From ea2e44f0665f1c1ebe1f0ef0de608177315901f4 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 28 Sep 2021 11:13:54 +0200 Subject: [PATCH 01/40] privilege_esc_persistence --- detections/endpoint/registry_keys_used_for_persistence.yml | 3 ++- detections/endpoint/screensaver_event_trigger_execution.yml | 2 +- tests/endpoint/screensaver_event_trigger_execution.test.yml | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 3fa7167986..33f290cdd1 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -11,7 +11,8 @@ description: The search looks for modifications to registry keys that can be use search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* - OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* + OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* + OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml index dd457c5f95..697e489eed 100644 --- a/detections/endpoint/screensaver_event_trigger_execution.yml +++ b/detections/endpoint/screensaver_event_trigger_execution.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is developed to detect possible event trigger execution through screensaver registry entry modification. +description: This analytic is developed to detect possible event trigger execution through screensaver registry entry modification for persistence or privilege escalation. This technique was seen in several APT and malware where they put the malicious payload path to the SCRNSAVE.EXE registry key to redirect the execution to their malicious payload path. This TTP is a good indicator that some attacker may modify this entry for their persistence and privilege escalation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/tests/endpoint/screensaver_event_trigger_execution.test.yml b/tests/endpoint/screensaver_event_trigger_execution.test.yml index 4e398660f6..1f3ad83e56 100644 --- a/tests/endpoint/screensaver_event_trigger_execution.test.yml +++ b/tests/endpoint/screensaver_event_trigger_execution.test.yml @@ -1,6 +1,6 @@ name: Screensaver Event Trigger Execution Unit Test tests: -- name: Screensaver Event Trigger Execution +- name: Manual datasets generation for Screensaver Event Trigger Execution. file: endpoint/screensaver_event_trigger_execution.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' From 20f659970ecbe845483e74c4a1a70b7b54f61289 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 28 Sep 2021 15:20:25 +0200 Subject: [PATCH 02/40] privilege_esc_persistence --- .../change_default_file_association.yml | 67 +++++++++++++++++++ .../change_default_file_association.test.yml | 12 ++++ 2 files changed, 79 insertions(+) create mode 100644 detections/endpoint/change_default_file_association.yml create mode 100644 tests/endpoint/change_default_file_association.test.yml diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/change_default_file_association.yml new file mode 100644 index 0000000000..4a0b68584a --- /dev/null +++ b/detections/endpoint/change_default_file_association.yml @@ -0,0 +1,67 @@ +name: Change Default File Association +id: 462d17d8-1f71-11ec-ad07-acde48001122 +version: 1 +date: '2021-09-27' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is developed to detect suspicious registry modification to change the default file association of windows to malicious payload. + This techninique was seen in some APT where it modify the default process to run file association, like .txt to notepad.exe. Instead notepad.exe it will point to a Script + or other payload that will load malicious command to the compromised host. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" + by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `change_default_file_association_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features +tags: + analytic_story: + - Windows Persistence Techniques + - Windows Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1546.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/change_default_file_association.test.yml b/tests/endpoint/change_default_file_association.test.yml new file mode 100644 index 0000000000..42dd4b8324 --- /dev/null +++ b/tests/endpoint/change_default_file_association.test.yml @@ -0,0 +1,12 @@ +name: Change Default File Association Unit Test +tests: +- name: Change Default File Association + file: endpoint/change_default_file_association.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 993f0adb87f5e6c00ad39950d878ce7a1010f7e5 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 29 Sep 2021 10:42:05 +0200 Subject: [PATCH 03/40] privilege_escalation_persistence --- .../logon_script_event_trigger_execution.yml | 67 +++++++++++++++++++ .../endpoint/verclsid_clsid_execution.yml | 67 +++++++++++++++++++ macros/process_verclsid.yml | 3 + ...on_script_event_trigger_execution.test.yml | 12 ++++ .../verclsid_clsid_execution.test.yml | 12 ++++ 5 files changed, 161 insertions(+) create mode 100644 detections/endpoint/logon_script_event_trigger_execution.yml create mode 100644 detections/endpoint/verclsid_clsid_execution.yml create mode 100644 macros/process_verclsid.yml create mode 100644 tests/endpoint/logon_script_event_trigger_execution.test.yml create mode 100644 tests/endpoint/verclsid_clsid_execution.test.yml diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml new file mode 