spawning_powershell.yml rename to detections/deprecated/excel_spawning_powershell.yml index 14609579ca..a4808cc05e 100644 --- a/detections/endpoint/excel_spawning_powershell.yml +++ b/detections/deprecated/excel_spawning_powershell.yml @@ -1,11 +1,12 @@ name: Excel Spawning PowerShell id: 42d40a22-9be3-11eb-8f08-acde48001122 version: 7 -date: '2024-12-10' +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects Microsoft Excel spawning PowerShell, an +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic detects Microsoft Excel spawning PowerShell, an uncommon and suspicious behavior. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is "excel.exe" and the child process is PowerShell. This activity is significant diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/deprecated/excel_spawning_windows_script_host.yml similarity index 91% rename from detections/endpoint/excel_spawning_windows_script_host.yml rename to detections/deprecated/excel_spawning_windows_script_host.yml index 1985646f4b..70da2b9f10 100644 --- a/detections/endpoint/excel_spawning_windows_script_host.yml +++ b/detections/deprecated/excel_spawning_windows_script_host.yml @@ -1,11 +1,12 @@ name: Excel Spawning Windows Script Host id: 57fe880a-9be3-11eb-9bf3-acde48001122 -version: 7 -date: '2024-12-10' +version: 8 +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where Microsoft Excel spawns +description: The following analytic has been deprecated in favour of a more generic approach. + The following analytic identifies instances where Microsoft Excel spawns Windows Script Host processes (`cscript.exe` or `wscript.exe`). This behavior is detected using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where the parent process is `excel.exe`. This activity is significant @@ -83,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/deprecated/net_localgroup_discovery.yml similarity index 78% rename from detections/endpoint/net_localgroup_discovery.yml rename to detections/deprecated/net_localgroup_discovery.yml index dd4243378c..e54388cb4c 100644 --- a/detections/endpoint/net_localgroup_discovery.yml +++ b/detections/deprecated/net_localgroup_discovery.yml @@ -1,17 +1,11 @@ name: Net Localgroup Discovery id: 54f5201e-155b-11ec-a6e2-acde48001122 version: 5 -date: '2024-12-10' +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting -description: The following analytic detects the execution of the `net localgroup` - command, which is used to enumerate local group memberships on a system. It leverages - data from Endpoint Detection and Response (EDR) agents, focusing on process execution - logs that include command-line details. This activity is significant because it - can indicate an attacker is gathering information about local group memberships, - potentially to identify privileged accounts. If confirmed malicious, this behavior - could lead to further privilege escalation or lateral movement within the network. +description: This search has been deprecated in favour of the more generic analytic "c5c8e0f3-147a-43da-bf04-4cfaec27dc44". The following analytic detects the execution of the `net localgroup` command, which is used to enumerate local group memberships on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because it can indicate an attacker is gathering information about local group memberships, potentially to identify privileged accounts. If confirmed malicious, this behavior could lead to further privilege escalation or lateral movement within the network. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/deprecated/office_application_spawn_regsvr32_process.yml similarity index 94% rename from detections/endpoint/office_application_spawn_regsvr32_process.yml rename to detections/deprecated/office_application_spawn_regsvr32_process.yml index 286df616c9..20aef6978a 100644 --- a/detections/endpoint/office_application_spawn_regsvr32_process.yml +++ b/detections/deprecated/office_application_spawn_regsvr32_process.yml @@ -1,11 +1,12 @@ name: Office Application Spawn Regsvr32 process id: 2d9fc90c-f11f-11eb-9300-acde48001122 version: 8 -date: '2024-12-10' +date: '2025-01-13' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where an Office application +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic identifies instances where an Office application spawns a Regsvr32 process, which is often indicative of macro execution or malicious code. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is a known Office application. diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/deprecated/office_application_spawn_rundll32_process.yml similarity index 94% rename from detections/endpoint/office_application_spawn_rundll32_process.yml rename to detections/deprecated/office_application_spawn_rundll32_process.yml index d42b43116e..fd944b75cf 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/deprecated/office_application_spawn_rundll32_process.yml @@ -1,11 +1,12 @@ name: Office Application Spawn rundll32 process id: 958751e4-9c5f-11eb-b103-acde48001122 version: 8 -date: '2024-12-10' +date: '2025-01-13' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where an Office application +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic identifies instances where an Office application spawns a rundll32 process, which is often indicative of macro execution or malicious code. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is a known Office application. diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/deprecated/office_product_spawn_cmd_process.yml similarity index 84% rename from detections/endpoint/office_product_spawn_cmd_process.yml rename to detections/deprecated/office_product_spawn_cmd_process.yml index 1491dedaab..acbe347fb7 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/deprecated/office_product_spawn_cmd_process.yml @@ -1,18 +1,12 @@ name: Office Product Spawn CMD Process id: b8b19420-e892-11eb-9244-acde48001122 version: 8 -date: '2024-11-13' +date: '2025-01-13' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects an Office product spawning a CMD process, - which is indicative of a macro executing shell commands to download or run malicious - code. This detection leverages data from Endpoint Detection and Response (EDR) agents, - focusing on process and parent process names. This activity is significant as it - often signals the execution of malicious payloads, such as those seen in Trickbot - spear-phishing campaigns. If confirmed malicious, this behavior could lead to unauthorized - code execution, potentially compromising the system and allowing further malicious - activities. +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic detects an Office product spawning a CMD process, which is indicative of a macro executing shell commands to download or run malicious code. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process names. This activity is significant as it often signals the execution of malicious payloads, such as those seen in Trickbot spear-phishing campaigns. If confirmed malicious, this behavior could lead to unauthorized code execution, potentially compromising the system and allowing further malicious activities. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/deprecated/office_product_spawning_bitsadmin.yml similarity index 94% rename from detections/endpoint/office_product_spawning_bitsadmin.yml rename to detections/deprecated/office_product_spawning_bitsadmin.yml index 0918e577ab..8c3de51640 100644 --- a/detections/endpoint/office_product_spawning_bitsadmin.yml +++ b/detections/deprecated/office_product_spawning_bitsadmin.yml @@ -1,11 +1,12 @@ name: Office Product Spawning BITSAdmin id: e8c591f4-a6d7-11eb-8cf7-acde48001122 version: 9 -date: '2024-12-10' +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects any Windows Office Product spawning `bitsadmin.exe`, +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic detects any Windows Office Product spawning `bitsadmin.exe`, a behavior often associated with malware families like TA551 and IcedID. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. This activity is significant because `bitsadmin.exe` diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/deprecated/office_product_spawning_certutil.yml similarity index 94% rename from detections/endpoint/office_product_spawning_certutil.yml rename to detections/deprecated/office_product_spawning_certutil.yml index 7f97b4ac57..d1e14b4181 100644 --- a/detections/endpoint/office_product_spawning_certutil.yml +++ b/detections/deprecated/office_product_spawning_certutil.yml @@ -1,11 +1,12 @@ name: Office Product Spawning CertUtil id: 6925fe72-a6d5-11eb-9e17-acde48001122 version: 9 -date: '2024-12-10' +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects any Windows Office Product spawning `certutil.exe`, +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic detects any Windows Office Product spawning `certutil.exe`, a behavior often associated with malware families like TA551 and IcedID. This detection leverages Endpoint Detection and Response (EDR) data, focusing on process relationships and command-line executions. The significance lies in the fact that `certutil.exe` diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/deprecated/office_product_spawning_mshta.yml similarity index 90% rename from detections/endpoint/office_product_spawning_mshta.yml rename to detections/deprecated/office_product_spawning_mshta.yml index 696bf2540d..966d3f3b98 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/deprecated/office_product_spawning_mshta.yml @@ -1,11 +1,12 @@ name: Office Product Spawning MSHTA id: 6078fa20-a6d2-11eb-b662-acde48001122 version: 8 -date: '2024-12-10' +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where a Microsoft Office +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic identifies instances where a Microsoft Office product spawns `mshta.exe`. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is an Office application. This activity is significant because it is a common @@ -80,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/office_product_spawning_windows_script_host.yml b/detections/deprecated/office_product_spawning_windows_script_host.yml similarity index 91% rename from detections/endpoint/office_product_spawning_windows_script_host.yml rename to detections/deprecated/office_product_spawning_windows_script_host.yml index 903cde52fb..20ee47bc5c 100644 --- a/detections/endpoint/office_product_spawning_windows_script_host.yml +++ b/detections/deprecated/office_product_spawning_windows_script_host.yml @@ -1,11 +1,12 @@ name: Office Product Spawning Windows Script Host id: b3628a5b-8d02-42fa-a891-eebf2351cbe1 version: 10 -date: '2024-12-10' +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects an Office product spawning WScript.exe +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic detects an Office product spawning WScript.exe or CScript.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where Office applications are the parent processes. This activity is significant because it may indicate the execution of potentially @@ -83,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/deprecated/office_product_spawning_wmic.yml similarity index 91% rename from detections/endpoint/office_product_spawning_wmic.yml rename to detections/deprecated/office_product_spawning_wmic.yml index 5b92510727..6360ea5c4e 100644 --- a/detections/endpoint/office_product_spawning_wmic.yml +++ b/detections/deprecated/office_product_spawning_wmic.yml @@ -1,11 +1,12 @@ name: Office Product Spawning Wmic id: ffc236d6-a6c9-11eb-95f1-acde48001122 version: 10 -date: '2024-12-10' +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects any Windows Office Product spawning `wmic.exe`, +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic detects any Windows Office Product spawning `wmic.exe`, specifically when the command-line of `wmic.exe` contains `wmic process call create`. This behavior is identified using data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. This activity is significant @@ -81,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/deprecated/remote_system_discovery_with_net.yml b/detections/deprecated/remote_system_discovery_with_net.yml new file mode 100644 index 0000000000..2377264b52 --- /dev/null +++ b/detections/deprecated/remote_system_discovery_with_net.yml @@ -0,0 +1,36 @@ +name: Remote System Discovery with Net +id: 9df16706-04a2-41e2-bbfe-9b38b34409d3 +version: 5 +date: '2025-01-13' +author: Mauricio Velazco, Splunk +status: deprecated +type: Hunting +description: The following analytic has been deprecated in favour of two dedicated analytics "4dc3951f-b3f8-4f46-b412-76a483f72277" and "a23a0e20-0b1b-4a07-82e5-ec5f70811e7a" .The following analytic identifies the execution of `net.exe` or `net1.exe` with command-line arguments used to discover remote systems, such as `domain computers /domain`. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries or Red Teams to map out networked systems and Active Directory structures. If confirmed malicious, this behavior could lead to further network exploitation, privilege escalation, or lateral movement within the environment. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process="*domain computers*" AND Processes.process=*/do*) OR (Processes.process="*view*" AND Processes.process=*/do*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_system_discovery_with_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1018/ +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ +tags: + analytic_story: + - Active Directory Discovery + - IcedID + asset_type: Endpoint + mitre_attack_id: + - T1018 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/deprecated/winword_spawning_cmd.yml similarity index 90% rename from detections/endpoint/winword_spawning_cmd.yml rename to detections/deprecated/winword_spawning_cmd.yml index 286902e5df..5760517a84 100644 --- a/detections/endpoint/winword_spawning_cmd.yml +++ b/detections/deprecated/winword_spawning_cmd.yml @@ -1,11 +1,12 @@ name: Winword Spawning Cmd id: 6fcbaedc-a37b-11eb-956b-acde48001122 version: 7 -date: '2024-12-10' +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where Microsoft Word (winword.exe) +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic identifies instances where Microsoft Word (winword.exe) spawns the command prompt (cmd.exe). This behavior is detected using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where the parent process is winword.exe. This activity is significant because it is uncommon and @@ -81,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/deprecated/winword_spawning_powershell.yml similarity index 91% rename from detections/endpoint/winword_spawning_powershell.yml rename to detections/deprecated/winword_spawning_powershell.yml index 97e512c743..b2e102dc75 100644 --- a/detections/endpoint/winword_spawning_powershell.yml +++ b/detections/deprecated/winword_spawning_powershell.yml @@ -1,11 +1,12 @@ name: Winword Spawning PowerShell id: b2c950b8-9be2-11eb-8658-acde48001122 version: 7 -date: '2024-12-10' +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where Microsoft Word (winword.exe) +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic identifies instances where Microsoft Word (winword.exe) spawns a PowerShell process. This behavior is detected using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where the parent process is winword.exe. This activity is significant because it is uncommon and @@ -84,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/deprecated/winword_spawning_windows_script_host.yml similarity index 91% rename from detections/endpoint/winword_spawning_windows_script_host.yml rename to detections/deprecated/winword_spawning_windows_script_host.yml index df2997ec4a..16ee7d84c1 100644 --- a/detections/endpoint/winword_spawning_windows_script_host.yml +++ b/detections/deprecated/winword_spawning_windows_script_host.yml @@ -1,11 +1,12 @@ name: Winword Spawning Windows Script Host id: 637e1b5c-9be1-11eb-9c32-acde48001122 version: 6 -date: '2024-12-10' +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where Microsoft Winword.exe +description: The following analytic has been deprecated in favour of a more generic approach. + The following analytic identifies instances where Microsoft Winword.exe spawns Windows Script Host processes (cscript.exe or wscript.exe). This behavior is detected using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where the parent process is Winword.exe. This activity is significant @@ -79,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_wsh.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_wsh.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml deleted file mode 100644 index d97c43041d..0000000000 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ /dev/null @@ -1,95 +0,0 @@ -name: Attempt To Stop Security Service -id: c8e349c6-b97c-486e-8949-bd7bcd1f3910 -version: 8 -date: '2024-11-13' -author: Rico Valdez, Splunk -status: production -type: TTP -description: The following analytic detects attempts to stop security-related services - on an endpoint, which may indicate malicious activity. It leverages data from Endpoint - Detection and Response (EDR) agents, specifically searching for processes involving - the "sc.exe" command with the "stop" parameter. This activity is significant because - disabling security services can undermine the organization's security posture, potentially - leading to unauthorized access, data exfiltration, or further attacks like malware - installation or privilege escalation. If confirmed malicious, this behavior could - compromise the endpoint and the entire network, necessitating immediate investigation - and response. -data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_net` OR Processes.process_name = sc.exe Processes.process="* stop - *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` |lookup security_services_lookup service as - process OUTPUTNEW category, description | search category=security | `attempt_to_stop_security_service_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: None identified. Attempts to disable security-related services - should be identified and understood. -references: -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service -- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ -drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: An instance of $parent_process_name$ spawning $process_name$ was identified - attempting to disable security services on endpoint $dest$ by user $user$. - risk_objects: - - field: user - type: user - score: 20 - - field: dest - type: system - score: 20 - threat_objects: - - field: parent_process_name - type: parent_process_name - - field: process_name - type: process_name -tags: - analytic_story: - - WhisperGate - - Graceful Wipe Out Attack - - Disabling Security Tools - - Data Destruction - - Azorult - - Trickbot - asset_type: Endpoint - mitre_attack_id: - - T1562.001 - - T1562 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_defend_service_stop/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/change_default_file_association.yml deleted file mode 100644 index 9b5b14c169..0000000000 --- a/detections/endpoint/change_default_file_association.yml +++ /dev/null @@ -1,81 +0,0 @@ -name: Change Default File Association -id: 462d17d8-1f71-11ec-ad07-acde48001122 -version: 4 -date: '2024-11-13' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic detects suspicious registry modifications that - change the default file association to execute a malicious payload. It leverages - data from the Endpoint data model, specifically monitoring registry paths under - "*\\shell\\open\\command\\*" and "*HKCR\\*". This activity is significant because - altering default file associations can allow attackers to execute arbitrary scripts - or payloads when a user opens a file, leading to potential code execution. If confirmed - malicious, this technique can enable attackers to persist on the compromised host - and execute further malicious commands, posing a severe threat to the environment. -data_source: -- Sysmon EventID 12 -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path - ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest Registry.user - Registry.registry_path Registry.registry_key_name Registry.registry_value_name | - `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` - | `change_default_file_association_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features -drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: Registry path $registry_path$ was modified, added, or deleted on $dest$. - risk_objects: - - field: dest - type: system - score: 80 - - field: user - type: user - score: 80 - threat_objects: [] -tags: - analytic_story: - - Hermetic Wiper - - Windows Registry Abuse - - Prestige Ransomware - - Windows Privilege Escalation - - Windows Persistence Techniques - - Data Destruction - asset_type: Endpoint - mitre_attack_id: - - T1546.001 - - T1546 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml deleted file mode 100644 index 7eaaa1fb05..0000000000 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ /dev/null @@ -1,102 +0,0 @@ -name: Cmdline Tool Not Executed In CMD Shell -id: 6c3f7dd8-153c-11ec-ac2d-acde48001122 -version: 6 -date: '2024-11-13' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, - or similar tools are executed by a non-standard parent process, excluding CMD, PowerShell, - or Explorer. This detection leverages Endpoint Detection and Response (EDR) telemetry - to monitor process creation events. Such behavior is significant as it may indicate - adversaries using injected processes to perform system discovery, a tactic observed - in FIN7's JSSLoader. If confirmed malicious, this activity could allow attackers - to gather critical host information, aiding in further exploitation or lateral movement - within the network. -data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "ipconfig.exe" - OR Processes.process_name = "systeminfo.exe" OR Processes.process_name = "net.exe" - OR Processes.process_name = "net1.exe" OR Processes.process_name = "arp.exe" OR - Processes.process_name = "nslookup.exe" OR Processes.process_name = "route.exe" - OR Processes.process_name = "netstat.exe" OR Processes.process_name = "whoami.exe") - AND NOT (Processes.parent_process_name = "cmd.exe" OR Processes.parent_process_name - = "powershell*" OR Processes.parent_process_name="pwsh.exe" OR Processes.parent_process_name - = "explorer.exe") by Processes.parent_process_name Processes.parent_process Processes.process_name - Processes.original_file_name Processes.process_id Processes.process Processes.dest - Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `cmdline_tool_not_executed_in_cmd_shell_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: A network operator or systems administrator may utilize an - automated host discovery application that may generate false positives. Filter as - needed. -references: -- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation -- https://attack.mitre.org/groups/G0046/ -- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ -drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: A non-standard parent process $parent_process_name$ spawned child process - $process_name$ to execute command-line tool on $dest$. - risk_objects: - - field: dest - type: system - score: 56 - - field: user - type: user - score: 56 - threat_objects: - - field: parent_process_name - type: parent_process_name - - field: process_name - type: process_name -tags: - analytic_story: - - Volt Typhoon - - Rhysida Ransomware - - FIN7 - - DarkGate Malware - - Qakbot - - CISA AA22-277A - - CISA AA23-347A - - Gozi Malware - asset_type: Endpoint - mitre_attack_id: - - T1059 - - T1059.007 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml deleted file mode 100644 index febef3b4f9..0000000000 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ /dev/null @@ -1,93 +0,0 @@ -name: Create local admin accounts using net exe -id: b89919ed-fe5f-492c-b139-151bb162040e -version: 14 -date: '2024-12-10' -author: Bhavin Patel, Splunk -status: production -type: TTP -description: The following analytic detects the creation of local administrator accounts - using the net.exe command. It leverages Endpoint Detection and Response (EDR) data - to identify processes named net.exe or net1.exe with the "/add" parameter and keywords - related to administrator accounts. This activity is significant as it may indicate - an attacker attempting to gain persistent access or escalate privileges. If confirmed - malicious, this could lead to unauthorized access, data theft, or further system - compromise. Review the process details, user context, and related artifacts to determine - the legitimacy of the activity. -data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.user) as - user values(Processes.parent_process) as parent_process values(parent_process_name) - as parent_process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_net` AND Processes.process=*/add* AND (Processes.process=*administrators* - OR Processes.process=*administratoren* OR Processes.process=*administrateurs* OR - Processes.process=*administrador* OR Processes.process=*amministratori* OR Processes.process=*administratorer* - OR Processes.process=*Rendszergazda* OR Processes.process=*Администратор* OR Processes.process=*Administratör*) - by Processes.process Processes.process_name Processes.parent_process_name Processes.dest - Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `create_local_admin_accounts_using_net_exe_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: Administrators often leverage net.exe to create admin accounts. -references: [] -drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators - group. - risk_objects: - - field: user - type: user - score: 30 - - field: dest - type: system - score: 30 - threat_objects: - - field: parent_process_name - type: parent_process_name - - field: process_name - type: process_name -tags: - analytic_story: - - DHS Report TA18-074A - - Azorult - - CISA AA22-257A - - DarkGate Malware - - CISA AA24-241A - asset_type: Endpoint - mitre_attack_id: - - T1136.001 - - T1136 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml deleted file mode 100644 index 9d8205ac10..0000000000 --- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml +++ /dev/null @@ -1,90 +0,0 @@ -name: Detect processes used for System Network Configuration Discovery -id: a51bfe1a-94f0-48cc-b1e4-16ae10145893 -version: 6 -date: '2024-11-13' -author: Bhavin Patel, Splunk -status: production -type: TTP -description: The following analytic identifies the rapid execution of processes used - for system network configuration discovery on an endpoint. It leverages data from - Endpoint Detection and Response (EDR) agents, focusing on process GUIDs, names, - parent processes, and command-line executions. This activity is significant as it - may indicate an attacker attempting to map the network, which is a common precursor - to lateral movement or further exploitation. If confirmed malicious, this behavior - could allow an attacker to gain insights into the network topology, identify critical - systems, and plan subsequent attacks, potentially leading to data exfiltration or - system compromise. -data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.process) - as process values(Processes.parent_process) as parent_process min(_time) as firstTime - max(_time) as lastTime from datamodel=Endpoint.Processes where NOT Processes.user - IN ("","unknown") by Processes.dest Processes.process_name Processes.parent_process_name - Processes.user _time | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `drop_dm_object_name(Processes)` | search `system_network_configuration_discovery_tools` - | transaction dest connected=false maxpause=5m |where eventcount>=5 | table firstTime - lastTime dest user process_name process parent_process parent_process_name eventcount - | `detect_processes_used_for_system_network_configuration_discovery_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: It is uncommon for normal users to execute a series of commands - used for network discovery. System administrators often use scripts to execute these - commands. These can generate false positives. -references: [] -drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: An instance of $parent_process_name$ spawning multiple $process_name$ was - identified on endpoint $dest$ by user $user$ typically not a normal behavior of - the process. - risk_objects: - - field: user - type: user - score: 32 - - field: dest - type: system - score: 32 - threat_objects: - - field: parent_process_name - type: parent_process_name - - field: process_name - type: process_name -tags: - analytic_story: - - Unusual Processes - asset_type: Endpoint - mitre_attack_id: - - T1016 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/discovery_commands/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/elevated_group_discovery_with_net.yml b/detections/endpoint/elevated_group_discovery_with_net.yml deleted file mode 100644 index 04c2e9a3ee..0000000000 --- a/detections/endpoint/elevated_group_discovery_with_net.yml +++ /dev/null @@ -1,86 +0,0 @@ -name: Elevated Group Discovery With Net -id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a -version: 5 -date: '2024-12-10' -author: Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic detects the execution of `net.exe` or `net1.exe` - with command-line arguments used to query elevated domain groups. It