100644 index 0000000000..9be28d8257 --- /dev/null +++ b/detections/endpoint/logon_script_event_trigger_execution.yml @@ -0,0 +1,67 @@ +name: Logon Script Event Trigger Execution +id: 4c38c264-1f74-11ec-b5fa-acde48001122 +version: 1 +date: '2021-09-27' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious modification of registry entry to persist and gain privilege escalation upon booting up of compromised host. + This technique was seen in several APT and malware where it modify UserInitMprLogonScript registry entry to its malicious payload to be executed upon boot up of the machine since + this is a +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Environment\\UserInitMprLogonScript") + by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `logon_script_event_trigger_execution_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://attack.mitre.org/techniques/T1037/001 +tags: + analytic_story: + - Windows Persistence Techniques + - Windows Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1037.001/logonscript_reg/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1037.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml new file mode 100644 index 0000000000..6e438751a3 --- /dev/null +++ b/detections/endpoint/verclsid_clsid_execution.yml @@ -0,0 +1,67 @@ +name: Verclsid CLSID Execution +id: 61e9a56a-20fa-11ec-8ba3-acde48001122 +version: 1 +date: '2021-09-29' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic is to detect a possible abuse of verclsid to execute malicious file through generate CLSID. + This process is a normal application of windows to verify the CLSID COM object before it is instantiated by Windows Explorer. + This hunting query can be a good pivot point to analyze what is he CLSID or COM object pointing too to check if it is a valid application or not. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.parent_process) as parent_process values(Processes.process_id) + as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_verclsid` AND Processes.process="*/S*" Processes.process="*/C*" AND Processes.process="*{*" AND Processes.process="*}*" + by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `verclsid_clsid_execution_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: windows can used this application for its normal COm object validation +references: +- https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5 +- https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/ +tags: + analytic_story: + - Unusual Processes + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.012 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.original_file_name + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - source:endpoint + - stage:Defense Evasion + message: process $process_name$ to execute possible clsid commandline $process$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim \ No newline at end of file diff --git a/macros/process_verclsid.yml b/macros/process_verclsid.yml new file mode 100644 index 0000000000..a70fbd2e0d --- /dev/null +++ b/macros/process_verclsid.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=verclsid.exe OR Processes.original_file_name=verclsid.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_verclsid \ No newline at end of file diff --git a/tests/endpoint/logon_script_event_trigger_execution.test.yml b/tests/endpoint/logon_script_event_trigger_execution.test.yml new file mode 100644 index 0000000000..dcb74a0a02 --- /dev/null +++ b/tests/endpoint/logon_script_event_trigger_execution.test.yml @@ -0,0 +1,12 @@ +name: Logon Script Event Trigger Execution Unit Test +tests: +- name: Logon Script Event Trigger Execution + file: endpoint/logon_script_event_trigger_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1037.001/logonscript_reg/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/verclsid_clsid_execution.test.yml b/tests/endpoint/verclsid_clsid_execution.test.yml new file mode 100644 index 0000000000..cbbc1bfc62 --- /dev/null +++ b/tests/endpoint/verclsid_clsid_execution.test.yml @@ -0,0 +1,12 @@ +name: Verclsid CLSID Execution Unit Test +tests: +- name: Verclsid CLSID Execution + file: endpoint/verclsid_clsid_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.012/verclsid_exec/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From f9662d73938c72dd924217de8e54f1ac3ab348b7 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 29 Sep 2021 10:42:52 +0200 Subject: [PATCH 04/40] privilege_escalation_persistence --- detections/endpoint/verclsid_clsid_execution.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml index 6e438751a3..331e9489a6 100644 --- a/detections/endpoint/verclsid_clsid_execution.yml +++ b/detections/endpoint/verclsid_clsid_execution.yml @@ -30,7 +30,7 @@ tags: analytic_story: - Unusual Processes dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.012/verclsid_exec/sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: From 7f49a1dedc7b933f6ab6f0f6e4bcb8eb545f691d Mon Sep 17 00:00:00 2001 From: root Date: Wed, 29 Sep 2021 09:20:38 +0000 Subject: [PATCH 05/40] Added detection testing service results inVerclsid CLSID Execution --- .../endpoint/verclsid_clsid_execution.yml | 41 ++++++++++--------- 1 file changed, 22 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml index 331e9489a6..5144212fd7 100644 --- a/detections/endpoint/verclsid_clsid_execution.yml +++ b/detections/endpoint/verclsid_clsid_execution.yml @@ -6,25 +6,27 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytic is to detect a possible abuse of verclsid to execute malicious file through generate CLSID. - This process is a normal application of windows to verify the CLSID COM object before it is instantiated by Windows Explorer. - This hunting query can be a good pivot point to analyze what is he CLSID or COM object pointing too to check if it is a valid application or not. +description: This analytic is to detect a possible abuse of verclsid to execute malicious + file through generate CLSID. This process is a normal application of windows to + verify the CLSID COM object before it is instantiated by Windows Explorer. This + hunting query can be a good pivot point to analyze what is he CLSID or COM object + pointing too to check if it is a valid application or not. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_verclsid` AND Processes.process="*/S*" Processes.process="*/C*" AND Processes.process="*{*" AND Processes.process="*}*" - by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + where `process_verclsid` AND Processes.process="*/S*" Processes.process="*/C*" AND Processes.process="*{*" + AND Processes.process="*}*" by Processes.process_name Processes.original_file_name + Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `verclsid_clsid_execution_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: windows can used this application for its normal COm object validation + Sysmon TA. +known_false_positives: windows can used this application for its normal COm object + validation references: -- https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5 +- https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5 - https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/ tags: analytic_story: @@ -41,21 +43,21 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_name - - Processes.original_file_name - - Processes.dest - - Processes.user - - Processes.parent_process_name + - Processes.process_name + - Processes.original_file_name + - Processes.dest + - Processes.user + - Processes.parent_process_name - Processes.parent_process security_domain: endpoint impact: 50 confidence: 50 - # (impact * confidence)/100 risk_score: 25 context: - source:endpoint - stage:Defense Evasion - message: process $process_name$ to execute possible clsid commandline $process$ in $dest$ + message: process $process_name$ to execute possible clsid commandline $process$ + in $dest$ observable: - name: dest type: Hostname @@ -64,4 +66,5 @@ tags: - name: user type: user role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 65d6bacee6fd8fe7c77a8c75a02171db9479471f Mon Sep 17 00:00:00 2001 From: root Date: Wed, 29 Sep 2021 09:50:10 +0000 Subject: [PATCH 06/40] Added detection testing service results inManual datasets generation for Screensaver Event Trigger Execution. --- .../screensaver_event_trigger_execution.yml | 38 +++++++++---------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml index 697e489eed..00b8914da3 100644 --- a/detections/endpoint/screensaver_event_trigger_execution.yml +++ b/detections/endpoint/screensaver_event_trigger_execution.yml @@ -1,4 +1,4 @@ -name: Screensaver Event Trigger Execution +name: Screensaver Event Trigger Execution id: 58cea3ec-1f6d-11ec-8560-acde48001122 version: 1 date: '2021-09-27' @@ -6,16 +6,17 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is developed to detect possible event trigger execution through screensaver registry entry modification for persistence or privilege escalation. - This technique was seen in several APT and malware where they put the malicious payload path to the SCRNSAVE.EXE registry key to redirect the execution - to their malicious payload path. This TTP is a good indicator that some attacker may modify this entry for their persistence and privilege escalation. +description: This analytic is developed to detect possible event trigger execution + through screensaver registry entry modification for persistence or privilege escalation. + This technique was seen in several APT and malware where they put the malicious + payload path to the SCRNSAVE.EXE registry key to redirect the execution to their + malicious payload path. This TTP is a good indicator that some attacker may modify + this entry for their persistence and privilege escalation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Control Panel\\Desktop\\SCRNSAVE.EXE*") - by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` - | `screensaver_event_trigger_execution_filter`' + max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Control + Panel\\Desktop\\SCRNSAVE.EXE*") by Registry.dest Registry.user Registry.registry_path + Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `screensaver_event_trigger_execution_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response @@ -24,8 +25,8 @@ how_to_implement: To successfully implement this search, you must be ingesting d to the registry. known_false_positives: unknown references: -- https://attack.mitre.org/techniques/T1546/002/ -- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/screensaver +- https://attack.mitre.org/techniques/T1546/002/ +- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/screensaver tags: analytic_story: - Windows Persistence Techniques @@ -42,15 +43,14 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name security_domain: endpoint impact: 80 confidence: 90 - # (impact * confidence)/100 risk_score: 72 context: - source:endpoint @@ -65,4 +65,4 @@ tags: type: user role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 5d2bb19efe1dda2f6a7c62a3c065b0dc2c766370 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 29 Sep 2021 10:47:38 +0000 Subject: [PATCH 07/40] Added detection testing service results inLogon Script Event Trigger Execution --- .../logon_script_event_trigger_execution.yml | 33 +++++++++---------- 1 file changed, 16 insertions(+), 17 deletions(-) diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml index 9be28d8257..d27bdca08a 100644 --- a/detections/endpoint/logon_script_event_trigger_execution.yml +++ b/detections/endpoint/logon_script_event_trigger_execution.yml @@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a suspicious modification of registry entry to persist and gain privilege escalation upon booting up of compromised host. - This technique was seen in several APT and malware where it modify UserInitMprLogonScript registry entry to its malicious payload to be executed upon boot up of the machine since - this is a +description: This search is to detect a suspicious modification of registry entry + to persist and gain privilege escalation upon booting up of compromised host. This + technique was seen in several APT and malware where it modify UserInitMprLogonScript + registry entry to its malicious payload to be executed upon boot up of the machine + since this is a search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Environment\\UserInitMprLogonScript") - by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` - | `logon_script_event_trigger_execution_filter`' + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path + IN ("*\\Environment\\UserInitMprLogonScript") by Registry.dest Registry.user Registry.registry_path + Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `logon_script_event_trigger_execution_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response @@ -24,7 +24,7 @@ how_to_implement: To successfully implement this search, you must be ingesting d to the registry. known_false_positives: unknown references: -- https://attack.mitre.org/techniques/T1037/001 +- https://attack.mitre.org/techniques/T1037/001 tags: analytic_story: - Windows Persistence Techniques @@ -41,15 +41,14 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - source:endpoint @@ -64,4 +63,4 @@ tags: type: user role: - Victim - \ No newline at end of file + automated_detection_testing: passed From a83fee590a3cd84fbfd7cc4b004b5dd539bf5fe4 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 29 Sep 2021 11:53:36 +0000 Subject: [PATCH 08/40] Added detection testing service results inChange Default File Association --- .../change_default_file_association.yml | 34 +++++++++---------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/change_default_file_association.yml index 4a0b68584a..44cab51f50 100644 --- a/detections/endpoint/change_default_file_association.yml +++ b/detections/endpoint/change_default_file_association.yml @@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is developed to detect suspicious registry modification to change the default file association of windows to malicious payload. - This techninique was seen in some APT where it modify the default process to run file association, like .txt to notepad.exe. Instead notepad.exe it will point to a Script - or other payload that will load malicious command to the compromised host. +description: This analytic is developed to detect suspicious registry modification + to change the default file association of windows to malicious payload. This techninique + was seen in some APT where it modify the default process to run file association, + like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other + payload that will load malicious command to the compromised host. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" - by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path + ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest Registry.user + Registry.registry_path Registry.registry_key_name Registry.registry_value_name | + `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `change_default_file_association_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model @@ -25,7 +25,7 @@ how_to_implement: To successfully implement this search, you must be ingesting d to the registry. known_false_positives: unknown references: -- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features +- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features tags: analytic_story: - Windows Persistence Techniques @@ -42,15 +42,14 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - source:endpoint @@ -64,4 +63,5 @@ tags: - name: user type: user role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 24d740b66c38f44a57c7c6ddd11c337a00065e4e Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 29 Sep 2021 15:21:03 +0200 Subject: [PATCH 09/40] privilege_escalation_persistence --- .../active_setup_registry_autostart.yml | 55 +++++++++++++++ .../print_processor_registry_autostart.yml | 69 +++++++++++++++++++ .../active_setup_registry_autostart.test.yml | 12 ++++ ...rint_processor_registry_autostart.test.yml | 12 ++++ 4 files changed, 148 insertions(+) create mode 100644 detections/endpoint/active_setup_registry_autostart.yml create mode 100644 detections/endpoint/print_processor_registry_autostart.yml create mode 100644 tests/endpoint/active_setup_registry_autostart.test.yml create mode 100644 tests/endpoint/print_processor_registry_autostart.test.yml diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml new file mode 100644 index 0000000000..10484e2631 --- /dev/null +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -0,0 +1,55 @@ +name: Active Setup Registry Autostart +id: f64579c0-203f-11ec-abcc-acde48001122 +version: 1 +date: '2021-09-28' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious modification of the active setup registry for persistence and privilege escalation. + This technique was seen in several malware (poisonIvy), adware and APT to gain persistence to the compromised machine upon boot up. + This TTP is a good indicator to further check the process id that do the modification since modification of this registry is not commonly done. + check the legitimacy of the file and process involve in this rules to check if it is a valid setup installer that creating or modifying this registry. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_value_name = "StubPath" Registry.registry_key_name = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*" + by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `active_setup_registry_autostart_filter`' +how_to_implement: UPDATE_HOW_To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry.TO_IMPLEMENT +known_false_positives: active setup installer may add or modify this registry +references: +- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E +- https://attack.mitre.org/techniques/T1547/014/ +tags: + analytic_story: + - Windows Persistence Techniques + - Windows Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1547.014 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + message: + observable: + \ No newline at end of file diff --git a/detections/endpoint/print_processor_registry_autostart.yml b/detections/endpoint/print_processor_registry_autostart.yml new file mode 100644 index 0000000000..144544ae94 --- /dev/null +++ b/detections/endpoint/print_processor_registry_autostart.yml @@ -0,0 +1,69 @@ +name: Print Processor Registry Autostart +id: 1f5b68aa-2037-11ec-898e-acde48001122 +version: 1 +date: '2021-09-28' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious modification or new registry entry regarding print processor. + This registry is known to be abuse by turla or other APT to gain persistence and privilege escalation to the compromised machine. + This is done by adding the malicious dll payload on the new created key in this registry that will be executed as it restarted the spoolsv.exe process and services. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path ="*\\Control\\Print\\Environments\\Windows x64\\Print Processors*" + by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `print_processor_registry_autostart_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: possible new printer installation may add driver component on this registry. +references: +- https://attack.mitre.org/techniques/T1547/012/ +- https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/ +tags: + analytic_story: + - Windows Persistence Techniques + - Windows Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1547.012 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + \ No newline at end of file diff --git a/tests/endpoint/active_setup_registry_autostart.test.yml b/tests/endpoint/active_setup_registry_autostart.test.yml new file mode 100644 index 0000000000..e1fb06c684 --- /dev/null +++ b/tests/endpoint/active_setup_registry_autostart.test.yml @@ -0,0 +1,12 @@ +name: Active Setup Registry Autostart Unit Test +tests: +- name: Active Setup Registry Autostart + file: endpoint/active_setup_registry_autostart.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/print_processor_registry_autostart.test.yml b/tests/endpoint/print_processor_registry_autostart.test.yml new file mode 100644 index 0000000000..a40d16f744 --- /dev/null +++ b/tests/endpoint/print_processor_registry_autostart.test.yml @@ -0,0 +1,12 @@ +name: Print Processor Registry Autostart Unit Test +tests: +- name: Print Processor Registry Autostart + file: endpoint/print_processor_registry_autostart.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon.log + source: WinEventLog:Microsoft-Windows-PrintService/Operational + sourcetype: WinEventLog \ No newline at end of file From e9e9edd6591f6d31c50c354d89800bba113fec75 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 29 Sep 2021 15:25:45 +0200 Subject: [PATCH 10/40] privilege_escalation_persistence --- .../active_setup_registry_autostart.yml | 24 +++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index 10484e2631..4612b2dbee 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -44,12 +44,28 @@ tags: - Splunk Cloud required_fields: - _time + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name security_domain: endpoint - impact: - confidence: + impact: 80 + confidence: 100 # (impact * confidence)/100 - risk_score: + risk_score: 80 context: - message: + - source:endpoint + - stage:Privilege Escalation Persistence + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + \ No newline at end of file From 5276ba85ce5987da3b4edcb66ee6974083119f52 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 29 Sep 2021 15:27:18 +0200 Subject: [PATCH 11/40] privilege_escalation_persistence --- detections/endpoint/active_setup_registry_autostart.