leverages data - from Endpoint Detection and Response (EDR) agents, focusing on process names and - command-line executions. This activity is significant as it indicates potential - reconnaissance efforts by adversaries to identify high-privileged users within Active - Directory. If confirmed malicious, this behavior could lead to further attacks aimed - at compromising privileged accounts, escalating privileges, or gaining unauthorized - access to sensitive systems and data. -data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process="*group*" - AND Processes.process="*/do*") (Processes.process="*Domain Admins*" OR Processes.process="*Enterprise - Admins*" OR Processes.process="*Schema Admins*" OR Processes.process="*Account Operators*" - OR Processes.process="*Server Operators*" OR Processes.process="*Protected Users*" - OR Processes.process="*Dns Admins*") by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `elevated_group_discovery_with_net_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1069/002/ -- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory -- https://adsecurity.org/?p=3658 -- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF -drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: Elevated domain group discovery enumeration on $dest$ by $user$ - risk_objects: - - field: dest - type: system - score: 21 - threat_objects: [] -tags: - analytic_story: - - Active Directory Discovery - - Volt Typhoon - - Rhysida Ransomware - - BlackSuit Ransomware - asset_type: Endpoint - mitre_attack_id: - - T1069 - - T1069.002 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml deleted file mode 100644 index 49e1c2b156..0000000000 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Excessive Service Stop Attempt -id: ae8d3f4a-acd7-11eb-8846-acde48001122 -version: 6 -date: '2024-11-13' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic detects multiple attempts to stop or delete services - on a system using `net.exe`, `sc.exe`, or `net1.exe`. It leverages Endpoint Detection - and Response (EDR) telemetry, focusing on process names and command-line executions - within a one-minute window. This activity is significant as it may indicate an adversary - attempting to disable security or critical services to evade detection and further - their objectives. If confirmed malicious, this could lead to the attacker gaining - persistence, escalating privileges, or disrupting essential services, thereby compromising - the system's security posture. -data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_net` OR Processes.process_name - = "sc.exe" OR Processes.process_name = "net1.exe" AND Processes.process="*stop*" - OR Processes.process="*delete*" by Processes.process_name Processes.original_file_name - Processes.parent_process_name Processes.dest Processes.user _time span=1m | where - count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `excessive_service_stop_attempt_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: unknown -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: An excessive amount of $process_name$ was executed on $dest$ attempting - to disable services. - risk_objects: - - field: dest - type: system - score: 80 - threat_objects: - - field: process_name - type: process_name -tags: - analytic_story: - - Ransomware - - BlackByte Ransomware - - Crypto Stealer - - XMRig - asset_type: Endpoint - mitre_attack_id: - - T1489 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml deleted file mode 100644 index 37956c9bd9..0000000000 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ /dev/null @@ -1,88 +0,0 @@ -name: Excessive Usage Of Net App -id: 45e52536-ae42-11eb-b5c6-acde48001122 -version: 5 -date: '2024-11-13' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic detects excessive usage of `net.exe` or `net1.exe` - within a one-minute interval. It leverages data from Endpoint Detection and Response - (EDR) agents, focusing on process names, parent processes, and command-line executions. - This behavior is significant as it may indicate an adversary attempting to create, - delete, or disable multiple user accounts rapidly, a tactic observed in Monero mining - incidents. If confirmed malicious, this activity could lead to unauthorized user - account manipulation, potentially compromising system integrity and enabling further - malicious actions. -data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process_name - Processes.parent_process_name Processes.original_file_name Processes.dest Processes.user - _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `excessive_usage_of_net_app_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: unknown. Filter as needed. Modify the time span as needed. -references: -- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ -drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: Excessive usage of net1.exe or net.exe within 1m, with command line $process$ - has been detected on $dest$ by $user$ - risk_objects: - - field: user - type: user - score: 28 - - field: dest - type: system - score: 28 - threat_objects: - - field: process_name - type: process_name -tags: - analytic_story: - - Prestige Ransomware - - Graceful Wipe Out Attack - - XMRig - - Windows Post-Exploitation - - Azorult - - Ransomware - - Rhysida Ransomware - asset_type: Endpoint - mitre_attack_id: - - T1531 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml deleted file mode 100644 index 9002c8def1..0000000000 --- a/detections/endpoint/extraction_of_registry_hives.yml +++ /dev/null @@ -1,91 +0,0 @@ -name: Extraction of Registry Hives -id: 8bbb7d58-b360-11eb-ba21-acde48001122 -version: 5 -date: '2024-11-13' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic detects the use of `reg.exe` to export Windows - Registry hives, which may contain sensitive credentials. This detection leverages - data from Endpoint Detection and Response (EDR) agents, focusing on command-line - executions involving `save` or `export` actions targeting the `sam`, `system`, or - `security` hives. This activity is significant as it indicates potential offline - credential access attacks, often executed from untrusted processes or scripts. If - confirmed malicious, attackers could gain access to credential data, enabling further - compromise and lateral movement within the network. -data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_reg` (Processes.process=*save* - OR Processes.process=*export*) AND (Processes.process="*\sam *" OR Processes.process="*\system - *" OR Processes.process="*\security *") by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.parent_process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `extraction_of_registry_hives_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: It is possible some agent based products will generate false - positives. Filter as needed. -references: -- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md -- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF -drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: Suspicious use of `reg.exe` exporting Windows Registry hives containing - credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$ - risk_objects: - - field: user - type: user - score: 56 - - field: dest - type: system - score: 56 - threat_objects: - - field: parent_process_name - type: parent_process_name -tags: - analytic_story: - - Volt Typhoon - - Credential Dumping - - CISA AA23-347A - - DarkSide Ransomware - - CISA AA22-257A - asset_type: Endpoint - mitre_attack_id: - - T1003.002 - - T1003 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/linux_auditd_auditd_service_stop.yml b/detections/endpoint/linux_auditd_auditd_service_stop.yml index 3dfb171bf2..8efe47b2f9 100644 --- a/detections/endpoint/linux_auditd_auditd_service_stop.yml +++ b/detections/endpoint/linux_auditd_auditd_service_stop.yml @@ -46,7 +46,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A service event - [$type$] event occured on host - [$dest$]. + message: A service event - [$type$] event occurred on host - [$dest$]. risk_objects: - field: dest type: system diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml index c3afef3870..a45a65d0f8 100644 --- a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml @@ -1,35 +1,16 @@ name: Linux Auditd Change File Owner To Root id: 7b87c556-0ca4-47e0-b84c-6cd62a0a3e90 version: 4 -date: '2024-11-13' +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the use of the 'chown' command to change - a file owner to 'root' on a Linux system. It leverages Linux Auditd telemetry, specifically - monitoring command-line executions and process details. This activity is significant - as it may indicate an attempt to escalate privileges by adversaries, malware, or - red teamers. If confirmed malicious, this action could allow an attacker to gain - root-level access, leading to full control over the compromised host and potential - persistence within the environment. +description: The following analytic detects the use of the 'chown' command to change a file owner to 'root' on a Linux system. It leverages Linux Auditd telemetry, specifically monitoring command-line executions and process details. This activity is significant as it may indicate an attempt to escalate privileges by adversaries, malware, or red teamers. If confirmed malicious, this action could allow an attacker to gain root-level access, leading to full control over the compromised host and potential persistence within the environment. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as - dest | where LIKE (process_exec, "%chown %root%") | stats count min(_time) as firstTime - max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_change_file_owner_to_root_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as dest | where LIKE (process_exec, "%chown %root%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_change_file_owner_to_root_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users - https://askubuntu.com/questions/617850/changing-from-user-to-superuser @@ -39,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -73,7 +49,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/linux_auditd_chown_root/linux_auditd_chown_root.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/linux_auditd_chown_root/linux_auditd_chown_root.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml index 979500e7f3..0a32d1b5d3 100644 --- a/detections/endpoint/linux_auditd_clipboard_data_copy.yml +++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml @@ -1,36 +1,16 @@ name: Linux Auditd Clipboard Data Copy id: 9ddfe470-c4d0-4e60-8668-7337bd699edd version: 3 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the use of the Linux 'xclip' command to - copy data from the clipboard. It leverages Linux Auditd telemetry, focusing on process - names and command-line arguments related to clipboard operations. This activity - is significant because adversaries can exploit clipboard data to capture sensitive - information such as passwords or IP addresses. If confirmed malicious, this technique - could lead to unauthorized data exfiltration, compromising sensitive information - and potentially aiding further attacks within the environment. +description: The following analytic detects the use of the Linux 'xclip' command to copy data from the clipboard. It leverages Linux Auditd telemetry, focusing on process names and command-line arguments related to clipboard operations. This activity is significant because adversaries can exploit clipboard data to capture sensitive information such as passwords or IP addresses. If confirmed malicious, this technique could lead to unauthorized data exfiltration, compromising sensitive information and potentially aiding further attacks within the environment. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where LIKE(process_exec, "%xclip%") AND (LIKE(process_exec, "%clipboard%") - OR LIKE(process_exec, "%-o%") OR LIKE(process_exec, "%clip %") OR LIKE(process_exec, - "%-selection %") OR LIKE(process_exec, "%sel %")) | stats count min(_time) as firstTime - max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `linux_auditd_clipboard_data_copy_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: False positives may be present on Linux desktop as it may commonly - be used by administrators or end users. Filter as needed. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE(process_exec, "%xclip%") AND (LIKE(process_exec, "%clipboard%") OR LIKE(process_exec, "%-o%") OR LIKE(process_exec, "%clip %") OR LIKE(process_exec, "%-selection %") OR LIKE(process_exec, "%sel %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_clipboard_data_copy_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: False positives may be present on Linux desktop as it may commonly be used by administrators or end users. Filter as needed. references: - https://attack.mitre.org/techniques/T1115/ - https://linux.die.net/man/1/xclip @@ -40,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -71,7 +46,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1115/linux_auditd_xclip/linux_auditd_xclip.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1115/linux_auditd_xclip/linux_auditd_xclip.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_data_destruction_command.yml b/detections/endpoint/linux_auditd_data_destruction_command.yml index dc43b12c00..94d554eb0a 100644 --- a/detections/endpoint/linux_auditd_data_destruction_command.yml +++ b/detections/endpoint/linux_auditd_data_destruction_command.yml @@ -1,34 +1,15 @@ name: Linux Auditd Data Destruction Command id: 4da5ce1a-f71b-4e71-bb73-c0a3c73f3c3c version: 3 -date: '2024-11-13' +date: '2025-01-15' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the execution of a Unix shell command - designed to wipe root directories on a Linux host. It leverages data from Linux - Auditd, focusing on the 'rm' command with force recursive deletion and the '--no-preserve-root' - option. This activity is significant as it indicates potential data destruction - attempts, often associated with malware like Awfulshred. If confirmed malicious, - this behavior could lead to severe data loss, system instability, and compromised - integrity of the affected Linux host. Immediate investigation and response are crucial - to mitigate potential damage. +description: The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host. It leverages data from Linux Auditd, focusing on the 'rm' command with force recursive deletion and the '--no-preserve-root' option. This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred. If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host. Immediate investigation and response are crucial to mitigate potential damage. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where LIKE (process_exec, "%rm %") AND LIKE (process_exec, "% -rf %") AND - LIKE (process_exec, "%--no-preserve-root%") | stats count min(_time) as firstTime - max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_data_destruction_command_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE (process_exec, "%rm %") AND LIKE (process_exec, "% -rf %") AND LIKE (process_exec, "%--no-preserve-root%") | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_destruction_command_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: unknown references: - https://cert.gov.ua/article/3718487 @@ -39,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -70,7 +46,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_auditd_no_preserve_root/linux_auditd_no_preserve_root.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_auditd_no_preserve_root/linux_auditd_no_preserve_root.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml index 33168817ae..2c7f2eee4e 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml @@ -1,35 +1,16 @@ name: Linux Auditd Data Transfer Size Limits Via Split id: 4669561d-3bbd-44e3-857c-0e3c6ef2120c version: 3 -date: '2024-11-13' +date: '2025-01-15' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious data transfer activities that - involve the use of the `split` syscall, potentially indicating an attempt to evade - detection by breaking large files into smaller parts. Attackers may use this technique - to bypass size-based security controls, facilitating the covert exfiltration of - sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall, - this analytic helps identify potential data exfiltration attempts, allowing security - teams to intervene and prevent the unauthorized transfer of critical information - from the network. +description: The following analytic detects suspicious data transfer activities that involve the use of the `split` syscall, potentially indicating an attempt to evade detection by breaking large files into smaller parts. Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where LIKE(process_exec, "%split %") AND LIKE(process_exec, "% -b %") | stats - count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_transfer_size_limits_via_split_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE(process_exec, "%split %") AND LIKE(process_exec, "% -b %") | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_transfer_size_limits_via_split_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html drilldown_searches: @@ -38,12 +19,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -70,7 +46,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1030/linux_auditd_split_b_exec/linux_auditd_split_b_exec.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1030/linux_auditd_split_b_exec/linux_auditd_split_b_exec.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml index 6457b55aed..d9643341cb 100644 --- a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml @@ -1,42 +1,16 @@ name: Linux Auditd Database File And Directory Discovery id: f616c4f3-bde9-41cf-856c-019b65f668bb version: 4 -date: '2024-11-13' +date: '2025-01-15' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious database file and directory - discovery activities, which may signal an attacker attempt to locate and assess - critical database assets on a compromised system. This behavior is often a precursor - to data theft, unauthorized access, or privilege escalation, as attackers seek to - identify valuable information stored in databases. By monitoring for unusual or - unauthorized attempts to locate database files and directories, this analytic aids - in early detection of potential reconnaissance or data breach efforts, enabling - security teams to respond swiftly and mitigate the risk of further compromise. +description: The following analytic detects suspicious database file and directory discovery activities, which may signal an attacker attempt to locate and assess critical database assets on a compromised system. This behavior is often a precursor to data theft, unauthorized access, or privilege escalation, as attackers seek to identify valuable information stored in databases. By monitoring for unusual or unauthorized attempts to locate database files and directories, this analytic aids in early detection of potential reconnaissance or data breach efforts, enabling security teams to respond swiftly and mitigate the risk of further compromise. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND - (LIKE (process_exec, "%.db%") OR LIKE (process_exec, "%.sql%") OR LIKE (process_exec, - "%.sqlite%") OR LIKE (process_exec, "%.mdb%")OR LIKE (process_exec, "%.accdb%")OR - LIKE (process_exec, "%.mdf%")OR LIKE (process_exec, "%.ndf%")OR LIKE (process_exec, - "%.ldf%")OR LIKE (process_exec, "%.frm%")OR LIKE (process_exec, "%.idb%")OR LIKE - (process_exec, "%.myd%")OR LIKE (process_exec, "%.myi%")OR LIKE (process_exec, "%.dbf%")OR - LIKE (process_exec, "%.db2%")OR LIKE (process_exec, "%.dbc%")OR LIKE (process_exec, - "%.fpt%")OR LIKE (process_exec, "%.ora%")) | stats count min(_time) as firstTime - max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_database_file_and_directory_discovery_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.db%") OR LIKE (process_exec, "%.sql%") OR LIKE (process_exec, "%.sqlite%") OR LIKE (process_exec, "%.mdb%")OR LIKE (process_exec, "%.accdb%")OR LIKE (process_exec, "%.mdf%")OR LIKE (process_exec, "%.ndf%")OR LIKE (process_exec, "%.ldf%")OR LIKE (process_exec, "%.frm%")OR LIKE (process_exec, "%.idb%")OR LIKE (process_exec, "%.myd%")OR LIKE (process_exec, "%.myi%")OR LIKE (process_exec, "%.dbf%")OR LIKE (process_exec, "%.db2%")OR LIKE (process_exec, "%.dbc%")OR LIKE (process_exec, "%.fpt%")OR LIKE (process_exec, "%.ora%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_database_file_and_directory_discovery_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS @@ -46,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -79,7 +48,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_find_db/linux_auditd_find_db.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_find_db/linux_auditd_find_db.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml index 9a5ee1f5fe..5dfd17febc 100644 --- a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml +++ b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml @@ -46,7 +46,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A service event - [$type$] to disable or modify system firewall occured + message: A service event - [$type$] to disable or modify system firewall occurred on host - [$dest$] . risk_objects: - field: dest diff --git a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml index 16fccb7a70..6eea3f2bdf 100644 --- a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml @@ -47,7 +47,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A [$type$] event occured on host - [$dest$] to create a doas.conf file. + message: A [$type$] event occurred on host - [$dest$] to create a doas.conf file. risk_objects: - field: dest type: system diff --git a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml index 52a86aa342..f117d9113f 100644 --- a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml @@ -1,46 +1,16 @@ name: Linux Auditd File And Directory Discovery id: 0bbfb79c-a755-49a5-a38a-1128d0a452f1 version: 3 -date: '2024-11-13' +date: '2025-01-15' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious file and directory discovery - activities, which may indicate an attacker's effort to locate sensitive documents - and files on a compromised system. This behavior often precedes data exfiltration, - as adversaries seek to identify valuable or confidential information for theft. - By identifying unusual or unauthorized attempts to browse or enumerate files and - directories, this analytic helps security teams detect potential reconnaissance - or preparatory actions by an attacker, enabling timely intervention to prevent data - breaches or unauthorized access. +description: The following analytic detects suspicious file and directory discovery activities, which may indicate an attacker's effort to locate sensitive documents and files on a compromised system. This behavior often precedes data exfiltration, as adversaries seek to identify valuable or confidential information for theft. By identifying unusual or unauthorized attempts to browse or enumerate files and directories, this analytic helps security teams detect potential reconnaissance or preparatory actions by an attacker, enabling timely intervention to prevent data breaches or unauthorized access. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND - (LIKE (process_exec, "%.tif%") OR LIKE (process_exec, "%.tiff%") OR LIKE (process_exec, - "%.gif%") OR LIKE (process_exec, "%.jpeg%")OR LIKE (process_exec, "%.jpg%")OR LIKE - (process_exec, "%.jif%")OR LIKE (process_exec, "%.jfif%")OR LIKE (process_exec, - "%.jp2%")OR LIKE (process_exec, "%.jpx%")OR LIKE (process_exec, "%.j2k%")OR LIKE - (process_exec, "%.j2c%")OR LIKE (process_exec, "%.fpx%")OR LIKE (process_exec, "%.pcd%")OR - LIKE (process_exec, "%.png%")OR LIKE (process_exec, "%.flv%") OR LIKE (process_exec, - "%.pdf%")OR LIKE (process_exec, "%.mp4%")OR LIKE (process_exec, "%.mp3%")OR LIKE - (process_exec, "%.gifv%")OR LIKE (process_exec, "%.avi%")OR LIKE (process_exec, - "%.mov%")OR LIKE (process_exec, "%.mpeg%")OR LIKE (process_exec, "%.wav%")OR LIKE - (process_exec, "%.doc%")OR LIKE (process_exec, "%.docx%")OR LIKE (process_exec, - "%.xls%")OR LIKE (process_exec, "%.xlsx%")OR LIKE (process_exec, "%.svg%")) | stats - count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_and_directory_discovery_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.tif%") OR LIKE (process_exec, "%.tiff%") OR LIKE (process_exec, "%.gif%") OR LIKE (process_exec, "%.jpeg%")OR LIKE (process_exec, "%.jpg%")OR LIKE (process_exec, "%.jif%")OR LIKE (process_exec, "%.jfif%")OR LIKE (process_exec, "%.jp2%")OR LIKE (process_exec, "%.jpx%")OR LIKE (process_exec, "%.j2k%")OR LIKE (process_exec, "%.j2c%")OR LIKE (process_exec, "%.fpx%")OR LIKE (process_exec, "%.pcd%")OR LIKE (process_exec, "%.png%")OR LIKE (process_exec, "%.flv%") OR LIKE (process_exec, "%.pdf%")OR LIKE (process_exec, "%.mp4%")OR LIKE (process_exec, "%.mp3%")OR LIKE (process_exec, "%.gifv%")OR LIKE (process_exec, "%.avi%")OR LIKE (process_exec, "%.mov%")OR LIKE (process_exec, "%.mpeg%")OR LIKE (process_exec, "%.wav%")OR LIKE (process_exec, "%.doc%")OR LIKE (process_exec, "%.docx%")OR LIKE (process_exec, "%.xls%")OR LIKE (process_exec, "%.xlsx%")OR LIKE (process_exec, "%.svg%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_and_directory_discovery_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS @@ -50,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -83,7 +48,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_find_document/linux_auditd_find_document.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_find_document/linux_auditd_find_document.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml index f1a05daa1a..d0316fa643 100644 --- a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml +++ b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml @@ -22,7 +22,7 @@ search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename hos max(_time) as lastTime by process_exec proctitle dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_permission_modification_via_chmod_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step diff --git a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml index 3618f2cc1d..84bb8beef4 100644 --- a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml +++ b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml @@ -1,36 +1,16 @@ name: Linux Auditd File Permissions Modification Via Chattr id: f2d1110d-b01c-4a58-9975-90a9edeb083a version: 3 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious file permissions modifications - using the chattr command, which may indicate an attacker attempting to manipulate - file attributes to evade detection or prevent alteration. The chattr command can - be used to make files immutable or restrict deletion, which can be leveraged to - protect malicious files or disrupt system operations. By monitoring for unusual - or unauthorized chattr usage, this analytic helps identify potential tampering with - critical files, enabling security teams to quickly respond to and mitigate threats - associated with unauthorized file attribute changes. +description: The following analytic detects suspicious file permissions modifications using the chattr command, which may indicate an attacker attempting to manipulate file attributes to evade detection or prevent alteration. The chattr command can be used to make files immutable or restrict deletion, which can be leveraged to protect malicious files or disrupt system operations. By monitoring for unusual or unauthorized chattr usage, this analytic helps identify potential tampering with critical files, enabling security teams to quickly respond to and mitigate threats associated with unauthorized file attribute changes. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host - as dest | where LIKE(process_exec, "%chattr %") AND LIKE(process_exec, "% -i%") - | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle - normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_file_permissions_modification_via_chattr_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE(process_exec, "%chattr %") AND LIKE(process_exec, "% -i%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_permissions_modification_via_chattr_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html drilldown_searches: @@ -39,12 +19,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -73,7 +48,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chattr_i/linux_auditd_chattr_i.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chattr_i/linux_auditd_chattr_i.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml index 2a345f75c0..f42a173862 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml @@ -1,42 +1,16 @@ name: Linux Auditd Find Credentials From Password Managers id: 784241aa-85a5-4782-a503-d071bd3446f9 version: 3 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious attempts to find credentials - stored in password managers, which may indicate an attacker's effort to retrieve - sensitive login information. Password managers are often targeted by adversaries - seeking to access stored passwords for further compromise or lateral movement within - a network. By monitoring for unusual or unauthorized access to password manager - files or processes, this analytic helps identify potential credential theft attempts, - enabling security teams to respond quickly to protect critical accounts and prevent - further unauthorized access. +description: The following analytic detects suspicious attempts to find credentials stored in password managers, which may indicate an attacker's effort to retrieve sensitive login information. Password managers are often targeted by adversaries seeking to access stored passwords for further compromise or lateral movement within a network. By monitoring for unusual or unauthorized access to password manager files or processes, this analytic helps identify potential credential theft attempts, enabling security teams to respond quickly to protect critical accounts and prevent further unauthorized access. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND - (LIKE (process_exec, "%.kdbx%") OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, - "%KeePass\.enforced%") OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR - LIKE (process_exec, "%.agilekeychain%")OR LIKE (process_exec, "%.dashlane%")OR LIKE - (process_exec, "%.rfx%")OR LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, - "%.spdb%")OR LIKE (process_exec, "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR - LIKE (process_exec, "%enpass%")OR LIKE (process_exec, "%vault%")OR LIKE (process_exec, - "%.kdb%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc - process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_find_credentials_from_password_managers_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.kdbx%") OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, "%KeePass\.enforced%") OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR LIKE (process_exec, "%.agilekeychain%")OR LIKE (process_exec, "%.dashlane%")OR LIKE (process_exec, "%.rfx%")OR LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, "%.spdb%")OR LIKE (process_exec, "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR LIKE (process_exec, "%enpass%")OR LIKE (process_exec, "%vault%")OR LIKE (process_exec, "%.kdb%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_managers_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS @@ -46,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -80,7 +49,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.005/linux_auditd_find_password_db/linux_auditd_find_password_db.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.005/linux_auditd_find_password_db/linux_auditd_find_password_db.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml index 09ff7a6107..6332592a94 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml @@ -1,37 +1,16 @@ name: Linux Auditd Find Credentials From Password Stores id: 4de73044-9a1d-4a51-a1c2-85267d8dcab3 version: 3 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious attempts to find credentials - stored in password stores, indicating a potential attacker's effort to access sensitive - login information. Password stores are critical repositories that contain valuable - credentials, and unauthorized access to them can lead to significant security breaches. - By monitoring for unusual or unauthorized activities related to password store access, - this analytic helps identify potential credential theft attempts, allowing security - teams to respond promptly and prevent unauthorized access to critical systems and - data. +description: The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND - (LIKE (process_exec, "%password%") OR LIKE (process_exec, "%pass %") OR LIKE (process_exec, - "%credential%")OR LIKE (process_exec, "%creds%")) | stats count min(_time) as firstTime - max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_stores_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%password%") OR LIKE (process_exec, "%pass %") OR LIKE (process_exec, "%credential%")OR LIKE (process_exec, "%creds%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_stores_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS @@ -41,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -75,7 +49,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.005/linux_auditd_find_credentials/linux_auditd_find_credentials.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.005/linux_auditd_find_credentials/linux_auditd_find_credentials.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_find_private_keys.yml b/detections/endpoint/linux_auditd_find_private_keys.yml deleted file mode 100644 index 947dca19a4..0000000000 --- a/detections/endpoint/linux_auditd_find_private_keys.yml +++ /dev/null @@ -1,82 +0,0 @@ -name: Linux Auditd Find Private Keys -id: 80bb9988-190b-4ee0-a3c3-509545a8f678 -version: 4 -date: '2024-11-13' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic detects suspicious attempts to find private keys, - which may indicate an attacker's effort to access sensitive cryptographic information. - Private keys are crucial for securing encrypted communications and data, and unauthorized - access to them can lead to severe security breaches, including data decryption and - identity theft. By monitoring for unusual or unauthorized searches for private keys, - this analytic helps identify potential threats to cryptographic security, enabling - security teams to take swift action to protect the integrity and confidentiality - of encrypted information. -data_source: -- Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND - (LIKE (process_exec, "%.pem%") OR LIKE (process_exec, "%.cer%") OR LIKE (process_exec, - "%.crt%") OR LIKE (process_exec, "%.pgp%") OR LIKE (process_exec, "%.key%") OR LIKE - (process_exec, "%.gpg%")OR LIKE (process_exec, "%.ppk%") OR LIKE (process_exec, - "%.p12%")OR LIKE (process_exec, "%.pfx%")OR LIKE (process_exec, "%.p7b%")) | stats - count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_private_keys_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. -references: -- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html -- https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS -drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: A [$process_exec$] event occurred on host - [$dest$] to find private keys. - risk_objects: - - field: dest - type: system - score: 64 - threat_objects: [] -tags: - analytic_story: - - Linux Living Off The Land - - Linux Privilege Escalation - - Linux Persistence Techniques - - Compromised Linux Host - asset_type: Endpoint - mitre_attack_id: - - T1552.004 - - T1552 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.004/linux_auditd_find_gpg/linux_auditd_find_gpg.log - source: /var/log/audit/audit.log - sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml index 1df35fe233..8788828cc2 100644 --- a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml +++ b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml @@ -1,38 +1,16 @@ name: Linux Auditd Find Ssh Private Keys id: e2d2bd10-dcd1-4b2f-8a76-0198eab32ba5 version: 3 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious attempts to find SSH private - keys, which may indicate an attacker's effort to compromise secure access to systems. - SSH private keys are essential for secure authentication, and unauthorized access - to these keys can enable attackers to gain unauthorized access to servers and other - critical infrastructure. By monitoring for unusual or unauthorized searches for - SSH private keys, this analytic helps identify potential threats to network security, - allowing security teams to quickly respond and safeguard against unauthorized access - and potential breaches. +description: The following analytic detects suspicious attempts to find SSH private keys, which may indicate an attacker's effort to compromise secure access to systems. SSH private keys are essential for secure authentication, and unauthorized access to these keys can enable attackers to gain unauthorized access to servers and other critical infrastructure. By monitoring for unusual or unauthorized searches for SSH private keys, this analytic helps identify potential threats to network security, allowing security teams to quickly respond and safeguard against unauthorized access and potential breaches. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND - (LIKE (process_exec, "%id_rsa%") OR LIKE (process_exec, "%id_dsa%")OR LIKE (process_exec, - "%.key%") OR LIKE (process_exec, "%ssh_key%")OR LIKE (process_exec, "%authorized_keys%")) - | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_find_ssh_private_keys_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%id_rsa%") OR LIKE (process_exec, "%id_dsa%")OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, "%ssh_key%")OR LIKE (process_exec, "%authorized_keys%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_ssh_private_keys_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS @@ -42,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -76,7 +49,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.004/linux_auditd_find_ssh_files/linux_auditd_find_ssh_files.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.004/linux_auditd_find_ssh_files/linux_auditd_find_ssh_files.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml index 8c3b6a60df..11a767918e 100644 --- a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml +++ b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml @@ -1,36 +1,16 @@ name: Linux Auditd Hardware Addition Swapoff id: 5728bb16-1a0b-4b66-bce2-0074ac839770 version: 3 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the execution of the "swapoff" command, - which disables the swapping of paging devices on a Linux system. It leverages data - from Endpoint Detection and Response (EDR) agents, focusing on process execution - logs. This activity is significant because disabling swap can be a tactic used by - malware, such as Awfulshred, to evade detection and hinder forensic analysis. If - confirmed malicious, this action could allow an attacker to manipulate system memory - management, potentially leading to data corruption, system instability, or evasion - of memory-based detection mechanisms. +description: The following analytic detects the execution of the "swapoff" command, which disables the swapping of paging devices on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because disabling swap can be a tactic used by malware, such as Awfulshred, to evade detection and hinder forensic analysis. If confirmed malicious, this action could allow an attacker to manipulate system memory management, potentially leading to data corruption, system instability, or evasion of memory-based detection mechanisms. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host - as dest | where LIKE(process_exec, "%swapoff %") AND LIKE(process_exec, "% -a%") - | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle - normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `linux_auditd_hardware_addition_swapoff_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: administrator may disable swapping of devices in a linux host. - Filter is needed. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE(process_exec, "%swapoff %") AND LIKE(process_exec, "% -a%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_hardware_addition_swapoff_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: administrator may disable swapping of devices in a linux host. Filter is needed. references: - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ drilldown_searches: @@ -39,12 +19,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -71,7 +46,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1200/linux_auditd_swapoff/linux_auditd_swapoff.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1200/linux_auditd_swapoff/linux_auditd_swapoff.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml index 524c1ae9b6..f888933bba 100644 --- a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml +++ b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml @@ -1,39 +1,16 @@ name: Linux Auditd Hidden Files And Directories Creation id: 555cc358-bf16-4e05-9b3a-0f89c73b7261 version: 4 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious creation of hidden files and - directories, which may indicate an attacker's attempt to conceal malicious activities - or unauthorized data. Hidden files and directories are often used to evade detection - by security tools and administrators, providing a stealthy means for storing malware, - logs, or sensitive information. By monitoring for unusual or unauthorized creation - of hidden files and directories, this analytic helps identify potential attempts - to hide or unauthorized creation of hidden files and directories, this analytic - helps identify potential attempts to hide malicious operations, enabling security - teams to uncover and address hidden threats effectively. +description: The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. Hidden files and directories are often used to evade detection by security tools and administrators, providing a stealthy means for storing malware, logs, or sensitive information. By monitoring for unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where (LIKE (process_exec,"%touch %") OR LIKE (process_exec,"%mkdir %")OR - LIKE (process_exec,"%vim %") OR LIKE (process_exec,"%vi %") OR LIKE (process_exec,"%nano - %")) AND (LIKE (process_exec,"% ./.%") OR LIKE (process_exec," .%")OR LIKE (process_exec," - /.%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_hidden_files_and_directories_creation_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec,"%touch %") OR LIKE (process_exec,"%mkdir %")OR LIKE (process_exec,"%vim %") OR LIKE (process_exec,"%vi %") OR LIKE (process_exec,"%nano %")) AND (LIKE (process_exec,"% ./.%") OR LIKE (process_exec," .%")OR LIKE (process_exec," /.%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_hidden_files_and_directories_creation_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS @@ -43,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -75,7 +47,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_hidden_file/linux_auditd_hidden_file.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_hidden_file/linux_auditd_hidden_file.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml index 2bb1184ab4..10a1cc21ad 100644 --- a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml @@ -19,7 +19,7 @@ search: '`linux_auditd` type=SYSCALL comm=insmod | rename host as dest | stats c success dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_insert_kernel_module_using_insmod_utility_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step diff --git a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml index 1769ff5a99..29a1db8488 100644 --- a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml +++ b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml @@ -1,34 +1,16 @@ name: Linux Auditd Install Kernel Module Using Modprobe Utility id: 95165985-ace5-4d42-9c42-93a89a5af901 version: 3 -date: '2024-11-13' +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the installation of a Linux kernel module - using the modprobe utility. It leverages data from Linux Auditd, focusing on process - names and command-line executions. This activity is significant because installing - a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level - code, potentially leading to elevated privileges and bypassing security detections. - If confirmed malicious, this could allow an attacker to gain persistent, high-level - access to the system, compromising its integrity and security. +description: The following analytic detects the installation of a Linux kernel module using the modprobe utility. It leverages data from Linux Auditd, focusing on process names and command-line executions. This activity is significant because installing a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level code, potentially leading to elevated privileges and bypassing security detections. If confirmed malicious, this could allow an attacker to gain persistent, high-level access to the system, compromising its integrity and security. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=modprobe | rename host as dest | stats count - min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid - success dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `linux_auditd_install_kernel_module_using_modprobe_utility_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. +search: '`linux_auditd` type=SYSCALL comm=modprobe | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_install_kernel_module_using_modprobe_utility_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ - https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup @@ -39,12 +21,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -73,7 +50,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/linux_auditd_modprobe/linux_auditd_modprobe.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/linux_auditd_modprobe/linux_auditd_modprobe.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_kernel_module_enumeration.yml b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml index 5509cdeda0..266495693a 100644 --- a/detections/endpoint/linux_auditd_kernel_module_enumeration.yml +++ b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml @@ -19,7 +19,7 @@ search: '`linux_auditd` type=SYSCALL comm=lsmod | rename host as dest | stats c success dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `linux_auditd_kernel_module_enumeration_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step diff --git a/detections/endpoint/linux_auditd_osquery_service_stop.yml b/detections/endpoint/linux_auditd_osquery_service_stop.yml index a4aac2cbcf..edf2a44c84 100644 --- a/detections/endpoint/linux_auditd_osquery_service_stop.yml +++ b/detections/endpoint/linux_auditd_osquery_service_stop.yml @@ -47,7 +47,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A service event - [$type$] event occured on host - [$dest$] to stop the + message: A service event - [$type$] event occurred on host - [$dest$] to stop the osquery service. risk_objects: - field: dest diff --git a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml index 83544e6fb9..d80e3059c5 100644 --- a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File id: fea71cf0-fa10-4ef6-9202-9682b2e0c477 version: 4 -date: '2024-12-17' +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -19,7 +19,7 @@ search: '`linux_auditd` type=PATH name IN("*/etc/cron*", "*/var/spool/cron/*", " by name nametype OGID dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step diff --git a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml index f793396217..905d2fd1db 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml @@ -1,35 +1,16 @@ name: Linux Auditd Preload Hijack Library Calls id: 35c50572-a70b-452f-afa9-bebdf3c3ce36 version: 3 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the use of the LD_PRELOAD environment - variable to hijack or hook library functions on a Linux platform. It leverages data - from Linux Auditd, focusing on process execution logs that include command-line - details. This activity is significant because adversaries, malware authors, and - red teamers commonly use this technique to gain elevated privileges and establish - persistence on a compromised machine. If confirmed malicious, this behavior could - allow attackers to execute arbitrary code, escalate privileges, and maintain long-term - access to the system. +description: The following analytic detects the use of the LD_PRELOAD environment variable to hijack or hook library functions on a Linux platform. It leverages data from Linux Auditd, focusing on process execution logs that include command-line details. This activity is significant because adversaries, malware authors, and red teamers commonly use this technique to gain elevated privileges and establish persistence on a compromised machine. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, and maintain long-term access to the system. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where LIKE (process_exec, "%LD_PRELOAD%")| stats count min(_time) as firstTime - max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `linux_auditd_preload_hijack_library_calls_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE (process_exec, "%LD_PRELOAD%")| stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_preload_hijack_library_calls_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://compilepeace.medium.com/memory-malware-part-0x2-writing-userland-rootkits-via-ld-preload-30121c8343d5 drilldown_searches: @@ -38,12 +19,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -71,7 +47,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_ldpreload/linux_auditd_ldpreload.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_ldpreload/linux_auditd_ldpreload.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml index 1090b25606..2d5b8c3d5e 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml @@ -47,7 +47,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A [$type$] event has occured on host - [$dest$] to modify the preload file. + message: A [$type$] event has occurred on host - [$dest$] to modify the preload file. risk_objects: - field: dest type: system diff --git a/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml new file mode 100644 index 0000000000..0e5f984f6a --- /dev/null +++ b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml @@ -0,0 +1,53 @@ +name: Linux Auditd Private Keys and Certificate Enumeration +id: 80bb9988-190b-4ee0-a3c3-509545a8f678 +version: 4 +date: '2025-01-15' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects suspicious attempts to find private keys, which may indicate an attacker's effort to access sensitive cryptographic information. Private keys are crucial for securing encrypted communications and data, and unauthorized access to them can lead to severe security breaches, including data decryption and identity theft. By monitoring for unusual or unauthorized searches for private keys, this analytic helps identify potential threats to cryptographic security, enabling security teams to take swift action to protect the integrity and confidentiality of encrypted information. +data_source: +- Linux Auditd Execve +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.pem%") OR LIKE (process_exec, "%.cer%") OR LIKE (process_exec, "%.crt%") OR LIKE (process_exec, "%.pgp%") OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, "%.gpg%")OR LIKE (process_exec, "%.ppk%") OR LIKE (process_exec, "%.p12%") OR LIKE (process_exec, "%.pfx%")OR LIKE (process_exec, "%.p7b%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_private_keys_and_certificate_enumeration_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +- https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to find private keys. + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: [] +tags: + analytic_story: + - Linux Living Off The Land + - Linux Privilege Escalation + - Linux Persistence Techniques + - Compromised Linux Host + asset_type: Endpoint + mitre_attack_id: + - T1552.004 + - T1552 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.004/linux_auditd_find_gpg/linux_auditd_find_gpg.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml index 5a1fbb58cb..df8cc3f4ae 100644 --- a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml @@ -1,37 +1,16 @@ name: Linux Auditd Setuid Using Setcap Utility id: 1474459a-302b-4255-8add-d82f96d14cd9 version: 3 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the execution of the 'setcap' utility - to enable the SUID bit on Linux systems. It leverages Linux Auditd data, focusing - on process names and command-line arguments that indicate the use of 'setcap' with - specific capabilities. This activity is significant because setting the SUID bit - allows a user to temporarily gain root access, posing a substantial security risk. - If confirmed malicious, an attacker could escalate privileges, execute arbitrary - commands with elevated permissions, and potentially compromise the entire system. +description: The following analytic detects the execution of the 'setcap' utility to enable the SUID bit on Linux systems. It leverages Linux Auditd data, focusing on process names and command-line arguments that indicate the use of 'setcap' with specific capabilities. This activity is significant because setting the SUID bit allows a user to temporarily gain root access, posing a substantial security risk. If confirmed malicious, an attacker could escalate privileges, execute arbitrary commands with elevated permissions, and potentially compromise the entire system. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where LIKE (process_exec, "%setcap %") AND (LIKE (process_exec, "% cap_setuid+ep - %") OR LIKE (process_exec, "% cap_setuid=ep %") OR LIKE (process_exec, "% cap_net_bind_service+p - %") OR LIKE (process_exec, "% cap_net_raw+ep %") OR LIKE (process_exec, "% cap_dac_read_search+ep - %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec - dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `linux_auditd_setuid_using_setcap_utility_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE (process_exec, "%setcap %") AND (LIKE (process_exec, "% cap_setuid+ep %") OR LIKE (process_exec, "% cap_setuid=ep %") OR LIKE (process_exec, "% cap_net_bind_service+p %") OR LIKE (process_exec, "% cap_net_raw+ep %") OR LIKE (process_exec, "% cap_dac_read_search+ep %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_setuid_using_setcap_utility_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ drilldown_searches: @@ -40,12 +19,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -73,7 +47,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/linux_auditd_setuid/linux_auditd_setcap_priv.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/linux_auditd_setuid/linux_auditd_setcap_priv.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml index 3715e29558..23004f47e1 100644 --- a/detections/endpoint/linux_auditd_stop_services.yml +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -1,34 +1,16 @@ name: Linux Auditd Stop Services id: 43bc9281-753b-4743-b4b7-60af84f085f3 version: 3 -date: '2024-11-13' +date: '2024-12-16' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects attempts to stop or clear a service on - Linux systems. It leverages data from Linux Auditd, focusing on processes like "systemctl," - "service," and "svcadm" executing stop commands. This activity is significant as - adversaries often terminate security or critical services to disable defenses or - disrupt operations, as seen in malware like Industroyer2. If confirmed malicious, - this could lead to the disabling of security mechanisms, allowing attackers to persist, - escalate privileges, or deploy destructive payloads, severely impacting system integrity - and availability. +type: Hunting +description: The following analytic detects attempts to stop a service on Linux systems. It leverages data from Linux Auditd. This activity is significant as adversaries often stop or terminate security or critical services to disable defenses or disrupt operations, as seen in malware like Industroyer2. If confirmed malicious, this could lead to the disabling of security mechanisms, allowing attackers to persist, escalate privileges, or deploy destructive payloads, severely impacting system integrity and availability. data_source: - Linux Auditd Service Stop -search: '`linux_auditd` type=SERVICE_STOP | rename host as dest | stats count min(_time) - as firstTime max(_time) as lastTime by type pid UID comm exe dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `linux_auditd_stop_services_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=SERVICE_STOP | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm exe dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_stop_services_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - https://cert.gov.ua/article/39518 @@ -38,22 +20,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -rba: - message: A service event - [$type$] event occured on host - [$dest$] to stop or - disable a service. - risk_objects: - - field: dest - type: system - score: 49 - threat_objects: [] tags: analytic_story: - Industroyer2 @@ -71,7 +40,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_service_stop/linux_auditd_service_stop.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_service_stop/linux_auditd_service_stop.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml index 02888ee53f..b53ed7ef6c 100644 --- a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml +++ b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml @@ -1,35 +1,16 @@ name: Linux Auditd Sudo Or Su Execution id: 817a5c89-5b92-4818-a22d-aa35e1361afe version: 3 -date: '2024-11-13' +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the execution of the "sudo" or "su" command - on a Linux operating system. It leverages data from Linux Auditd, focusing on process - names and parent process names. This activity is significant because "sudo" and - "su" commands are commonly used by adversaries to elevate privileges, potentially - leading to unauthorized access or control over the system. If confirmed malicious, - this activity could allow attackers to execute commands with root privileges, leading - to severe security breaches, data exfiltration, or further system compromise. +description: The following analytic detects the execution of the "sudo" or "su" command on a Linux operating system. It leverages data from Linux Auditd, focusing on process names and parent process names. This activity is significant because "sudo" and "su" commands are commonly used by adversaries to elevate privileges, potentially leading to unauthorized access or control over the system. If confirmed malicious, this activity could allow attackers to execute commands with root privileges, leading to severe security breaches, data exfiltration, or further system compromise. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host - as dest | where LIKE(process_exec, "%sudo %") OR LIKE(process_exec, "%su %") | stats - count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_sudo_or_su_execution_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE(process_exec, "%sudo %") OR LIKE(process_exec, "%su %") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_sudo_or_su_execution_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1548/003/ drilldown_searches: @@ -38,12 +19,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -71,7 +47,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudo_su/linux_auditd_sudo_su.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudo_su/linux_auditd_sudo_su.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_sysmon_service_stop.yml b/detections/endpoint/linux_auditd_sysmon_service_stop.yml index fd87cbaabc..64021b8def 100644 --- a/detections/endpoint/linux_auditd_sysmon_service_stop.yml +++ b/detections/endpoint/linux_auditd_sysmon_service_stop.yml @@ -46,7 +46,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A service event - [$type$] event occured on host - [$dest$] to stop or + message: A service event - [$type$] event occurred on host - [$dest$] to stop or disable the sysmon service. risk_objects: - field: dest diff --git a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml index 43a4fbf7f8..50d90725bc 100644 --- a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml +++ b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml @@ -53,7 +53,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A [$type$] event occured on host - [$dest$] to modify the unix shell configuration + message: A [$type$] event occurred on host - [$dest$] to modify the unix shell configuration file. risk_objects: - field: dest diff --git a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml index 615a6e7e2b..d3f5d76e2e 100644 --- a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml +++ b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml @@ -1,36 +1,16 @@ name: Linux Auditd Unload Module Via Modprobe id: 90964d6a-4b5f-409a-85bd-95e261e03fe9 version: 3 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious use of the `modprobe` command - to unload kernel modules, which may indicate an attempt to disable critical system - components or evade detection. The `modprobe` utility manages kernel modules, and - unauthorized unloading of modules can disrupt system security features, remove logging - capabilities, or conceal malicious activities. By monitoring for unusual or unauthorized - `modprobe` operations involving module unloading, this analytic helps identify potential - tampering with kernel functionality, enabling security teams to investigate and - address possible threats to system integrity. +description: The following analytic detects suspicious use of the `modprobe` command to unload kernel modules, which may indicate an attempt to disable critical system components or evade detection. The `modprobe` utility manages kernel modules, and unauthorized unloading of modules can disrupt system security features, remove logging capabilities, or conceal malicious activities. By monitoring for unusual or unauthorized `modprobe` operations involving module unloading, this analytic helps identify potential tampering with kernel functionality, enabling security teams to investigate and address possible threats to system integrity. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where LIKE (process_exec, "%modprobe%") AND LIKE (process_exec, "%-r %") - | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec - dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `linux_auditd_unload_module_via_modprobe_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE (process_exec, "%modprobe%") AND LIKE (process_exec, "%-r %") | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_unload_module_via_modprobe_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html drilldown_searches: @@ -39,12 +19,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -73,7 +48,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/linux_auditd_modprobe_unload_module/linux_auditd_modprobe_unload_module.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/linux_auditd_modprobe_unload_module/linux_auditd_modprobe_unload_module.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml index edf0906fc8..59da2a56d4 100644 --- a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml @@ -1,37 +1,16 @@ name: Linux Auditd Virtual Disk File And Directory Discovery id: eec78cef-d4c8-4b35-8f5b-6922102a4a41 version: 4 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious discovery of virtual disk files - and directories, which may indicate an attacker's attempt to locate and access virtualized - storage environments. Virtual disks can contain sensitive data or critical system - configurations, and unauthorized discovery attempts could signify preparatory actions - for data exfiltration or further compromise. By monitoring for unusual or unauthorized - searches for virtual disk files and directories, this analytic helps identify potential - reconnaissance activities, enabling security teams to respond promptly and safeguard - against unauthorized access and data breaches. +description: The following analytic detects suspicious discovery of virtual disk files and directories, which may indicate an attacker's attempt to locate and access virtualized storage environments. Virtual disks can contain sensitive data or critical system configurations, and unauthorized discovery attempts could signify preparatory actions for data exfiltration or further compromise. By monitoring for unusual or unauthorized searches for virtual disk files and directories, this analytic helps identify potential reconnaissance activities, enabling security teams to respond promptly and safeguard against unauthorized access and data breaches. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND - (LIKE (process_exec, "%.vhd%") OR LIKE (process_exec, "%.vhdx%") OR LIKE (process_exec, - "%.vmdk%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc - process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_virtual_disk_file_and_directory_discovery_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.vhd%") OR LIKE (process_exec, "%.vhdx%") OR LIKE (process_exec, "%.vmdk%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_virtual_disk_file_and_directory_discovery_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS @@ -41,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -74,7 +48,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_find_virtual_disk/linux_auditd_find_virtual_disk.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_find_virtual_disk/linux_auditd_find_virtual_disk.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 2a21d1b26f..41471fc7c0 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -1,40 +1,18 @@ name: Malicious PowerShell Process - Execution Policy Bypass id: 9be56c82-b1cc-4318-87eb-d138afaaca39 version: 8 -date: '2024-11-13' +date: '2024-12-16' author: Rico Valdez, Mauricio Velazco, Splunk status: production -type: TTP -description: The following analytic detects PowerShell processes initiated with parameters - that bypass the local execution policy for scripts. It leverages data from Endpoint - Detection and Response (EDR) agents, focusing on command-line executions containing - specific flags like "-ex" or "bypass." This activity is significant because bypassing - execution policies is a common tactic used by attackers to run malicious scripts - undetected. If confirmed malicious, this could allow an attacker to execute arbitrary - code, potentially leading to further system compromise, data exfiltration, or persistent - access within the environment. +type: Anomaly +description: The following analytic detects PowerShell processes initiated with parameters that bypass the local execution policy for scripts. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions containing specific flags like "-ex" or "bypass." This activity is significant because bypassing execution policies is a common tactic used by attackers to run malicious scripts undetected. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to further system compromise, data exfiltration, or persistent access within the environment. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process_id) as - process_id, values(Processes.parent_process_id) as parent_process_id values(Processes.process) - as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_powershell` (Processes.process="* -ex*" OR Processes.process="* bypass - *") by Processes.process_id, Processes.user, Processes.dest | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_process___execution_policy_bypass_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: There may be legitimate reasons to bypass the PowerShell execution - policy. The PowerShell script being run with this parameter should be validated - to ensure that it is legitimate. +search: '| tstats `security_content_summariesonly` values(Processes.process_id) as process_id, values(Processes.parent_process_id) as parent_process_id values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="* -ex*" AND Processes.process="* bypass *") by Processes.process_id, Processes.user, Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_process___execution_policy_bypass_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: There may be legitimate reasons to bypass the PowerShell execution policy. The PowerShell script being run with this parameter should be validated to ensure that it is legitimate. references: - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ drilldown_searches: @@ -43,12 +21,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -77,7 +50,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/microsoft_defender_atp_alerts.yml b/detections/endpoint/microsoft_defender_atp_alerts.yml index eb9a570618..e18398545b 100644 --- a/detections/endpoint/microsoft_defender_atp_alerts.yml +++ b/detections/endpoint/microsoft_defender_atp_alerts.yml @@ -1,54 +1,22 @@ name: Microsoft Defender ATP Alerts id: 38f034ed-1598-46c8-95e8-14edf05fdf5d version: 2 -date: '2025-01-21' +date: '2025-01-20' author: Bryan Pluta, Bhavin Patel, Splunk status: production type: TTP data_source: - MS Defender ATP Alerts -description: The following analytic is to leverage alerts from Microsoft Defender - ATP Alerts. This query aggregates and summarizes all alerts from Microsoft Defender - ATP Alerts, providing details such as the source, file name, severity, process command - line, ip address, registry key, signature, description, unique id, and timestamps. - This detection is not intended to detect new activity from raw data, but leverages - Microsoft provided alerts to be correlated with other data as part of risk based - alerting. The data contained in the alert is mapped not only to the risk obejct, - but also the threat object. This detection filters out evidence that has a verdict - of clean from Microsoft. It dynamically maps the MITRE technique at search time - to auto populate the annotation field with the value provided in the alert. It also - uses a dynamic mapping to set the risk score in Enterprise Security based on the - severity of the alert. -search: ' `ms_defender_atp_alerts` (dest=* OR user=*)| eval tmp_evidence=json_extract(_raw, - "evidence"), tmp_evidencemv=json_array_to_mv(tmp_evidence), entityType = mvmap(tmp_evidencemv, - spath(tmp_evidencemv, "entityType")), filePath = mvmap(tmp_evidencemv, spath(tmp_evidencemv, - "filePath")), processCommandLine = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "processCommandLine")), - ipAddress = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "ipAddress")), registryKey - = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "registryKey")), url = mvmap(tmp_evidencemv, - spath(tmp_evidencemv, "url")), fileName = mvmap(tmp_evidencemv, spath(tmp_evidencemv, - "fileName")) | eval tmp_evidencemv=mvfilter(json_extract(tmp_evidencemv, "entityType") - = "File"), fileName = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "fileName")) | - eval risk_score=case(severity="informational", 5, severity="low", 15, severity="medium", - 25, severity="high", 50 , true(), 2) | eval processCommandLine=if(processCommandLine="null", - "", processCommandLine), ipAddress=if(ipAddress="null", "", ipAddress), registryKey=if(registryKey="null", - "", registryKey), url=if(url="null", "", url) | stats count min(_time) as firstTime - max(_time) as lastTime values(fileName) as file_name values(severity) as severity - values(processCommandLine) as process values(ipAddress) as ip_address values(registryKey) - as registry_key values(url) as url values(mitreTechniques{}) as annotations.mitre_attack.mitre_technique_id - values(signature) as signature values(user) as user values(risk_score) as risk_score - by id description src | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `microsoft_defender_atp_alerts_filter`' -how_to_implement: In order to properly run this search, you need to ingest alerts - data from Microsoft Defender, specifcally using the Splunk add-on for Microsoft - Security. This add-on will collect alerts using the ms:defender:atp:alerts sourcetype. - You will need to define the `ms_defender_atp_alerts` macro to point to the proper - index that contains the ms:defender:atp:alerts sourcetype. **NOTE** - We also have - a detection named `Detect Critical Alerts from Security Tools` that triggers on - the same data and is written against the Alerts datamodel. Enabling both of these - detections will result in duplicate risk/notable events, we recommend enabling only - one of these detections. -known_false_positives: False positives may vary based on Microsfot Defender configuration; - monitor and filter out the alerts that are not relevant to your environment. +description: The following analytic is to leverage alerts from Microsoft Defender ATP Alerts. This query aggregates and summarizes all alerts from Microsoft Defender ATP Alerts, providing details such as the source, file name, severity, process command line, ip address, registry key, signature, description, unique id, and timestamps. This detection is not intended to detect new activity from raw data, but leverages Microsoft provided alerts to be correlated with other data as part of risk based alerting. The data contained in the alert is mapped not only to the risk obejct, but also the threat object. This detection filters out evidence that has a verdict of clean from Microsoft. It dynamically maps the MITRE technique at search time to auto populate the annotation field with the value provided in the alert. It also uses a dynamic mapping to set the risk score in Enterprise Security based on the severity of the alert. +search: ' `ms_defender_atp_alerts` (dest=* OR user=*)| eval tmp_evidence=json_extract(_raw, "evidence"), tmp_evidencemv=json_array_to_mv(tmp_evidence), entityType = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "entityType")), filePath = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "filePath")), processCommandLine = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "processCommandLine")), ipAddress = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "ipAddress")), registryKey = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "registryKey")), url = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "url")), fileName = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "fileName")) +| eval tmp_evidencemv=mvfilter(json_extract(tmp_evidencemv, "entityType") = "File"), fileName = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "fileName")) +| eval risk_score=case(severity="informational", 5, severity="low", 15, severity="medium", 25, severity="high", 50 , true(), 2) +| eval processCommandLine=if(processCommandLine="null", "", processCommandLine), ipAddress=if(ipAddress="null", "", ipAddress), registryKey=if(registryKey="null", "", registryKey), url=if(url="null", "", url) +| stats count min(_time) as firstTime max(_time) as lastTime values(fileName) as file_name values(severity) as severity values(processCommandLine) as process values(ipAddress) as ip_address values(registryKey) as registry_key values(url) as url values(mitreTechniques{}) as annotations.mitre_attack.mitre_technique_id values(signature) as signature values(user) as user values(risk_score) as risk_score by id description src +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `microsoft_defender_atp_alerts_filter`' +how_to_implement: In order to properly run this search, you need to ingest alerts data from Microsoft Defender, specifcally using the Splunk add-on for Microsoft Security. This add-on will collect alerts using the ms:defender:atp:alerts sourcetype. You will need to define the `ms_defender_atp_alerts` macro to point to the proper index that contains the ms:defender:atp:alerts sourcetype. +known_false_positives: False positives may vary based on Microsfot Defender configuration; monitor and filter out the alerts that are not relevant to your environment. references: - https://learn.microsoft.com/en-us/defender-xdr/api-list-incidents?view=o365-worldwide - https://learn.microsoft.com/en-us/graph/api/resources/security-alert?view=graph-rest-1.0 @@ -60,12 +28,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$src$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -99,15 +62,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint - manual_test: We are dynamically creating the risk_score field based on the severity - of the alert in the SPL and that supersedes the risk score set in the detection. - Setting these to manual test since otherwise we fail integration testing. The - detection is also failing on unit-testing as some of the fields set in the observables - are empty. + manual_test: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. Setting these to manual test since otherwise we fail integration testing. The detection is also failing on unit-testing as some of the fields set in the observables are empty. tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/alerts/defender_atp_alerts_single_event.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/alerts/defender_atp_alerts_single_event.log source: ms_defender_atp_alerts sourcetype: ms:defender:atp:alerts diff --git a/detections/endpoint/microsoft_defender_incident_alerts.yml b/detections/endpoint/microsoft_defender_incident_alerts.yml index 0b648b1ec0..2133ecae98 100644 --- a/detections/endpoint/microsoft_defender_incident_alerts.yml +++ b/detections/endpoint/microsoft_defender_incident_alerts.yml @@ -1,52 +1,28 @@ name: Microsoft Defender Incident Alerts id: 13435b55-afd8-46d4-9045-7d5457f430a5 version: 2 -date: '2025-01-21' +date: '2025-01-20' author: Bryan Pluta, Bhavin Patel, Splunk status: production type: TTP data_source: - MS365 Defender Incident Alerts -description: The following analytic is to leverage alerts from Microsoft Defender - O365 Incidents. This query aggregates and summarizes all alerts from Microsoft Defender - O365 Incidents, providing details such as the destination, file name, severity, - process command line, ip address, registry key, signature, description, unique id, - and timestamps. This detection is not intended to detect new activity from raw data, - but leverages Microsoft provided alerts to be correlated with other data as part - of risk based alerting. The data contained in the alert is mapped not only to the - risk obejct, but also the threat object. This detection filters out evidence that - has a verdict of clean from Microsoft. It dynamically maps the MITRE technique at - search time to auto populate the annotation field with the value provided in the - alert. It also uses a static mapping to set the risk score based on the severity - of the alert. -search: '`ms365_defender_incident_alerts` (dest=* OR user=*) | eval tmp_entities=json_extract(_raw, - "entities"), tmp_entitymv=json_array_to_mv(tmp_entities), tmp_filtered_mv=mvfilter(json_extract(tmp_entitymv, - "verdict") != "Clean"), entityType = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, - "entityType")), filePath = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "filePath")), - processCommandLine = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "processCommandLine")), - ipAddress = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "ipAddress")), registryKey - = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "registryKey")), url = mvmap(tmp_filtered_mv, - spath(tmp_filtered_mv, "url")) | eval tmp_filtered_mv=mvfilter(json_extract(tmp_filtered_mv, - "entityType") = "File"), fileName = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, - "fileName")) | eval risk_score=case(severity="informational", 5, severity="low", - 15, severity="medium", 25, severity="high", 50, true(), 2) | stats count min(_time) - as firstTime max(_time) as lastTime values(fileName) as file_name values(severity) - as severity values(processCommandLine) as process values(ipAddress) as ip_address - values(registryKey) as registry_key values(url) as url values(mitreTechniques{}) - as annotations.mitre_attack.mitre_technique_id values(signature) as signature values(user) - as user values(risk_score) as risk_score by id description dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `microsoft_defender_incident_alerts_filter`' -how_to_implement: In order to properly run this search, you need to ingest alerts - data from Microsoft Defender, specifcally using the Splunk add-on for Microsfot - Security. This add-on will collect alerts using the ms365:defender:incident:alerts - sourcetype. You will need to define the `ms365_defender_incident_alerts` macro to - point to the proper index that contains the ms365:defender:incident:alerts sourcetype. - **NOTE** - We also have a detection named `Detect Critical Alerts from Security - Tools` that triggers on the same data and is written against the Alerts datamodel. - Enabling both of these detections will result in duplicate risk/notable events, - we recommend enabling only one of these detections. -known_false_positives: False positives may vary based on Microsfot Defender configuration; - monitor and filter out the alerts that are not relevant to your environment. +description: The following analytic is to leverage alerts from Microsoft Defender O365 Incidents. This query aggregates and summarizes all alerts from Microsoft Defender O365 Incidents, providing details such as the destination, file name, severity, process command line, ip address, registry key, signature, description, unique id, and timestamps. This detection is not intended to detect new activity from raw data, but leverages Microsoft provided alerts to be correlated with other data as part of risk based alerting. The data contained in the alert is mapped not only to the risk obejct, but also the threat object. This detection filters out evidence that has a verdict of clean from Microsoft. It dynamically maps the MITRE technique at search time to auto populate the annotation field with the value provided in the alert. It also uses a static mapping to set the risk score based on the severity of the alert. +search: '`ms365_defender_incident_alerts` (dest=* OR user=*) +| eval tmp_entities=json_extract(_raw, "entities"), +tmp_entitymv=json_array_to_mv(tmp_entities), +tmp_filtered_mv=mvfilter(json_extract(tmp_entitymv, "verdict") != "Clean"), +entityType = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "entityType")), +filePath = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "filePath")), +processCommandLine = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "processCommandLine")), +ipAddress = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "ipAddress")), +registryKey = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "registryKey")), +url = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "url")) +| eval tmp_filtered_mv=mvfilter(json_extract(tmp_filtered_mv, "entityType") = "File"), fileName = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "fileName")) +| eval risk_score=case(severity="informational", 5, severity="low", 15, severity="medium", 25, severity="high", 50, true(), 2) +| stats count min(_time) as firstTime max(_time) as lastTime values(fileName) as file_name values(severity) as severity values(processCommandLine) as process values(ipAddress) as ip_address values(registryKey) as registry_key values(url) as url values(mitreTechniques{}) as annotations.mitre_attack.mitre_technique_id values(signature) as signature values(user) as user values(risk_score) as risk_score by id description dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `microsoft_defender_incident_alerts_filter`' +how_to_implement: In order to properly run this search, you need to ingest alerts data from Microsoft Defender, specifcally using the Splunk add-on for Microsfot Security. This add-on will collect alerts using the ms365:defender:incident:alerts sourcetype. You will need to define the `ms365_defender_incident_alerts` macro to point to the proper index that contains the ms365:defender:incident:alerts sourcetype. +known_false_positives: False positives may vary based on Microsfot Defender configuration; monitor and filter out the alerts that are not relevant to your environment. references: - https://learn.microsoft.com/en-us/defender-xdr/api-list-incidents?view=o365-worldwide - https://learn.microsoft.com/en-us/graph/api/resources/security-alert?view=graph-rest-1.0 @@ -58,12 +34,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -97,15 +68,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint - manual_test: We are dynamically creating the risk_score field based on the severity - of the alert in the SPL and that supersedes the risk score set in the detection. - Setting these to manual test since otherwise we fail integration testing. The - detection is also failing on unit-testing as some of the fields set in the observables - are empty. + manual_test: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. Setting these to manual test since otherwise we fail integration testing. The detection is also failing on unit-testing as some of the fields set in the observables are empty. tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/alerts/defender_incident_alerts_single_event.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/alerts/defender_incident_alerts_single_event.log source: m365_defender_incident_alerts sourcetype: ms365:defender:incident:alerts diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml deleted file mode 100644 index 587a0aae86..0000000000 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ /dev/null @@ -1,79 +0,0 @@ -name: MSHTML Module Load in Office Product -id: 5f1c168e-118b-11ec-84ff-acde48001122 -version: 6 -date: '2024-11-13' -author: Michael Haag, Mauricio Velazco, Splunk -status: production -type: TTP -description: The following analytic detects the loading of the mshtml.dll module into - an Office product, which is indicative of CVE-2021-40444 exploitation. It leverages - Sysmon EventID 7 to monitor image loads by specific Office processes. This activity - is significant because it can indicate an attempt to exploit a vulnerability in - the MSHTML component via a malicious document. If confirmed malicious, this could - allow an attacker to execute arbitrary code, potentially leading to system compromise, - data exfiltration, or further network penetration. -data_source: -- Sysmon EventID 7 -search: '`sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe", - "msaccess.exe","Graph.exe","winproj.exe") loaded_file_path IN ("*\\mshtml.dll", - "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") - | stats count min(_time) as firstTime max(_time) as lastTime by user_id, dest, process_name, - loaded_file, loaded_file_path, original_file_name, process_guid | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process names and image loads from your endpoints. If you are using - Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: Limited false positives will be present, however, tune as necessary. - Some applications may legitimately load mshtml.dll. -references: -- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ -- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 -- https://strontic.github.io/xcyclopedia/index-dll -- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ -drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: An instance of $process_name$ was identified on endpoint $dest$ loading - mshtml.dll. - risk_objects: - - field: dest - type: system - score: 80 - threat_objects: - - field: process_name - type: process_name -tags: - analytic_story: - - Spearphishing Attachments - - Microsoft MSHTML Remote Code Execution CVE-2021-40444 - - CVE-2023-36884 Office and Windows HTML RCE Vulnerability - asset_type: Endpoint - cve: - - CVE-2021-40444 - mitre_attack_id: - - T1566 - - T1566.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/network_connection_discovery_with_net.yml b/detections/endpoint/network_connection_discovery_with_net.yml deleted file mode 100644 index 81e3c9ac8b..0000000000 --- a/detections/endpoint/network_connection_discovery_with_net.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Network Connection Discovery With Net -id: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d -version: 5 -date: '2024-12-10' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: The following analytic identifies the execution of `net.exe` or `net1.exe` - with command-line arguments used to list network connections on a compromised system. - It leverages data from Endpoint Detection and Response (EDR) agents, focusing on - process names and command-line executions. This activity is significant as it indicates - potential network reconnaissance by adversaries or Red Teams, aiming to gather situational - awareness and Active Directory information. If confirmed malicious, this behavior - could allow attackers to map the network, identify critical assets, and plan further - attacks, potentially leading to data exfiltration or lateral movement. -data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process=*use*) - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_connection_discovery_with_net_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1049/ -tags: - analytic_story: - - Active Directory Discovery - - Azorult - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - mitre_attack_id: - - T1049 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml deleted file mode 100644 index ecf8d25fa8..0000000000 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Office Document Creating Schedule Task -id: cc8b7b74-9d0f-11eb-8342-acde48001122 -version: 9 -date: '2024-11-13' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic detects an Office document creating a scheduled - task, either through a macro VBA API or by loading `taskschd.dll`. This detection - leverages Sysmon EventCode 7 to identify when Office applications load the `taskschd.dll` - file. This activity is significant as it is a common technique used by malicious - macro malware to establish persistence or initiate beaconing. If confirmed malicious, - this could allow an attacker to maintain persistence, execute arbitrary commands, - or schedule future malicious activities, posing a significant threat to the environment. -data_source: -- Sysmon EventID 7 -search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe", - "msaccess.exe") loaded_file_path = "*\\taskschd.dll" | stats min(_time) as firstTime - max(_time) as lastTime count by user_id, dest, process_name,loaded_file, loaded_file_path, - original_file_name, process_guid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `office_document_creating_schedule_task_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. - Also be sure to include those monitored dll to your own sysmon config. -known_false_positives: False positives may occur if legitimate office documents are - creating scheduled tasks. Ensure to investigate the scheduled task and the command - to be executed. If the task is benign, add the task name to the exclusion list. - Some applications may legitimately load taskschd.dll. -references: -- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ -- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ -- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ -drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: An Office document was identified creating a scheduled task on $dest$. - Investigate further. - risk_objects: - - field: dest - type: system - score: 49 - threat_objects: [] -tags: - analytic_story: - - Spearphishing Attachments - asset_type: Endpoint - mitre_attack_id: - - T1566 - - T1566.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml deleted file mode 100644 index b309792fc2..0000000000 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ /dev/null @@ -1,85 +0,0 @@ -name: Office Document Executing Macro Code -id: b12c89bc-9d06-11eb-a592-acde48001122 -version: 8 -date: '2024-11-13' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies office documents executing macro code. - It leverages Sysmon EventCode 7 to detect when processes like WINWORD.EXE or EXCEL.EXE - load specific DLLs associated with macros (e.g., VBE7.DLL). This activity is significant - because macros are a common attack vector for delivering malicious payloads, such - as malware. If confirmed malicious, this could lead to unauthorized code execution, - data exfiltration, or further compromise of the system. Disabling macros by default - is recommended to mitigate this risk. -data_source: -- Sysmon EventID 7 -search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") - loaded_file_path IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) - as firstTime max(_time) as lastTime values(loaded_file) as loaded_file count by - dest EventCode process_name process_guid | `security_content_ctime(firstTime)` | - `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. - If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. - Also be sure to include those monitored dll to your own sysmon config. -known_false_positives: False positives may occur if legitimate office documents are - executing macro code. Ensure to investigate the macro code and the command to be - executed. If the macro code is benign, add the document name to the exclusion list. - Some applications may legitimately load VBE7INTL.DLL, VBE7.DLL, or VBEUI.DLL. -references: -- https://www.joesandbox.com/analysis/386500/0/html -- https://www.joesandbox.com/analysis/702680/0/html -- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/ -- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing -- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ -- https://www.fortinet.com/blog/threat-research/leveraging-microsoft-office-documents-to-deliver-agent-tesla-and-njrat -drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: Office document executing a macro on $dest$ - risk_objects: - - field: dest - type: system - score: 35 - threat_objects: [] -tags: - analytic_story: - - Spearphishing Attachments - - Trickbot - - IcedID - - DarkCrystal RAT - - AgentTesla - - Qakbot - - Azorult - - Remcos - - PlugX - - NjRAT - asset_type: Endpoint - mitre_attack_id: - - T1566 - - T1566.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml deleted file mode 100644 index eb35cf0a89..0000000000 --- a/detections/endpoint/office_document_spawned_child_process_to_download.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Office Document Spawned Child Process To Download -id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 -version: 9 -date: '2024-11-13' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies Office applications spawning child - processes to download content via HTTP/HTTPS. It leverages data from Endpoint Detection - and Response (EDR) agents, focusing on process creation events where Office applications - like Word or Excel initiate network connections, excluding common browsers. This - activity is significant as it often indicates the use of malicious documents to - execute living-off-the-land binaries (LOLBins) for payload delivery. If confirmed - malicious, this behavior could lead to unauthorized code execution, data exfiltration, - or further malware deployment, posing a severe threat to the organization's security. -data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe", - "Graph.exe","winproj.exe") Processes.process IN ("*http:*","*https:*") NOT (Processes.original_file_name - IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")) by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.original_file_name | - `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `office_document_spawned_child_process_to_download_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: Default browser not in the filter list. -references: -- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/ -- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ -drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: Office document spawning suspicious child process on $dest$ - risk_objects: - - field: dest - type: system - score: 35 - threat_objects: [] -tags: - analytic_story: - - Spearphishing Attachments - - CVE-2023-36884 Office and Windows HTML RCE Vulnerability - - PlugX - - NjRAT - asset_type: Endpoint - mitre_attack_id: - - T1566 - - T1566.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/password_policy_discovery_with_net.yml b/detections/endpoint/password_policy_discovery_with_net.yml deleted file mode 100644 index b29fff9632..0000000000 --- a/detections/endpoint/password_policy_discovery_with_net.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Password Policy Discovery with Net -id: 09336538-065a-11ec-8665-acde48001122 -version: 6 -date: '2024-12-10' -author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production -type: Hunting -description: The following analytic identifies the execution of `net.exe` or `net1.exe` - with command line arguments aimed at obtaining the domain password policy. It leverages - data from Endpoint Detection and Response (EDR) agents, focusing on process names - and command-line executions. This activity is significant as it indicates potential - reconnaissance efforts by adversaries to gather information about Active Directory - password policies. If confirmed malicious, this behavior could allow attackers to - understand password complexity requirements, aiding in brute-force or password-guessing - attacks, ultimately compromising user accounts and gaining unauthorized access to - the network. -data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process - = "*accounts*" AND Processes.process = "*/domain*" by Processes.dest Processes.user - Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `password_policy_discovery_with_net_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet -tags: - analytic_story: - - Active Directory Discovery - asset_type: Endpoint - mitre_attack_id: - - T1201 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/potential_system_network_configuration_discovery_activity.yml b/detections/endpoint/potential_system_network_configuration_discovery_activity.yml new file mode 100644 index 0000000000..1d0ac6798c --- /dev/null +++ b/detections/endpoint/potential_system_network_configuration_discovery_activity.yml @@ -0,0 +1,58 @@ +name: Potential System Network Configuration Discovery Activity +id: a51bfe1a-94f0-48cc-b1e4-16ae10145893 +version: 6 +date: '2025-01-20' +author: Bhavin Patel, Splunk +status: production +type: Anomaly +description: The following analytic identifies the rapid execution of processes used for system network configuration discovery on an endpoint. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process GUIDs, names, parent processes, and command-line executions. This activity can be significant as it may indicate an attacker attempting to map the network, which is a common precursor to lateral movement or further exploitation. If confirmed malicious, this behavior could allow an attacker to gain insights into the network topology, identify critical systems, and plan subsequent attacks, potentially leading to data exfiltration or system compromise. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where NOT Processes.user IN ("","unknown") by Processes.dest Processes.process_name Processes.parent_process_name Processes.user _time | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | search `system_network_configuration_discovery_tools` | transaction dest connected=false maxpause=5m |where eventcount>=5 | table firstTime lastTime dest user process_name process parent_process parent_process_name eventcount | `potential_system_network_configuration_discovery_activity_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: It is uncommon for normal users to execute a series of commands used for network discovery. System administrators often use scripts to execute these commands. These can generate false positives. +references: [] +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning multiple $process_name$ was + identified on endpoint $dest$ by user $user$ typically not a normal behavior of + the process. + risk_objects: + - field: user + type: user + score: 32 + - field: dest + type: system + score: 32 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - Unusual Processes + asset_type: Endpoint + mitre_attack_id: + - T1016 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/discovery_commands/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index dd5384ca2c..cab7babf13 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -1,29 +1,16 @@ -name: PowerShell Loading DotNET into Memory via Reflection +name: PowerShell Loading DotNET Into Memory via Reflection id: 85bc3f30-ca28-11eb-bd21-acde48001122 version: 6 -date: '2024-11-13' +date: '2025-01-16' author: Michael Haag, Splunk status: production -type: TTP +type: Anomaly data_source: - Powershell Script Block Logging 4104 -description: The following analytic detects the use of PowerShell to load .NET assemblies - into memory via reflection, a technique often used in malicious activities such - as those by Empire and Cobalt Strike. It leverages PowerShell Script Block Logging - (EventCode=4104) to capture and analyze the full command executed. This behavior - is significant as it can indicate advanced attack techniques aiming to execute code - in memory, bypassing traditional defenses. If confirmed malicious, this activity - could lead to unauthorized code execution, privilege escalation, and persistent - access within the environment. -search: '`powershell` EventCode=4104 ScriptBlockText IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*", - "*reflection.assembly*") | stats count min(_time) as firstTime max(_time) as lastTime - by Opcode Computer UserID EventCode ScriptBlockText | rename UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_reflection_filter`' -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: False positives should be limited as day to day scripts do - not use this method. +description: The following analytic detects the use of PowerShell scripts to load .NET assemblies into memory via reflection, a technique often used in malicious activities such as those by Empire and Cobalt Strike. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command executed. This behavior is significant as it can indicate advanced attack techniques aiming to execute code in memory, bypassing traditional defenses. If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, and persistent access within the environment. +search: '`powershell` EventCode=4104 ScriptBlockText IN ("*Reflection.Assembly]::Load*", "*Reflection.Assembly.Load*", "*UnsafeLoadFrom*", "*.LoadFrom(*", "*.LoadModule(*", "*.LoadWithPartialName*", "*ReflectionOnlyLoad*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | rename Computer as dest, UserID as user| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_reflection_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: False positives should be limited as day to day scripts do not use this method. references: - https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0 - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -31,25 +18,20 @@ references: - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ drilldown_searches: -- name: View the detection results for - "$Computer$" and "$user$" - search: '%original_detection_search% | search Computer = "$Computer$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$Computer$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: message: A suspicious powershell script contains reflective class assembly command in $ScriptBlockText$ to load .net code in memory with EventCode $EventCode$ in - host $Computer$ + host $dest$ risk_objects: - - field: Computer + - field: dest type: system score: 56 - field: user @@ -76,7 +58,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 40f522d2cb..5e37c7894e 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -43,7 +43,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Suspicious printer spooler errors have occured on endpoint $ComputerName$ + message: Suspicious printer spooler errors have occurred on endpoint $ComputerName$ with EventCode $EventCode$. risk_objects: - field: ComputerName diff --git a/detections/endpoint/remote_system_discovery_with_net.yml b/detections/endpoint/remote_system_discovery_with_net.yml deleted file mode 100644 index f94851f9d4..0000000000 --- a/detections/endpoint/remote_system_discovery_with_net.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Remote System Discovery with Net -id: 9df16706-04a2-41e2-bbfe-9b38b34409d3 -version: 5 -date: '2024-12-10' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: The following analytic identifies the execution of `net.exe` or `net1.exe` - with command-line arguments used to discover remote systems, such as `domain computers - /domain`. This detection leverages data from Endpoint Detection and Response (EDR) - agents, focusing on process names and command-line arguments. This activity is significant - as it indicates potential reconnaissance efforts by adversaries or Red Teams to - map out networked systems and Active Directory structures. If confirmed malicious, - this behavior could lead to further network exploitation, privilege escalation, - or lateral movement within the environment. -data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process="*domain - computers*" AND Processes.process=*/do*) OR (Processes.process="*view*" AND Processes.process=*/do*) - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_system_discovery_with_net_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ -tags: - analytic_story: - - Active Directory Discovery - - IcedID - asset_type: Endpoint - mitre_attack_id: - - T1018 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml index 64fdb6d6c2..9e30f471ff 100644 --- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml +++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml @@ -1,7 +1,7 @@ name: Shim Database Installation With Suspicious Parameters id: 404620de-46d8-48b6-90cc-8a8d7b0876a3 version: 8 -date: '2024-12-10' +date: '2024-12-16' author: David Dorsey, Splunk status: production type: TTP @@ -17,21 +17,8 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = sdbinst.exe NOT Processes.process IN ("\"C:\\Windows\\System32\\sdbinst.exe\"", - "C:\\Windows\\System32\\sdbinst.exe", "*-mm", "*-?") by Processes.process_name Processes.parent_process_name - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `shim_database_installation_with_suspicious_parameters_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sdbinst.exe NOT Processes.process IN ("\"C:\\Windows\\System32\\sdbinst.exe\"", "C:\\Windows\\System32\\sdbinst.exe", "*-mm", "*-?", "*-m -bg") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `shim_database_installation_with_suspicious_parameters_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: None identified references: [] drilldown_searches: @@ -75,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_attempt_to_stop_security_service.yml b/detections/endpoint/windows_attempt_to_stop_security_service.yml new file mode 100644 index 0000000000..fa9264062b --- /dev/null +++ b/detections/endpoint/windows_attempt_to_stop_security_service.yml @@ -0,0 +1,65 @@ +name: Windows Attempt To Stop Security Service +id: c8e349c6-b97c-486e-8949-bd7bcd1f3910 +version: 8 +date: '2025-01-13' +author: Rico Valdez, Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: The following analytic detects attempts to stop security-related services on an endpoint, which may indicate malicious activity. It leverages data from Endpoint Detection and Response (EDR) agents, specifically searching for processes involving the "sc.exe" or "net.exe" command with the "stop" parameter or the PowerShell "Stop-Service" cmdlet. This activity is significant because disabling security services can undermine the organization's security posture, potentially leading to unauthorized access, data exfiltration, or further attacks like malware installation or privilege escalation. If confirmed malicious, this behavior could compromise the endpoint and the entire network, necessitating immediate investigation and response. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_net` OR `process_sc`) Processes.process="* stop *") OR Processes.process="*Stop-Service *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |lookup security_services_lookup service as process OUTPUTNEW category, description | search category=security | `windows_attempt_to_stop_security_service_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: None identified. Attempts to disable security-related services should be identified and understood. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + attempting to disable security services on endpoint $dest$ by user $user$. + risk_objects: + - field: user + type: user + score: 20 + - field: dest + type: system + score: 20 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - WhisperGate + - Graceful Wipe Out Attack + - Disabling Security Tools + - Data Destruction + - Azorult + - Trickbot + asset_type: Endpoint + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_defend_service_stop/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml new file mode 100644 index 0000000000..1201456848 --- /dev/null +++ b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml @@ -0,0 +1,68 @@ +name: Windows Cmdline Tool Execution From Non-Shell Process +id: 6c3f7dd8-153c-11ec-ac2d-acde48001122 +version: 6 +date: '2025-01-13' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, or similar tools are executed by a non-standard shell parent process, excluding CMD, PowerShell, or Explorer. This detection leverages Endpoint Detection and Response (EDR) telemetry to monitor process creation events. Such behavior is significant as it may indicate adversaries using injected processes to perform system discovery, a tactic observed in FIN7's JSSLoader. If confirmed malicious, this activity could allow attackers to gather critical host information, aiding in further exploitation or lateral movement within the network. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("ipconfig.exe", "systeminfo.exe", "net1.exe", "arp.exe", "nslookup.exe", "route.exe", "netstat.exe", "whoami.exe") AND NOT Processes.parent_process_name IN ("cmd.exe", "powershell.exe", "powershell_ise.exe", "pwsh.exe", "explorer.exe", "-", "unknown") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cmdline_tool_execution_from_non_shell_process_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: A network operator or systems administrator may utilize an automated host discovery application that may generate false positives. Filter as needed. +references: +- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation +- https://attack.mitre.org/groups/G0046/ +- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ +drilldown_searches: +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A non-standard parent process $parent_process_name$ spawned child process + $process_name$ to execute command-line tool on $dest$. + risk_objects: + - field: dest + type: system + score: 56 + - field: user + type: user + score: 56 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - Volt Typhoon + - Rhysida Ransomware + - FIN7 + - DarkGate Malware + - Qakbot + - CISA AA22-277A + - CISA AA23-347A + - Gozi Malware + asset_type: Endpoint + mitre_attack_id: + - T1059 + - T1059.007 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_command_shell_fetch_env_variables.yml b/detections/endpoint/windows_command_shell_fetch_env_variables.yml deleted file mode 100644 index fa3d2cb8d1..0000000000 --- a/detections/endpoint/windows_command_shell_fetch_env_variables.yml +++ /dev/null @@ -1,80 +0,0 @@ -name: Windows Command Shell Fetch Env Variables -id: 048839e4-1eaa-43ff-8a22-86d17f6fcc13 -version: 4 -date: '2024-11-13' -author: Teoderick Contreras, Splunk -status: production -type: TTP -description: The following analytic identifies a suspicious process command line fetching - environment variables with a non-shell parent process. It leverages data from Endpoint - Detection and Response (EDR) agents, focusing on command-line executions and parent - process names. This activity is significant as it is commonly associated with malware - like Qakbot, which uses this technique to gather system information. If confirmed - malicious, this behavior could indicate that the parent process has been compromised, - potentially allowing attackers to execute arbitrary commands, escalate privileges, - or persist within the environment. -data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process = "*cmd /c - set" OR Processes.process = "*cmd.exe /c set" AND NOT (Processes.parent_process_name - = "cmd.exe" OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name="pwsh.exe" - OR Processes.parent_process_name = "explorer.exe") by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_command_shell_fetch_env_variables_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: shell process that are not included in this search may cause - False positive. Filter is needed. -references: -- https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg -drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: non-shell parent process has a child process $process_name$ with a commandline - $process$ to fetch env variables on $dest$ - risk_objects: - - field: dest - type: system - score: 56 - threat_objects: [] -tags: - analytic_story: - - Qakbot - asset_type: Endpoint - mitre_attack_id: - - T1055 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr/sysmon_wermgr.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml b/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml index a550cb6016..8e8aba3b57 100644 --- a/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml +++ b/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml @@ -1,44 +1,15 @@ name: Windows Common Abused Cmd Shell Risk Behavior id: e99fcc4f-c6b0-4443-aa2a-e3c85126ec9a version: 4 -date: '2024-11-13' +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Correlation data_source: [] -description: The following analytic identifies instances where four or more distinct - detection analytics are associated with malicious command line behavior on a specific - host. This detection leverages the Command Line Interface (CLI) data from various - sources to identify suspicious activities. This behavior is significant as it often - indicates attempts to execute malicious commands, access sensitive data, install - backdoors, or perform other nefarious actions. If confirmed malicious, attackers - could gain unauthorized control, exfiltrate information, escalate privileges, or - launch further attacks within the network, leading to severe compromise. -search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) - as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) - as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as - annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) - as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) - as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) - as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, - dc(source) as source_count from datamodel=Risk.All_Risk where source IN ("*Cmdline - Tool Not Executed In CMD Shell*", "*Windows System Network Config Discovery Display - DNS*", "*Local Account Discovery With Wmic*", "*Net Localgroup Discovery*", "*Create - local admin accounts using net exe*", "*Local Account Discovery with Net*", "*Icacls - Deny Command*", "*ICACLS Grant Command*", "*Windows Proxy Via Netsh*", "*Processes - launching netsh*", "*Disabling Firewall with Netsh*", "*Windows System Network Connections - Discovery Netsh*", "*Network Connection Discovery With Arp*", "*Windows System Discovery - Using ldap Nslookup*", "*Windows System Shutdown CommandLine*") by All_Risk.risk_object - All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic | `drop_dm_object_name(All_Risk)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where - source_count >= 4 | `windows_common_abused_cmd_shell_risk_behavior_filter`' -how_to_implement: Splunk Enterprise Security is required to utilize this correlation. - In addition, modify the source_count value to your environment. In our testing, - a count of 4 or 5 was decent in a lab, but the number may need to be increased base - on internal testing. In addition, based on false positives, modify any analytics - to be anomaly and lower or increase risk based on organization importance. -known_false_positives: False positives will be present based on many factors. Tune - the correlation as needed to reduce too many triggers. +description: The following analytic identifies instances where four or more distinct detection analytics are associated with malicious command line behavior on a specific host. This detection leverages the Command Line Interface (CLI) data from various sources to identify suspicious activities. This behavior is significant as it often indicates attempts to execute malicious commands, access sensitive data, install backdoors, or perform other nefarious actions. If confirmed malicious, attackers could gain unauthorized control, exfiltrate information, escalate privileges, or launch further attacks within the network, leading to severe compromise. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count from datamodel=Risk.All_Risk where source IN ("*Windows Cmdline Tool Execution From Non-Shell Process*", "*Windows System Network Config Discovery Display DNS*", "*Local Account Discovery With Wmic*", "*Windows Group Discovery Via Net*", "*Windows Create Local Administrator Account Via Net*", "*Windows User Discovery Via Net*", "*Icacls Deny Command*", "*ICACLS Grant Command*", "*Windows Proxy Via Netsh*", "*Processes launching netsh*", "*Disabling Firewall with Netsh*", "*Windows System Network Connections Discovery Netsh*", "*Network Connection Discovery With Arp*", "*Windows System Discovery Using ldap Nslookup*", "*Windows System Shutdown CommandLine*") by All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where source_count >= 4 | `windows_common_abused_cmd_shell_risk_behavior_filter`' +how_to_implement: Splunk Enterprise Security is required to utilize this correlation. In addition, modify the source_count value to your environment. In our testing, a count of 4 or 5 was decent in a lab, but the number may need to be increased base on internal testing. In addition, based on false positives, modify any analytics to be anomaly and lower or increase risk based on organization importance. +known_false_positives: False positives will be present based on many factors. Tune the correlation as needed to reduce too many triggers. references: - https://www.splunk.com/en_us/blog/security/from-macros-to-no-macros-continuous-malware-improvements-by-qakbot.html - https://www.splunk.com/en_us/blog/security/dark-crystal-rat-agent-deep-dive.html @@ -48,12 +19,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$risk_object$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: @@ -85,7 +51,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/risk_behavior/abused_commandline/risk_recon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/risk_behavior/abused_commandline/risk_recon.log source: risk sourcetype: stash diff --git a/detections/endpoint/windows_create_local_administrator_account_via_net.yml b/detections/endpoint/windows_create_local_administrator_account_via_net.yml new file mode 100644 index 0000000000..033b7f012f --- /dev/null +++ b/detections/endpoint/windows_create_local_administrator_account_via_net.yml @@ -0,0 +1,63 @@ +name: Windows Create Local Administrator Account Via Net +id: b89919ed-fe5f-492c-b139-151bb162040e +version: 14 +date: '2025-01-13' +author: Bhavin Patel, Splunk +status: production +type: Anomaly +description: The following analytic detects the creation of a local administrator account using the "net.exe" command. It leverages Endpoint Detection and Response (EDR) data to identify processes named "net.exe" with the "/add" parameter and keywords related to administrator accounts. This activity is significant as it may indicate an attacker attempting to gain persistent access or escalate privileges. If confirmed malicious, this could lead to unauthorized access, data theft, or further system compromise. Review the process details, user context, and related artifacts to determine the legitimacy of the activity. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process values(parent_process_name) as parent_process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process=*/add* AND Processes.process IN ("*administrators*", "*administratoren*", "*administrateurs*", "*administrador*", "*amministratori*", "*administratorer*", "*Rendszergazda*", "*Администратор*", "*Administratör*") by Processes.process Processes.process_name Processes.parent_process_name Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_create_local_administrator_account_via_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators often leverage net.exe to create admin accounts. +references: [] +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators + group. + risk_objects: + - field: user + type: user + score: 30 + - field: dest + type: system + score: 30 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - DHS Report TA18-074A + - Azorult + - CISA AA22-257A + - DarkGate Malware + - CISA AA24-241A + asset_type: Endpoint + mitre_attack_id: + - T1136.001 + - T1136 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index c66728ad30..806aa64509 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -1,7 +1,7 @@ name: Windows Domain Admin Impersonation Indicator id: 10381f93-6d38-470a-9c30-d25478e3bd3f version: 6 -date: '2024-12-10' +date: '2025-01-20' author: Mauricio Velazco, Splunk status: production type: TTP @@ -33,7 +33,7 @@ search: '`wineventlog_security` EventCode=4627 LogonType=3 NOT TargetUserName I | fillnull value=NotDA username | search username = "NotDA" | `windows_domain_admin_impersonation_indicator_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Authentication events across all endpoints and ingest Event Id 4627. Specifically, - the Audit Group Membership subcategory within the Logon Logooff category needs to + the Audit Group Membership subcategory within the Logon Logoff category needs to be enabled. Its crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table. @@ -83,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/diamond_ticket/security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/diamond_ticket/security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml index 64eb743762..0fecbadc81 100644 --- a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml +++ b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml @@ -1,32 +1,18 @@ name: Windows ESX Admins Group Creation via Net id: 3d7df60b-3332-4667-8090-afe03e08dce0 version: 4 -date: '2024-12-10' +date: '2025-01-13' author: Michael Haag, Splunk +status: production +type: TTP data_source: - Sysmon EventID 1 -type: TTP -status: production -description: This analytic detects attempts to create an "ESX Admins" group using - the Windows net.exe or net1.exe commands. This activity may indicate an attempt - to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability - (CVE-2024-37085). Attackers can use this method to gain unauthorized access to ESXi - hosts by recreating the "ESX Admins" group after its deletion from Active Directory. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process="*group - \"ESX Admins\"*" OR Processes.process="*group ESX Admins*") AND Processes.process="*/add*" - by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.original_file_name - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_esx_admins_group_creation_via_net_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - data that records process activity from your hosts to populate the Endpoint data - model in the Processes node. If you are using Sysmon, you must have at least version - 6.0.4 of the Sysmon TA. -known_false_positives: Legitimate administrators might create an "ESX Admins" group - for valid reasons. Verify that the group creation is authorized and part of normal - administrative tasks. Consider the context of the action, such as the user performing - it and any related activities. +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +description: This analytic detects attempts to create an "ESX Admins" group using the Windows net.exe or net1.exe commands. This activity may indicate an attempt to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085). Attackers can use this method to gain unauthorized access to ESXi hosts by recreating the "ESX Admins" group after its deletion from Active Directory. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*group*" Processes.process="*ESX Admins*" AND Processes.process="*/add*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_esx_admins_group_creation_via_net_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: Legitimate administrators might create an "ESX Admins" group for valid reasons. Verify that the group creation is authorized and part of normal administrative tasks. Consider the context of the action, such as the user performing it and any related activities. references: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505 - https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/ @@ -37,12 +23,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -73,7 +54,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon-esxadmins.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon-esxadmins.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_excessive_service_stop_attempt.yml b/detections/endpoint/windows_excessive_service_stop_attempt.yml new file mode 100644 index 0000000000..650ee8c56d --- /dev/null +++ b/detections/endpoint/windows_excessive_service_stop_attempt.yml @@ -0,0 +1,55 @@ +name: Windows Excessive Service Stop Attempt +id: ae8d3f4a-acd7-11eb-8846-acde48001122 +version: 6 +date: '2025-01-13' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects multiple attempts to stop or delete services on a system using `net.exe` or `sc.exe`. It leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and command-line executions within a one-minute window. This activity is significant as it may indicate an adversary attempting to disable security or critical services to evade detection and further their objectives. If confirmed malicious, this could lead to the attacker gaining persistence, escalating privileges, or disrupting essential services, thereby compromising the system's security posture. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (`process_net` OR `process_sc`) AND Processes.process="*stop*" OR Processes.process="*delete*" by Processes.process_name Processes.original_file_name Processes.parent_process_name Processes.dest Processes.user _time span=1m | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_excessive_service_stop_attempt_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An excessive amount of $process_name$ was executed on $dest$ attempting + to disable services. + risk_objects: + - field: dest + type: system + score: 80 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - XMRig + - Ransomware + - BlackByte Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1489 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_excessive_usage_of_net_app.yml b/detections/endpoint/windows_excessive_usage_of_net_app.yml new file mode 100644 index 0000000000..303b508b62 --- /dev/null +++ b/detections/endpoint/windows_excessive_usage_of_net_app.yml @@ -0,0 +1,62 @@ +name: Windows Excessive Usage Of Net App +id: 45e52536-ae42-11eb-b5c6-acde48001122 +version: 5 +date: '2025-01-13' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects excessive usage of `net.exe` within a one-minute interval. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This behavior is significant as it may indicate an adversary attempting to create, delete, or disable multiple user accounts rapidly, a tactic observed in Monero mining incidents. If confirmed malicious, this activity could lead to unauthorized user account manipulation, potentially compromising system integrity and enabling further malicious actions. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process_name Processes.parent_process_name Processes.original_file_name Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_excessive_usage_of_net_app_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: unknown. Filter as needed. Modify the time span as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Excessive usage of net1.exe or net.exe within 1m, with command line $process$ + has been detected on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 28 + - field: dest + type: system + score: 28 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - Prestige Ransomware + - Graceful Wipe Out Attack + - XMRig + - Windows Post-Exploitation + - Azorult + - Ransomware + - Rhysida Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1531 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_group_discovery_via_net.yml b/detections/endpoint/windows_group_discovery_via_net.yml new file mode 100644 index 0000000000..b351dac9de --- /dev/null +++ b/detections/endpoint/windows_group_discovery_via_net.yml @@ -0,0 +1,54 @@ +name: Windows Group Discovery Via Net +id: c5c8e0f3-147a-43da-bf04-4cfaec27dc44 +version: 1 +date: '2025-01-13' +author: Michael Haag, Mauricio Velazco, Splunk +status: production +type: Hunting +description: The following analytic identifies the execution of `net.exe` with command-line arguments used to query global, local and domain groups. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate local or domain groups, which is a common step in Active Directory or privileged accounts discovery. If confirmed malicious, this behavior could allow attackers to gain insights into the domain structure, aiding in further attacks such as privilege escalation or lateral movement. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*group*" AND NOT (Processes.process="*/add" OR Processes.process="*/delete") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_group_discovery_via_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://attack.mitre.org/techniques/T1069/001/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md +- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ +tags: + analytic_story: + - Windows Post-Exploitation + - Active Directory Discovery + - Prestige Ransomware + - Graceful Wipe Out Attack + - Rhysida Ransomware + - Cleo File Transfer Software + - Volt Typhoon + - IcedID + - Windows Discovery Techniques + - Azorult + asset_type: Endpoint + mitre_attack_id: + - T1069 + - T1069.001 + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/windows_http_network_communication_from_msiexec.yml b/detections/endpoint/windows_http_network_communication_from_msiexec.yml new file mode 100644 index 0000000000..94d5502310 --- /dev/null +++ b/detections/endpoint/windows_http_network_communication_from_msiexec.yml @@ -0,0 +1,57 @@ +name: Windows HTTP Network Communication From MSIExec +id: 827409a1-5393-4d8d-8da4-bbb297c262a7 +version: 5 +date: '2025-01-17' +author: Michael Haag, Splunk +status: production +type: Anomaly +description: The following analytic detects MSIExec making network connections over ports 443 or 80. This behavior is identified by correlating process creation events from Endpoint Detection and Response (EDR) agents with network traffic logs. Typically, MSIExec does not perform network communication to the internet, making this activity unusual and potentially indicative of malicious behavior. If confirmed malicious, an attacker could be using MSIExec to download or communicate with external servers, potentially leading to data exfiltration, command and control (C2) communication, or further malware deployment. +data_source: +- Sysmon EventID 1 AND Sysmon EventID 3 +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_msiexec` by _time Processes.user Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port IN ("80","443") by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port All_Traffic.dest_ip | `drop_dm_object_name(All_Traffic)` ] | table _time user dest parent_process_name process_name process_path process process_id dest_port dest_ip | `windows_http_network_communication_from_msiexec_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: False positives will be present and filtering is required. +references: +- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $process_name$ was identified on endpoint $dest$ contacting + a remote destination $dest_ip$ + risk_objects: + - field: user + type: user + score: 35 + - field: dest + type: system + score: 35 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - Windows System Binary Proxy Execution MSIExec + asset_type: Endpoint + mitre_attack_id: + - T1218.007 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml b/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml new file mode 100644 index 0000000000..4be4f5ad84 --- /dev/null +++ b/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml @@ -0,0 +1,51 @@ +name: Windows List ENV Variables Via SET Command From Uncommon Parent +id: 048839e4-1eaa-43ff-8a22-86d17f6fcc13 +version: 4 +date: '2025-01-17' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic identifies a suspicious process command line fetching environment variables using the cmd.exe "set" command, with a non-shell parent process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and parent process names. This activity could be significant as it is commonly associated with malware like Qakbot, which uses this technique to gather system information. If confirmed malicious, this behavior could indicate that the parent process has been compromised, potentially allowing attackers to execute arbitrary commands, escalate privileges, or persist within the environment. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="cmd.exe" Processes.process IN ("*/c set", "*/c \"set") AND NOT Processes.parent_process_name IN ("cmd.exe", "explorer.exe", "powershell*" "pwsh.exe") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_list_env_variables_via_set_command_from_uncommon_parent_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: shell process that are not included in this search may cause False positive. Filter as needed. +references: +- https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: non-shell parent process has a child process $process_name$ with a commandline + $process$ to fetch env variables on $dest$ + risk_objects: + - field: dest + type: system + score: 56 + threat_objects: [] +tags: + analytic_story: + - Qakbot + asset_type: Endpoint + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr/sysmon_wermgr.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_reg_restore.yml b/detections/endpoint/windows_modify_registry_reg_restore.yml deleted file mode 100644 index 49d359ba74..0000000000 --- a/detections/endpoint/windows_modify_registry_reg_restore.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows Modify Registry Reg Restore -id: d0072bd2-6d73-4c1b-bc77-ded6d2da3a4e -version: 4 -date: '2024-11-13' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic detects the execution of reg.exe with the "restore" - parameter, indicating an attempt to restore registry backup data on a host. This - detection leverages data from Endpoint Detection and Response (EDR) agents, focusing - on process execution logs and command-line arguments. This activity is significant - as it may indicate post-exploitation actions, such as those performed by tools like - winpeas, which use "reg save" and "reg restore" to manipulate registry settings. - If confirmed malicious, this could allow an attacker to revert registry changes, - potentially bypassing security controls and maintaining persistence. -data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process - = "* restore *" by Processes.process_name Processes.original_file_name Processes.process - Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process - Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_reg_restore_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: network administrator can use this command tool to backup registry - before updates or modifying critical registries. -references: -- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - Prestige Ransomware - asset_type: Endpoint - mitre_attack_id: - - T1012 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_msiexec_with_network_connections.yml b/detections/endpoint/windows_msiexec_with_network_connections.yml deleted file mode 100644 index 713896a6b0..0000000000 --- a/detections/endpoint/windows_msiexec_with_network_connections.yml +++ /dev/null @@ -1,86 +0,0 @@ -name: Windows MSIExec With Network Connections -id: 827409a1-5393-4d8d-8da4-bbb297c262a7 -version: 5 -date: '2024-11-13' -author: Michael Haag, Splunk -status: production -type: TTP -description: The following analytic detects MSIExec making network connections over - ports 443 or 80. This behavior is identified by correlating process creation events - from Endpoint Detection and Response (EDR) agents with network traffic logs. Typically, - MSIExec does not perform network communication to the internet, making this activity - unusual and potentially indicative of malicious behavior. If confirmed malicious, - an attacker could be using MSIExec to download or communicate with external servers, - potentially leading to data exfiltration, command and control (C2) communication, - or further malware deployment. -data_source: -- Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_msiexec` by _time Processes.user Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process Processes.parent_process_name - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic - where All_Traffic.dest_port IN ("80","443") by All_Traffic.process_id All_Traffic.dest - All_Traffic.dest_port All_Traffic.dest_ip | `drop_dm_object_name(All_Traffic)` ] - | table _time user dest parent_process_name process_name process_path process process_id - dest_port dest_ip | `windows_msiexec_with_network_connections_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: False positives will be present and filtering is required. -references: -- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md -drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: An instance of $process_name$ was identified on endpoint $dest$ contacting - a remote destination $dest_ip$ - risk_objects: - - field: user - type: user - score: 35 - - field: dest - type: system - score: 35 - threat_objects: - - field: parent_process_name - type: parent_process_name - - field: process_name - type: process_name -tags: - analytic_story: - - Windows System Binary Proxy Execution MSIExec - asset_type: Endpoint - mitre_attack_id: - - T1218.007 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_network_connection_discovery_via_net.yml b/detections/endpoint/windows_network_connection_discovery_via_net.yml new file mode 100644 index 0000000000..85a981ccaf --- /dev/null +++ b/detections/endpoint/windows_network_connection_discovery_via_net.yml @@ -0,0 +1,37 @@ +name: Windows Network Connection Discovery Via Net +id: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d +version: 5 +date: '2025-01-13' +author: Mauricio Velazco, Splunk +status: production +type: Hunting +description: The following analytic identifies the execution of `net.exe` with command-line arguments used to list or display information about computer connections. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential network reconnaissance by adversaries or Red Teams, aiming to gather situational awareness and Active Directory information. If confirmed malicious, this behavior could allow attackers to map the network, identify critical assets, and plan further attacks, potentially leading to data exfiltration or lateral movement. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (`process_net` OR (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe")) AND (Processes.process=*use) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_connection_discovery_via_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1049/ +tags: + analytic_story: + - Active Directory Discovery + - Azorult + - Windows Post-Exploitation + - Prestige Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1049 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_network_share_interaction_via_net.yml b/detections/endpoint/windows_network_share_interaction_via_net.yml new file mode 100644 index 0000000000..47a8dd8772 --- /dev/null +++ b/detections/endpoint/windows_network_share_interaction_via_net.yml @@ -0,0 +1,59 @@ +name: Windows Network Share Interaction Via Net +id: 4dc3951f-b3f8-4f46-b412-76a483f72277 +version: 4 +date: '2025-01-20' +author: Dean Luxton +status: production +type: Anomaly +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +description: The following analytic identifies network share discovery and collection activities performed on Windows systems using the Net command. Attackers often use network share discovery to identify accessible shared resources within a network, which can be a precursor to privilege escalation or data exfiltration. By monitoring Windows Event Logs for the usage of the Net command to list and interact with network shares, this detection helps identify potential reconnaissance and collection activities. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes WHERE (`process_net` OR (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe")) AND Processes.process IN ("*use *", "*view*") BY Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_share_interaction_via_net_filter`' +how_to_implement: The detection is based on data originating from either Endpoint Detection and Response (EDR) telemetry or EventCode 4688 with process command line logging enabled. These sources provide security-related telemetry from the endpoints. To implement this search, you must ingest logs that contain the process name, parent process, and complete command-line executions. These logs must be mapped to the Splunk Common Information Model (CIM) to normalize the field names capture the data within the datamodel schema. +known_false_positives: Administrators or power users may use this command. Additional filters needs to be applied. +references: +- https://attack.mitre.org/techniques/T1135/ +drilldown_searches: +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: User $user$ leveraged net.exe on $dest$ to interact with network shares, + executed by parent process $parent_process$ + risk_objects: + - field: dest + type: system + score: 20 + - field: user + type: user + score: 20 + threat_objects: [] +tags: + analytic_story: + - Active Directory Discovery + - Active Directory Privilege Escalation + - Network Discovery + asset_type: Endpoint + atomic_guid: + - ab39a04f-0c93-4540-9ff2-83f862c385ae + mitre_attack_id: + - T1135 + - T1039 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/net_share/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_network_share_interaction_with_net.yml b/detections/endpoint/windows_network_share_interaction_with_net.yml deleted file mode 100644 index dbdfa7f59d..0000000000 --- a/detections/endpoint/windows_network_share_interaction_with_net.yml +++ /dev/null @@ -1,79 +0,0 @@ -name: Windows Network Share Interaction With Net -id: 4dc3951f-b3f8-4f46-b412-76a483f72277 -version: 4 -date: '2024-12-10' -author: Dean Luxton -status: production -type: TTP -data_source: -- Sysmon EventID 1 -description: This analytic detects network share discovery and collection activities - performed on Windows systems using the Net command. Attackers often use network - share discovery to identify accessible shared resources within a network, which - can be a precursor to privilege escalation or data exfiltration. By monitoring Windows - Event Logs for the usage of the Net command to list and interact with network shares, - this detection helps identify potential reconnaissance and collection activities. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit) - as user_bunit FROM datamodel=Endpoint.Processes WHERE `process_net` BY Processes.user - Processes.dest Processes.process_exec Processes.parent_process_exec Processes.process - Processes.parent_process | `drop_dm_object_name(Processes)` | regex process="net[\s\.ex1]+view|net[\s\.ex1]+share|net[\s\.ex1]+use\s" - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_share_interaction_with_net_filter`' -how_to_implement: The detection is based on data originating from either Endpoint - Detection and Response (EDR) telemetry or EventCode 4688 with process command line - logging enabled. These sources provide security-related telemetry from the endpoints. - To implement this search, you must ingest logs that contain the process name, parent - process, and complete command-line executions. These logs must be mapped to the - Splunk Common Information Model (CIM) to normalize the field names capture the data - within the datamodel schema. -known_false_positives: Unknown -references: -- https://attack.mitre.org/techniques/T1135/ -drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: User $user$ leveraged net.exe on $dest$ to interact with network shares, - executed by parent process $parent_process$ - risk_objects: - - field: dest - type: system - score: 20 - - field: user - type: user - score: 20 - threat_objects: [] -tags: - analytic_story: - - Active Directory Discovery - - Active Directory Privilege Escalation - - Network Discovery - asset_type: Endpoint - atomic_guid: - - ab39a04f-0c93-4540-9ff2-83f862c385ae - mitre_attack_id: - - T1135 - - T1039 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/net_share/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_new_default_file_association_value_set.yml b/detections/endpoint/windows_new_default_file_association_value_set.yml new file mode 100644 index 0000000000..3b77265c00 --- /dev/null +++ b/detections/endpoint/windows_new_default_file_association_value_set.yml @@ -0,0 +1,47 @@ +name: Windows New Default File Association Value Set +id: 462d17d8-1f71-11ec-ad07-acde48001122 +version: 4 +date: '2025-01-15' +author: Teoderick Contreras, Splunk +status: production +type: Hunting +description: The following analytic detects registry changes to the default file association value. It leverages data from the Endpoint data model, specifically monitoring registry paths under "HKCR\\*\\shell\\open\\command\\*". This activity can be significant because, attackers might alter the default file associations in order to execute arbitrary scripts or payloads when a user opens a file, leading to potential code execution. If confirmed malicious, this technique can enable attackers to persist on the compromised host and execute further malicious commands, posing a severe threat to the environment. +data_source: +- Sysmon EventID 13 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\shell\\open\\command\\*" Registry.registry_path IN ("*HKCR\\*", "*HKEY_CLASSES_ROOT\\*") by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_new_default_file_association_value_set_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +known_false_positives: Windows and third party software will create and modify these file associations during installation or upgrades. Additional filters needs to be applied to tune environment specific false positives. +references: +- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features +drilldown_searches: +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +tags: + analytic_story: + - Hermetic Wiper + - Windows Registry Abuse + - Prestige Ransomware + - Windows Privilege Escalation + - Windows Persistence Techniques + - Data Destruction + asset_type: Endpoint + mitre_attack_id: + - T1546.001 + - T1546 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/office_product_writing_cab_or_inf.yml b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml similarity index 55% rename from detections/endpoint/office_product_writing_cab_or_inf.yml rename to detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml index 929ddd4902..b365b97975 100644 --- a/detections/endpoint/office_product_writing_cab_or_inf.yml +++ b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml @@ -1,38 +1,17 @@ -name: Office Product Writing cab or inf +name: Windows Office Product Dropped Cab or Inf File id: f48cd1d4-125a-11ec-a447-acde48001122 version: 9 -date: '2024-12-10' +date: '2025-01-20' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic detects Office products writing .cab or .inf files, - indicative of CVE-2021-40444 exploitation. It leverages the Endpoint.Processes and - Endpoint.Filesystem data models to identify Office applications creating these file - types. This activity is significant as it may signal an attempt to load malicious - ActiveX controls and download remote payloads, a known attack vector. If confirmed - malicious, this could lead to remote code execution, allowing attackers to gain - control over the affected system and potentially compromise sensitive data. +description: The following analytic detects Office products writing .cab or .inf files, indicative of CVE-2021-40444 exploitation. It leverages the Endpoint.Processes and Endpoint.Filesystem data models to identify Office applications creating these file types. This activity is significant as it may signal an attempt to load malicious ActiveX controls and download remote payloads, a known attack vector. If confirmed malicious, this could lead to remote code execution, allowing attackers to gain control over the affected system and potentially compromise sensitive data. data_source: -- Sysmon EventID 1 +- Sysmon EventID 1 AND Sysmon EventID 11 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -- Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count - min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.inf","*.cab") by _time span=1h Filesystem.dest - Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid - | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields _time - dest file_create_time file_name file_path process_name process_path process proc_guid] - | dedup file_create_time | table dest, process_name, process, file_create_time, - file_name, file_path, proc_guid | `office_product_writing_cab_or_inf_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` - node. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_office_products` by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.cab", "*.inf") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields _time dest file_create_time file_name file_path process_name process_path process proc_guid] | dedup file_create_time | table dest, process_name, process, file_create_time, file_name, file_path, proc_guid | `windows_office_product_dropped_cab_or_inf_file_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. known_false_positives: The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product. @@ -85,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml similarity index 51% rename from detections/endpoint/office_application_drop_executable.yml rename to detections/endpoint/windows_office_product_dropped_uncommon_file.yml index 0f58d8a853..3db3fc6cf0 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml @@ -1,35 +1,15 @@ -name: Office Application Drop Executable +name: Windows Office Product Dropped Uncommon File id: 73ce70c4-146d-11ec-9184-acde48001122 version: 8 -date: '2024-12-10' +date: '2025-01-20' author: Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github status: production -type: TTP -description: The following analytic detects Microsoft Office applications dropping - or creating executables or scripts on a Windows OS. It leverages process creation - and file system events from the Endpoint data model to identify Office applications - like Word or Excel generating files with extensions such as .exe, .dll, or .ps1. - This behavior is significant as it is often associated with spear-phishing attacks - where malicious files are dropped to compromise the host. If confirmed malicious, - this activity could lead to code execution, privilege escalation, or persistent - access, posing a severe threat to the environment. +type: Anomaly +description: The following analytic detects Microsoft Office applications dropping or creating executables or scripts on a Windows OS. It leverages process creation and file system events from the Endpoint data model to identify Office applications like Word or Excel generating files with extensions such as ".exe", ".dll", or ".ps1". This behavior is significant as it is often associated with spear-phishing attacks where malicious files are dropped to compromise the host. If confirmed malicious, this activity could lead to code execution, privilege escalation, or persistent access, posing a severe threat to the environment. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.process_guid | `drop_dm_object_name(Processes)` |join process_guid, _time - [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1") - by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name - Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` - | fields _time dest file_create_time file_name file_path process_name process_path - process process_guid] | dedup file_create_time | table dest, process_name, process, - file_create_time, file_name, file_path, process_guid | `office_application_drop_executable_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_office_products` by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.dll", "*.exe", "*.js", "*.pif", "*.ps1", "*.scr", "*.vbe", "*.vbs") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process process_guid] | dedup file_create_time | table dest, process_name, process, file_create_time, file_name, file_path, process_guid | `windows_office_product_dropped_uncommon_file_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. known_false_positives: office macro for automation may do this behavior references: - https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation @@ -79,7 +59,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_loaded_mshtml_module.yml b/detections/endpoint/windows_office_product_loaded_mshtml_module.yml new file mode 100644 index 0000000000..fa747992b2 --- /dev/null +++ b/detections/endpoint/windows_office_product_loaded_mshtml_module.yml @@ -0,0 +1,59 @@ +name: Windows Office Product Loaded MSHTML Module +id: 5f1c168e-118b-11ec-84ff-acde48001122 +version: 6 +date: '2025-01-20' +author: Michael Haag, Mauricio Velazco, Splunk +status: production +type: Anomaly +description: The following analytic detects the loading of the mshtml.dll module into an Office product, which is indicative of CVE-2021-40444 exploitation. It leverages Sysmon EventID 7 to monitor image loads by specific Office processes. This activity is significant because it can indicate an attempt to exploit a vulnerability in the MSHTML component via a malicious document. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further network penetration. +data_source: +- Sysmon EventID 7 +search: '`sysmon` EventID=7 process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe", "wordpad.exe", "wordview.exe") loaded_file_path IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | stats count min(_time) as firstTime max(_time) as lastTime by user_id, dest, process_name, loaded_file, loaded_file_path, original_file_name, process_guid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_loaded_mshtml_module_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: Limited false positives will be present, however, tune as necessary. Some applications may legitimately load mshtml.dll. +references: +- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 +- https://strontic.github.io/xcyclopedia/index-dll +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $process_name$ was identified on endpoint $dest$ loading + mshtml.dll. + risk_objects: + - field: dest + type: system + score: 80 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - Spearphishing Attachments + - Microsoft MSHTML Remote Code Execution CVE-2021-40444 + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability + asset_type: Endpoint + cve: + - CVE-2021-40444 + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_loading_taskschd_dll.yml b/detections/endpoint/windows_office_product_loading_taskschd_dll.yml new file mode 100644 index 0000000000..4e37e4291b --- /dev/null +++ b/detections/endpoint/windows_office_product_loading_taskschd_dll.yml @@ -0,0 +1,52 @@ +name: Windows Office Product Loading Taskschd DLL +id: cc8b7b74-9d0f-11eb-8342-acde48001122 +version: 9 +date: '2025-01-20' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects an Office document creating a scheduled task, either through a macro VBA API or by loading `taskschd.dll`. This detection leverages Sysmon EventCode 7 to identify when Office applications load the `taskschd.dll` file. This activity is significant as it is a common technique used by malicious macro malware to establish persistence or initiate beaconing. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary commands, or schedule future malicious activities, posing a significant threat to the environment. +data_source: +- Sysmon EventID 7 +search: '`sysmon` EventCode=7 process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") loaded_file_path = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime count by user_id, dest, process_name,loaded_file, loaded_file_path, original_file_name, process_guid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_loading_taskschd_dll_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Also be sure to include those monitored dll to your own sysmon config. +known_false_positives: False positives may occur if legitimate office documents are creating scheduled tasks. Ensure to investigate the scheduled task and the command to be executed. If the task is benign, add the task name to the exclusion list. Some applications may legitimately load taskschd.dll. +references: +- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ +- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An Office document was identified creating a scheduled task on $dest$. + Investigate further. + risk_objects: + - field: dest + type: system + score: 49 + threat_objects: [] +tags: + analytic_story: + - Spearphishing Attachments + asset_type: Endpoint + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_loading_vbe7_dll.yml b/detections/endpoint/windows_office_product_loading_vbe7_dll.yml new file mode 100644 index 0000000000..35b2ea4bd6 --- /dev/null +++ b/detections/endpoint/windows_office_product_loading_vbe7_dll.yml @@ -0,0 +1,63 @@ +name: Windows Office Product Loading VBE7 DLL +id: b12c89bc-9d06-11eb-a592-acde48001122 +version: 8 +date: '2025-01-20' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic identifies office documents executing macro code. It leverages Sysmon EventCode 7 to detect when processes like WINWORD.EXE or EXCEL.EXE load specific DLLs associated with macros (e.g., VBE7.DLL). This activity is significant because macros are a common attack vector for delivering malicious payloads, such as malware. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further compromise of the system. Disabling macros by default is recommended to mitigate this risk. +data_source: +- Sysmon EventID 7 +search: '`sysmon` EventCode=7 process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") loaded_file_path IN ("*\\VBE7INTL.DLL", "*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime values(loaded_file) as loaded_file count by dest EventCode process_name process_guid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_loading_vbe7_dll_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Also be sure to include those monitored dll to your own sysmon config. +known_false_positives: False positives may occur if legitimate office documents are executing macro code. Ensure to investigate the macro code and the command to be executed. If the macro code is benign, add the document name to the exclusion list. Some applications may legitimately load VBE7INTL.DLL, VBE7.DLL, or VBEUI.DLL. +references: +- https://www.joesandbox.com/analysis/386500/0/html +- https://www.joesandbox.com/analysis/702680/0/html +- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/ +- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +- https://www.fortinet.com/blog/threat-research/leveraging-microsoft-office-documents-to-deliver-agent-tesla-and-njrat +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Office document executing a macro on $dest$ + risk_objects: + - field: dest + type: system + score: 35 + threat_objects: [] +tags: + analytic_story: + - Spearphishing Attachments + - Trickbot + - IcedID + - DarkCrystal RAT + - AgentTesla + - Qakbot + - Azorult + - Remcos + - PlugX + - NjRAT + asset_type: Endpoint + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml new file mode 100644 index 0000000000..0a06c8cf3f --- /dev/null +++ b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml @@ -0,0 +1,55 @@ +name: Windows Office Product Spawned Child Process For Download +id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 +version: 9 +date: '2025-01-14' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic identifies Office applications spawning child processes to download content via HTTP/HTTPS. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where Office applications like Word or Excel initiate network connections, excluding common browsers. This activity is significant as it often indicates the use of malicious documents to execute living-off-the-land binaries (LOLBins) for payload delivery. If confirmed malicious, this behavior could lead to unauthorized code execution, data exfiltration, or further malware deployment, posing a severe threat to the organization's security. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` Processes.process IN ("*http:*","*https:*") NOT (Processes.original_file_name IN ("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_spawned_child_process_for_download_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Default browser not in the filter list. +references: +- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/ +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Office document spawning suspicious child process on $dest$ + risk_objects: + - field: dest + type: system + score: 35 + threat_objects: [] +tags: + analytic_story: + - Spearphishing Attachments + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability + - PlugX + - NjRAT + asset_type: Endpoint + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/office_spawning_control.yml b/detections/endpoint/windows_office_product_spawned_control.yml similarity index 82% rename from detections/endpoint/office_spawning_control.yml rename to detections/endpoint/windows_office_product_spawned_control.yml index d31ef598e1..1cf0c90c7e 100644 --- a/detections/endpoint/office_spawning_control.yml +++ b/detections/endpoint/windows_office_product_spawned_control.yml @@ -1,7 +1,7 @@ -name: Office Spawning Control +name: Windows Office Product Spawned Control id: 053e027c-10c7-11ec-8437-acde48001122 version: 9 -date: '2024-12-10' +date: '2025-01-14' author: Michael Haag, Splunk status: production type: TTP @@ -17,13 +17,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") - Processes.process_name=control.exe by Processes.dest Processes.user Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `office_spawning_control_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` Processes.process_name=control.exe by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `windows_office_product_spawned_control_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -87,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_control.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_control.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_spawning_msdt.yml b/detections/endpoint/windows_office_product_spawned_msdt.yml similarity index 82% rename from detections/endpoint/windows_office_product_spawning_msdt.yml rename to detections/endpoint/windows_office_product_spawned_msdt.yml index 1017755ad3..42115bf883 100644 --- a/detections/endpoint/windows_office_product_spawning_msdt.yml +++ b/detections/endpoint/windows_office_product_spawned_msdt.yml @@ -1,7 +1,7 @@ -name: Windows Office Product Spawning MSDT +name: Windows Office Product Spawned MSDT id: 127eba64-c981-40bf-8589-1830638864a7 -version: 9 -date: '2024-12-10' +version: 0 +date: '2025-01-14' author: Michael Haag, Teoderick Contreras, Splunk status: production type: TTP @@ -17,13 +17,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") - Processes.process_name=msdt.exe by Processes.dest Processes.user Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.original_file_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawning_msdt_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` Processes.process_name=msdt.exe by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawned_msdt_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -90,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml similarity index 79% rename from detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml rename to detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml index 70cb99e96f..12f546c88a 100644 --- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ b/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml @@ -1,7 +1,7 @@ -name: Office Product Spawning Rundll32 with no DLL +name: Windows Office Product Spawned Rundll32 With No DLL id: c661f6be-a38c-11eb-be57-acde48001122 version: 9 -date: '2024-12-10' +date: '2025-01-14' author: Michael Haag, Splunk status: production type: TTP @@ -17,14 +17,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe", - "msaccess.exe", "Graph.exe","winproj.exe") `process_rundll32` (Processes.process!=*.dll*) - by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `office_product_spawning_rundll32_with_no_dll_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` `process_rundll32` (Processes.process!=*.dll*) by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawned_rundll32_with_no_dll_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -70,6 +63,9 @@ tags: - Spearphishing Attachments - CVE-2023-36884 Office and Windows HTML RCE Vulnerability - Compromised Windows Host + - Prestige Ransomware + - Graceful Wipe Out Attack + - Crypto Stealer asset_type: Endpoint mitre_attack_id: - T1566 @@ -82,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_icedid.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_icedid.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_spawned_uncommon_process.yml b/detections/endpoint/windows_office_product_spawned_uncommon_process.yml new file mode 100644 index 0000000000..5dc516ea3d --- /dev/null +++ b/detections/endpoint/windows_office_product_spawned_uncommon_process.yml @@ -0,0 +1,109 @@ +name: Windows Office Product Spawned Uncommon Process +id: 55d8741c-fa32-4692-8109-410304961eb8 +version: 1 +date: '2025-01-13' +author: Michael Haag, Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects a Microsoft Office product spawning uncommon processes. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where Office applications are the parent process. This activity is significant as it may indicate an attempt of a malicious macro execution or exploitation of an unknown vulnerability in an office product, in order to bypass security controls. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` AND (`process_bitsadmin` OR `process_certutil` OR `process_cmd` OR `process_cscript` OR `process_mshta` OR `process_powershell` OR `process_regsvr32` OR `process_rundll32` OR `process_wmic` OR `process_wscript`) by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawned_uncommon_process_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: False positives should be limited, however filter as needed. +references: +- https://any.run/malware-trends/trickbot +- https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe +- https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/ +- https://attack.mitre.org/techniques/T1047/ +- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/ +- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md +- https://redcanary.com/threat-detection-report/threats/TA551/ +- https://twitter.com/cyb3rops/status/1416050325870587910?s=21 +- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing +- https://www.joesandbox.com/analysis/380662/0/html +- https://www.joesandbox.com/analysis/702680/0/html +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: User $user$ on $dest$ spawned Windows Script Host from Winword.exe + risk_objects: + - field: dest + type: system + score: 70 + - field: user + type: user + score: 70 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - AgentTesla + - Azorult + - Compromised Windows Host + - CVE-2023-21716 Word RTF Heap Corruption + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability + - DarkCrystal RAT + - FIN7 + - IcedID + - NjRAT + - PlugX + - Qakbot + - Remcos + - Spearphishing Attachments + - Trickbot + - Warzone RAT + asset_type: Endpoint + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test - Macro + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog +- name: True Positive Test - IcedId + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/phish_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog +- name: True Positive Test - TrickBot + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_password_policy_discovery_with_net.yml b/detections/endpoint/windows_password_policy_discovery_with_net.yml new file mode 100644 index 0000000000..9253379379 --- /dev/null +++ b/detections/endpoint/windows_password_policy_discovery_with_net.yml @@ -0,0 +1,34 @@ +name: Windows Password Policy Discovery with Net +id: 09336538-065a-11ec-8665-acde48001122 +version: 6 +date: '2025-01-13' +author: Teoderick Contreras, Mauricio Velazco, Nasreddine Bencherchali, Splunk +status: production +type: Hunting +description: The following analytic identifies the execution of `net.exe` with command line arguments aimed at obtaining the computer or domain password policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to gather information about Active Directory password policies. If confirmed malicious, this behavior could allow attackers to understand password complexity requirements, aiding in brute-force or password-guessing attacks, ultimately compromising user accounts and gaining unauthorized access to the network. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process = "*accounts*" AND NOT Processes.process IN ("*/FORCELOGOFF*", "*/MINPWLEN*", "*/MAXPWAGE*", "*/MINPWAGE*", "*/UNIQUEPW*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_password_policy_discovery_with_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + asset_type: Endpoint + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_query_registry_reg_save.yml b/detections/endpoint/windows_query_registry_reg_save.yml deleted file mode 100644 index 8b30088660..0000000000 --- a/detections/endpoint/windows_query_registry_reg_save.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows Query Registry Reg Save -id: cbee60c1-b776-456f-83c2-faa56bdbe6c6 -version: 4 -date: '2024-11-13' -author: Teoderick Contreras, Splunk -status: production -type: Hunting -description: The following analytic detects the execution of the reg.exe process with - the "save" parameter. This detection leverages data from Endpoint Detection and - Response (EDR) agents, focusing on process execution logs and command-line arguments. - This activity is significant because threat actors often use the "reg save" command - to dump credentials or test registry modification capabilities on compromised hosts. - If confirmed malicious, this behavior could allow attackers to escalate privileges, - persist in the environment, or access sensitive information stored in the registry. -data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process - = "* save *" by Processes.process_name Processes.original_file_name Processes.process - Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process - Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_query_registry_reg_save_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: network administrator can use this command tool to backup registry - before updates or modifying critical registries. -references: -- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser -- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -tags: - analytic_story: - - Windows Post-Exploitation - - CISA AA23-347A - - Prestige Ransomware - asset_type: Endpoint - mitre_attack_id: - - T1012 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_registry_entries_exported_via_reg.yml b/detections/endpoint/windows_registry_entries_exported_via_reg.yml new file mode 100644 index 0000000000..70e5fc6a36 --- /dev/null +++ b/detections/endpoint/windows_registry_entries_exported_via_reg.yml @@ -0,0 +1,38 @@ +name: Windows Registry Entries Exported Via Reg +id: cbee60c1-b776-456f-83c2-faa56bdbe6c6 +version: 4 +date: '2025-01-15' +author: Teoderick Contreras, Splunk +status: production +type: Hunting +description: The following analytic detects the execution of the reg.exe process with either the "save" or "export" parameters. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because threat actors often use the "reg save" or "reg export" command to dump credentials or test registry modification capabilities on compromised hosts. If confirmed malicious, this behavior could allow attackers to escalate privileges, persist in the environment, or access sensitive information stored in the registry. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process IN ("* save *", "* export *") by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_entries_exported_via_reg_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: network administrator can use this command tool to backup registry before updates or modifying critical registries. +references: +- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser +- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS +- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ +tags: + analytic_story: + - Windows Post-Exploitation + - CISA AA23-347A + - Prestige Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1012 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_registry_entries_restored_via_reg.yml b/detections/endpoint/windows_registry_entries_restored_via_reg.yml new file mode 100644 index 0000000000..0406b4c476 --- /dev/null +++ b/detections/endpoint/windows_registry_entries_restored_via_reg.yml @@ -0,0 +1,37 @@ +name: Windows Registry Entries Restored Via Reg +id: d0072bd2-6d73-4c1b-bc77-ded6d2da3a4e +version: 4 +date: '2025-01-14' +author: Teoderick Contreras, Splunk +status: production +type: Hunting +description: The following analytic detects the execution of reg.exe with the "restore" parameter, indicating an attempt to restore registry backup data on a host. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it may indicate post-exploitation actions, such as those performed by tools like winpeas, which use "reg save" and "reg restore" to manipulate registry settings. If confirmed malicious, this could allow an attacker to revert registry changes, potentially bypassing security controls and maintaining persistence. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process = "* restore *" by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_entries_restored_via_reg_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: network administrator can use this command tool to backup registry before updates or modifying critical registries. +references: +- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser +- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS +- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ +tags: + analytic_story: + - Windows Post-Exploitation + - Prestige Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1012 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml new file mode 100644 index 0000000000..128c59a6e9 --- /dev/null +++ b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml @@ -0,0 +1,59 @@ +name: Windows Sensitive Group Discovery With Net +id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a +version: 5 +date: '2025-01-13' +author: Mauricio Velazco, Splunk +status: production +type: Anomaly +description: The following analytic detects the execution of `net.exe` with command-line arguments used to query elevated domain or sensitive groups. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to identify high-privileged users within Active Directory. If confirmed malicious, this behavior could lead to further attacks aimed at compromising privileged accounts, escalating privileges, or gaining unauthorized access to sensitive systems and data. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*group*" Processes.process IN ("*Domain Admins*", "*Enterprise Admins*", "*Schema Admins*", "*Account Operators*", "*Server Operators*", "*Protected Users*", "*Dns Admins*", "*Domain Computers*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sensitive_group_discovery_with_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory +- https://adsecurity.org/?p=3658 +- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Elevated domain group discovery enumeration on $dest$ by $user$ + risk_objects: + - field: dest + type: system + score: 21 + threat_objects: [] +tags: + analytic_story: + - Active Directory Discovery + - Volt Typhoon + - Rhysida Ransomware + - BlackSuit Ransomware + - IcedID + asset_type: Endpoint + mitre_attack_id: + - T1069 + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml new file mode 100644 index 0000000000..77cda7a286 --- /dev/null +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -0,0 +1,72 @@ +name: Windows Sensitive Registry Hive Dump Via CommandLine +id: 8bbb7d58-b360-11eb-ba21-acde48001122 +version: 5 +date: '2025-01-15' +author: Michael Haag, Patrick Bareiss, Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: The following analytic detects the use of `reg.exe` to export Windows Registry hives, which may contain sensitive credentials. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving `save` or `export` actions targeting the `sam`, `system`, or `security` hives. This activity is significant as it indicates potential offline credential access attacks, often executed from untrusted processes or scripts. If confirmed malicious, attackers could gain access to credential data, enabling further compromise and lateral movement within the network. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_reg` Processes.process IN ("*save*", "*export*")) OR (`process_regedit` Processes.process IN ("*/E *", "*-E *"))) AND Processes.process IN ("*HKEY_LOCAL_MACHINE*", "*HKLM*") AND Processes.process IN ("*SAM*", "*System*", "*Security*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sensitive_registry_hive_dump_via_commandline_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: It is possible some agent based products will generate false positives. Filter as needed. +references: +- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md +- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Suspicious use of `reg.exe` exporting Windows Registry hives containing + credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$ + risk_objects: + - field: user + type: user + score: 56 + - field: dest + type: system + score: 56 + threat_objects: + - field: parent_process_name + type: parent_process_name +tags: + analytic_story: + - CISA AA22-257A + - CISA AA23-347A + - Compromised Windows Host + - Credential Dumping + - DarkSide Ransomware + - Data Destruction + - Industroyer2 + - Volt Typhoon + - Windows Registry Abuse + asset_type: Endpoint + mitre_attack_id: + - T1003.002 + - T1003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test - Sysmon + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog +- name: True Positive Test - CrowdStrike + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index 8cc9e49d31..80fcea4b98 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -1,10 +1,10 @@ name: Windows Service Creation Using Registry Entry id: 25212358-948e-11ec-ad47-acde48001122 -version: '7' -date: '2024-12-17' +version: 8 +date: '2025-01-20' author: Teoderick Contreras, Splunk, Steven Dick status: production -type: TTP +type: Anomaly description: The following analytic detects the modification of registry keys that define Windows services using reg.exe. This detection leverages Splunk to search for specific keywords in the registry path, value name, and value data fields. This @@ -75,4 +75,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/windows_service_stop_attempt.yml b/detections/endpoint/windows_service_stop_attempt.yml new file mode 100644 index 0000000000..c203b0a66e --- /dev/null +++ b/detections/endpoint/windows_service_stop_attempt.yml @@ -0,0 +1,50 @@ +name: Windows Service Stop Attempt +id: 827af04b-0d08-479b-9b84-b7d4644e4b80 +version: 4 +date: '2025-01-13' +author: Teoderick Contreras, Splunk +status: production +type: Hunting +description: The following analytic identifies attempts to stop services on a system using `net.exe`, `sc.exe` or the "Stop-Service" cmdlet. It leverages Endpoint Detection and Response (EDR) telemetry. This activity can be significant as adversaries often terminate security or critical services to evade detection and further their objectives. If confirmed malicious, this behavior could allow attackers to disable security defenses, facilitate ransomware encryption, or disrupt essential services, leading to potential data loss or system compromise. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_net` OR `process_sc`) Processes.process="* stop *") OR Processes.process="*Stop-Service *" by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_stop_attempt_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Windows OS or software may stop and restart services due to some critical update. +references: +- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +tags: + analytic_story: + - Prestige Ransomware + - Graceful Wipe Out Attack + asset_type: Endpoint + mitre_attack_id: + - T1489 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/prestige_ransomware/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml b/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml deleted file mode 100644 index afedc6b586..0000000000 --- a/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml +++ /dev/null @@ -1,79 +0,0 @@ -name: Windows Service Stop Via Net and SC Application -id: 827af04b-0d08-479b-9b84-b7d4644e4b80 -version: 4 -date: '2024-11-13' -author: Teoderick Contreras, Splunk -status: production -type: Anomaly -description: The following analytic identifies attempts to stop services on a system - using `net.exe` or `sc.exe`. It leverages data from Endpoint Detection and Response - (EDR) agents, focusing on process names, GUIDs, and command-line executions. This - activity is significant as adversaries often terminate security or critical services - to evade detection and further their objectives. If confirmed malicious, this behavior - could allow attackers to disable security defenses, facilitate ransomware encryption, - or disrupt essential services, leading to potential data loss or system compromise. -data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_net` OR Processes.process_name - = "sc.exe" OR Processes.original_file_name= "sc.exe" AND Processes.process="*stop*" - by Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_service_stop_via_net__and_sc_application_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: Windows OS or software may stop and restart services due to - some critical update. -references: -- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ -drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: $process$ was executed on $dest$ attempting to stop service. - risk_objects: - - field: dest - type: system - score: 49 - threat_objects: [] -tags: - analytic_story: - - Prestige Ransomware - - Graceful Wipe Out Attack - - Crypto Stealer - asset_type: Endpoint - mitre_attack_id: - - T1489 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/prestige_ransomware/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_valid_account_with_never_expires_password.yml b/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml similarity index 80% rename from detections/endpoint/windows_valid_account_with_never_expires_password.yml rename to detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml index ff0b99e91e..f5a9198094 100644 --- a/detections/endpoint/windows_valid_account_with_never_expires_password.yml +++ b/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml @@ -1,13 +1,13 @@ -name: Windows Valid Account With Never Expires Password +name: Windows Set Account Password Policy To Unlimited Via Net id: 73a931db-1830-48b3-8296-cd9cfa09c3c8 version: 5 -date: '2024-12-10' -author: Teoderick Contreras, Splunk +date: '2025-01-13' +author: Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects the use of net.exe to update user account policies to set passwords as non-expiring. It leverages data from Endpoint Detection - and Response (EDR) agents, focusing on command-line executions involving "/maxpwage:unlimited". + and Response (EDR) agents, focusing on command-line executions involving "/maxpwage:unlimited" or "/maxpwage:49710", which achieve a similar outcome theoretically. This activity is significant as it can indicate an attempt to maintain persistence, escalate privileges, evade defenses, or facilitate lateral movement. If confirmed malicious, this behavior could allow an attacker to maintain long-term access to @@ -19,11 +19,8 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_net` AND Processes.process="* accounts *" AND Processes.process="* - /maxpwage:unlimited" by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_valid_account_with_never_expires_password_filter`' + where `process_net` AND Processes.process="* accounts *" AND (Processes.process="* + /maxpwage:unlimited" OR Processes.process="/maxpwage:49710") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_set_account_password_policy_to_unlimited_via_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -62,8 +59,10 @@ rba: threat_objects: [] tags: analytic_story: - - Azorult - - Compromised Windows Host + - Ransomware + - BlackByte Ransomware + - Crypto Stealer + - XMRig asset_type: Endpoint mitre_attack_id: - T1489 diff --git a/detections/endpoint/detect_webshell_exploit_behavior.yml b/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml similarity index 95% rename from detections/endpoint/detect_webshell_exploit_behavior.yml rename to detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml index 48a4989e23..9a5312f111 100644 --- a/detections/endpoint/detect_webshell_exploit_behavior.yml +++ b/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml @@ -1,15 +1,15 @@ -name: Detect Webshell Exploit Behavior +name: Windows Suspicious Child Process Spawned From WebServer id: 22597426-6dbd-49bd-bcdc-4ec19857192f -version: 6 -date: '2024-12-10' +version: '6' +date: '2025-01-13' author: Steven Dick status: production type: TTP description: The following analytic identifies the execution of suspicious processes - typically associated with webshell activity on web servers. It detects when processes + typically associated with WebShell activity on web servers. It detects when processes like `cmd.exe`, `powershell.exe`, or `bash.exe` are spawned by web server processes such as `w3wp.exe` or `nginx.exe`. This behavior is significant as it may indicate - an adversary exploiting a web application vulnerability to install a webshell, providing + an adversary exploiting a web application vulnerability to install a WebShell, providing persistent access and command execution capabilities. If confirmed malicious, this activity could allow attackers to maintain control over the compromised server, execute arbitrary commands, and potentially escalate privileges or exfiltrate sensitive @@ -29,7 +29,7 @@ search: '| tstats `security_content_summariesonly` count max(_time) as lastTime, IN ("w3wp.exe", "http*.exe", "nginx*.exe", "php*.exe", "php-cgi*.exe","tomcat*.exe")) by Processes.dest,Processes.user,Processes.parent_process,Processes.parent_process_name,Processes.process,Processes.process_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `detect_webshell_exploit_behavior_filter`' + | `windows_suspicious_child_process_spawned_from_webserver_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/windows_user_deletion_via_net.yml similarity index 55% rename from detections/endpoint/deleting_of_net_users.yml rename to detections/endpoint/windows_user_deletion_via_net.yml index 10ea2d7392..7f807ec463 100644 --- a/detections/endpoint/deleting_of_net_users.yml +++ b/detections/endpoint/windows_user_deletion_via_net.yml @@ -1,39 +1,18 @@ -name: Deleting Of Net Users +name: Windows User Deletion Via Net id: 1c8c6f66-acce-11eb-aafb-acde48001122 version: 6 -date: '2024-11-13' +date: '2025-01-13' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects the use of net.exe or net1.exe command-line - to delete a user account on a system. It leverages data from Endpoint Detection - and Response (EDR) agents, focusing on process and command-line execution logs. - This activity is significant as it may indicate an attempt to impair user accounts - or cover tracks during lateral movement. If confirmed malicious, this could lead - to unauthorized access removal, disruption of legitimate user activities, or concealment - of adversarial actions, complicating incident response and forensic investigations. +type: Anomaly +description: The following analytic detects the use of net.exe or net1.exe command-line to delete a user account on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line execution logs. This activity is significant as it may indicate an attempt to impair user accounts or cover tracks during lateral movement. If confirmed malicious, this could lead to unauthorized access removal, disruption of legitimate user activities, or concealment of adversarial actions, complicating incident response and forensic investigations. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - values(Processes.parent_process) as parent_process values(Processes.process_id) - as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_net` AND Processes.process="*user*" AND Processes.process="*/delete*" - by Processes.process_name Processes.original_file_name Processes.dest Processes.user - Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `deleting_of_net_users_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: System administrators or scripts may delete user accounts via - this technique. Filter as needed. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process="*user*" AND Processes.process="*/delete*" by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_deletion_via_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: System administrators or scripts may delete user accounts via this technique. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ drilldown_searches: diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/windows_user_disabled_via_net.yml similarity index 55% rename from detections/endpoint/disabling_net_user_account.yml rename to detections/endpoint/windows_user_disabled_via_net.yml index 5179a25496..b4c7b6a922 100644 --- a/detections/endpoint/disabling_net_user_account.yml +++ b/detections/endpoint/windows_user_disabled_via_net.yml @@ -1,37 +1,17 @@ -name: Disabling Net User Account +name: Windows User Disabled Via Net id: c0325326-acd6-11eb-98c2-acde48001122 version: 6 -date: '2024-11-13' +date: '2025-01-13' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects the use of the `net.exe` utility to disable - a user account via the command line. It leverages data from Endpoint Detection and - Response (EDR) agents, focusing on process execution logs and command-line arguments. - This activity is significant as it may indicate an adversary's attempt to disrupt - user availability, potentially as a precursor to further malicious actions. If confirmed - malicious, this could lead to denial of service for legitimate users, aiding the - attacker in maintaining control or covering their tracks. +type: Anomaly +description: The following analytic detects the use of the `net.exe` utility to disable a user account via the command line. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it may indicate an adversary's attempt to disrupt user availability, potentially as a precursor to further malicious actions. If confirmed malicious, this could lead to denial of service for legitimate users, aiding the attacker in maintaining control or covering their tracks. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - values(Processes.parent_process) as parent_process values(Processes.process_id) - as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_net` AND Processes.process="*user*" AND Processes.process="*/active:no*" - by Processes.process_name Processes.original_file_name Processes.dest Processes.user - Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `disabling_net_user_account_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process="*user*" AND Processes.process="*/active:no*" by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_disabled_via_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: unknown references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/windows_user_discovery_via_net.yml similarity index 54% rename from detections/endpoint/local_account_discovery_with_net.yml rename to detections/endpoint/windows_user_discovery_via_net.yml index bb0a6ad627..2307f15e4a 100644 --- a/detections/endpoint/local_account_discovery_with_net.yml +++ b/detections/endpoint/windows_user_discovery_via_net.yml @@ -1,8 +1,8 @@ -name: Local Account Discovery with Net +name: Windows User Discovery Via Net id: 5d0d4830-0133-11ec-bae3-acde48001122 version: 5 -date: '2024-11-13' -author: Mauricio Velazco, Splunk +date: '2025-01-13' +author: Mauricio Velazco, Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: Hunting description: The following analytic detects the execution of `net.exe` or `net1.exe` @@ -17,21 +17,8 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_net` (Processes.process=*user - OR Processes.process=*users) by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `local_account_discovery_with_net_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` (Processes.process="*user" OR Processes.process="*users" OR Processes.process="*users *" OR Processes.process="*user *") AND NOT (Processes.process="*/add" OR Processes.process="*/delete") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_discovery_via_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1087/001/ diff --git a/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml b/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml index fa288f0f1c..9b10539657 100644 --- a/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml +++ b/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml @@ -1,30 +1,25 @@ name: Windows Exchange Autodiscover SSRF Abuse id: d436f9e7-0ee7-4a47-864b-6dea2c4e2752 version: 4 -date: '2024-11-15' +date: '2025-01-16' author: Michael Haag, Nathaniel Stearns, Splunk status: production type: TTP -description: The following analytic detects potential abuse of the ProxyShell or ProxyNotShell - vulnerabilities in Microsoft Exchange via Server Side Request Forgery (SSRF). It - leverages the Web datamodel to identify suspicious POST requests with specific URI - paths and queries related to autodiscover, powershell, and mapi. This activity is - significant as it may indicate an attempt to exploit Exchange server vulnerabilities - to access internal services or sensitive data. If confirmed malicious, this could - lead to unauthorized access, data exfiltration, or further compromise of the network. +description: This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server. The detection focuses on identifying the SSRF attack patterns used in these exploit chains. The analytic monitors for suspicious POST requests to /autodiscover/autodiscover.json endpoints that may indicate attempts to enumerate LegacyDN attributes as part of initial reconnaissance. It also detects requests containing X-Rps-CAT parameters that could indicate attempts to impersonate Exchange users and access the PowerShell backend. Additionally, it looks for MAPI requests that may be used to obtain user SIDs, along with suspicious user agents (particularly Python-based) commonly used in automated exploit attempts. If successful, these attacks can lead to remote code execution as SYSTEM, allowing attackers to deploy webshells, access mailboxes, or gain persistent access to the Exchange server and potentially the broader network environment. data_source: - Windows IIS -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Web where (Web.status=200 OR Web.status=302 OR Web.status=401) - AND Web.http_method=POST by Web.src Web.status Web.uri_path Web.dest Web.http_method - Web.uri_query | `drop_dm_object_name("Web")` | eval is_autodiscover=if(like(lower(uri_path),"%autodiscover%"),1,0) - | eval powershell = if(match(lower(uri_query),"powershell"), "1",0) | eval mapi=if(like(uri_query,"%/mapi/%"),1,0) - | addtotals fieldname=Score is_autodiscover, powershell, mapi | fields Score, src,dest, - status, uri_query,uri_path,http_method | where Score >= 2 | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_exchange_autodiscover_ssrf_abuse_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on Web traffic, Exchange OR IIS logs, mapped to `Web` datamodel in the `Web` node. - In addition, confirm the latest CIM App 4.20 or higher is installed. +search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where (Web.status=200) AND Web.http_method=POST by Web.src Web.status Web.uri_path Web.dest Web.http_method Web.uri_query Web.http_user_agent + | `drop_dm_object_name("Web")` + | eval is_autodiscover=if(like(lower(uri_path),"%autodiscover/autodiscover.json%"),1,0) + | eval has_rps_cat=if(like(lower(uri_query),"%x-rps-cat=%"),1,0) + | eval exchange_backend=if(like(lower(uri_query),"%/powershell/?%"),1,0) + | eval mapi=if(like(uri_query,"%/mapi/%"),1,0) + | eval suspicious_agent=if(match(lower(http_user_agent), "python|urllib"),1,0) + | addtotals fieldname=Score is_autodiscover, has_rps_cat, exchange_backend, mapi, suspicious_agent + | where Score >= 3 + | fields Score, src, dest, status, uri_query, uri_path, http_method, http_user_agent + | `windows_exchange_autodiscover_ssrf_abuse_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic, Exchange OR IIS logs, mapped to `Web` datamodel in the `Web` node. In addition, confirm the latest CIM App 4.20 or higher is installed. known_false_positives: False positives are limited. references: - https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html @@ -36,6 +31,7 @@ references: - https://docs.splunk.com/Documentation/AddOns/released/MSIIS - https://highon.coffee/blog/ssrf-cheat-sheet/ - https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ +- https://m365internals.com/2022/10/18/hunting-and-responding-to-proxyshell-attacks/ drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/lookups/security_services_lookup.csv b/lookups/security_services_lookup.csv index b8982c6109..8aa2e35080 100644 --- a/lookups/security_services_lookup.csv +++ b/lookups/security_services_lookup.csv @@ -3,3 +3,8 @@ service,description,category *wscsvc*,Windows Security Center Service,security *windefend*,Windows Defender Service,security *sysmon*,Sysmon Driver,security +*csc_iseagent*,Cisco Secure Client - ISE Posture Agent,security +*csc_nvmagent*,Cisco Secure Client - Network Visibility Agent,security +*csc_umbrellaagent*,Cisco Secure Client - Umbrella Agent,security +*csc_swgagent*,Cisco Secure Client - Umbrella SWG Agent,security +*CiscoAMP*,Cisco Secure Endpoint,security diff --git a/macros/process_cscript.yml b/macros/process_cscript.yml new file mode 100644 index 0000000000..ea60a34a73 --- /dev/null +++ b/macros/process_cscript.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=cscript.exe OR Processes.original_file_name=cscript.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_cscript diff --git a/macros/process_net.yml b/macros/process_net.yml index ca8bb9efa5..8ca4fcec5c 100644 --- a/macros/process_net.yml +++ b/macros/process_net.yml @@ -1,3 +1,3 @@ -definition: (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe" OR Processes.process_name="net1.exe" OR Processes.original_file_name="net1.exe") +definition: (Processes.process_name="net1.exe" OR Processes.original_file_name="net1.exe") description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ name: process_net \ No newline at end of file diff --git a/macros/process_office_products.yml b/macros/process_office_products.yml new file mode 100644 index 0000000000..7462194e06 --- /dev/null +++ b/macros/process_office_products.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe", "wordpad.exe", "wordview.exe") OR Processes.original_file_name IN ("EQNEDT32.EXE", "Excel.exe", "Graph.exe", "MSACCESS.EXE", "MSPUB.EXE", "OneNote.exe", "OneNoteIm.exe", "OneNoteM.exe", "OUTLOOK.EXE", "POWERPNT.EXE", "VISIO.EXE", "WinProj.exe", "WinWord.exe")) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_office_products diff --git a/macros/process_office_products_parent.yml b/macros/process_office_products_parent.yml new file mode 100644 index 0000000000..c4cd308613 --- /dev/null +++ b/macros/process_office_products_parent.yml @@ -0,0 +1,3 @@ +definition: (Processes.parent_process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe")) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_office_products_parent \ No newline at end of file diff --git a/macros/process_powershell.yml b/macros/process_powershell.yml index e90bfb853e..f5b56bebd7 100644 --- a/macros/process_powershell.yml +++ b/macros/process_powershell.yml @@ -1,3 +1,3 @@ -definition: (Processes.process_name=pwsh.exe OR Processes.process_name=sqlps.exe OR Processes.process_name=sqltoolsps.exe OR Processes.process_name=powershell.exe OR Processes.process_name=powershell_ise.exe OR Processes.original_file_name=pwsh.dll OR Processes.original_file_name=PowerShell.EXE OR Processes.original_file_name=powershell_ise.EXE) +definition: (Processes.process_name=pwsh.exe OR Processes.process_name=powershell.exe OR Processes.process_name=powershell_ise.exe OR Processes.original_file_name=pwsh.dll OR Processes.original_file_name=PowerShell.EXE OR Processes.original_file_name=powershell_ise.EXE) description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ name: process_powershell \ No newline at end of file diff --git a/macros/process_regedit.yml b/macros/process_regedit.yml new file mode 100644 index 0000000000..c611ec65d8 --- /dev/null +++ b/macros/process_regedit.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=regedit.exe OR Processes.original_file_name=REGEDIT.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_regedit diff --git a/macros/process_sc.yml b/macros/process_sc.yml new file mode 100644 index 0000000000..c98f5c4685 --- /dev/null +++ b/macros/process_sc.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name="sc.exe" OR Processes.original_file_name="sc.exe") +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_sc \ No newline at end of file diff --git a/macros/process_wscript.yml b/macros/process_wscript.yml new file mode 100644 index 0000000000..2ec5d68963 --- /dev/null +++ b/macros/process_wscript.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=wscript.exe OR Processes.original_file_name=wscript.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_wscript diff --git a/macros/system_network_configuration_discovery_tools.yml b/macros/system_network_configuration_discovery_tools.yml index 3f869e3af2..245c383f2d 100644 --- a/macros/system_network_configuration_discovery_tools.yml +++ b/macros/system_network_configuration_discovery_tools.yml @@ -1,12 +1,3 @@ -definition: (process_name= "arp.exe" OR process_name= "at.exe" OR process_name= "attrib.exe" - OR process_name= "cscript.exe" OR process_name= "dsquery.exe" OR process_name= "hostname.exe" - OR process_name= "ipconfig.exe" OR process_name= "mimikatz.exe" OR process_name= - "nbstat.exe" OR process_name= "net.exe" OR process_name= "netsh.exe" OR process_name= - "nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name= - "qwinsta.exe" OR process_name= "reg.exe" OR process_name= "runas.exe" OR process_name= - "sc.exe" OR process_name= "schtasks.exe" OR process_name= "ssh.exe" OR process_name= - "systeminfo.exe" OR process_name= "taskkill.exe" OR process_name= "telnet.exe" OR - process_name= "tracert.exe" OR process_name="wscript.exe" OR process_name= "xcopy.exe") -description: This macro is a list of process that can be used to discover the network - configuration +definition: (process_name="arp.exe" OR process_name="dsquery.exe" OR process_name="hostname.exe" OR process_name="ipconfig.exe" OR process_name="nbstat.exe" OR process_name="net.exe" OR process_name="netsh.exe" OR process_name="nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name="qwinsta.exe" OR process_name= "telnet.exe" OR process_name= "tracert.exe") +description: This macro is a list of processes that can be used to discover the network configuration name: system_network_configuration_discovery_tools diff --git a/playbooks/risk_notable_import_data.json b/playbooks/risk_notable_import_data.json index b88c0b461a..12f59821d9 100644 --- a/playbooks/risk_notable_import_data.json +++ b/playbooks/risk_notable_import_data.json @@ -136,7 +136,7 @@ "errors": {}, "id": "1", "type": "end", - "userCode": "\t\n # Error handling in case of playbook not being able to import data properly\n if not format_summary_note:\n raise RuntimeError(\"Error occured during import data and summary note is missing\")\n \n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n", + "userCode": "\t\n # Error handling in case of playbook not being able to import data properly\n if not format_summary_note:\n raise RuntimeError(\"Error occured during import data and summary note is missing\")\n \n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n", "x": 960, "y": 1800 },