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index 4612b2dbee..13b140310b 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -51,9 +51,9 @@ tags: - Registry.registry_value_name security_domain: endpoint impact: 80 - confidence: 100 + confidence: 80 # (impact * confidence)/100 - risk_score: 80 + risk_score: 64 context: - source:endpoint - stage:Privilege Escalation Persistence From 27539045d6cfc907115946842028cbe6b6d3fe5b Mon Sep 17 00:00:00 2001 From: root Date: Wed, 29 Sep 2021 13:57:15 +0000 Subject: [PATCH 12/40] Added detection testing service results inActive Setup Registry Autostart --- .../active_setup_registry_autostart.yml | 47 +++++++++---------- 1 file changed, 23 insertions(+), 24 deletions(-) diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index 13b140310b..b90601b450 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -6,28 +6,29 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious modification of the active setup registry for persistence and privilege escalation. - This technique was seen in several malware (poisonIvy), adware and APT to gain persistence to the compromised machine upon boot up. - This TTP is a good indicator to further check the process id that do the modification since modification of this registry is not commonly done. - check the legitimacy of the file and process involve in this rules to check if it is a valid setup installer that creating or modifying this registry. +description: This analytic is to detect a suspicious modification of the active setup + registry for persistence and privilege escalation. This technique was seen in several + malware (poisonIvy), adware and APT to gain persistence to the compromised machine + upon boot up. This TTP is a good indicator to further check the process id that + do the modification since modification of this registry is not commonly done. check + the legitimacy of the file and process involve in this rules to check if it is a + valid setup installer that creating or modifying this registry. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_value_name = "StubPath" Registry.registry_key_name = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*" - by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` - | `active_setup_registry_autostart_filter`' -how_to_implement: UPDATE_HOW_To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_name + = "StubPath" Registry.registry_key_name = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed + Components*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name + Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` | `active_setup_registry_autostart_filter`' +how_to_implement: UPDATE_HOW_To successfully implement this search, you must be ingesting + data that records registry activity from your hosts to populate the endpoint data + model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.TO_IMPLEMENT known_false_positives: active setup installer may add or modify this registry references: -- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E -- https://attack.mitre.org/techniques/T1547/014/ +- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E +- https://attack.mitre.org/techniques/T1547/014/ tags: analytic_story: - Windows Persistence Techniques @@ -44,15 +45,14 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name security_domain: endpoint impact: 80 confidence: 80 - # (impact * confidence)/100 risk_score: 64 context: - source:endpoint @@ -67,5 +67,4 @@ tags: type: user role: - Victim - - \ No newline at end of file + automated_detection_testing: passed From 766497b4ef77d200534e30001d7cb7f3518a7e2c Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 30 Sep 2021 09:33:47 +0200 Subject: [PATCH 13/40] privilege_escalation_persistence --- tests/endpoint/print_processor_registry_autostart.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/print_processor_registry_autostart.test.yml b/tests/endpoint/print_processor_registry_autostart.test.yml index a40d16f744..8723a93d14 100644 --- a/tests/endpoint/print_processor_registry_autostart.test.yml +++ b/tests/endpoint/print_processor_registry_autostart.test.yml @@ -3,7 +3,7 @@ tests: - name: Print Processor Registry Autostart file: endpoint/print_processor_registry_autostart.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' + earliest_time: '-21d' latest_time: 'now' attack_data: - file_name: sysmon.log From e6e1004bd4e507a5150d27ff2d98488aa9855159 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 30 Sep 2021 10:29:01 +0200 Subject: [PATCH 14/40] privilege_escalation_persistence --- .../disable_uac_remote_restriction.yml | 70 +++++++++++++++++++ .../time_provider_persistence_registry.yml | 69 ++++++++++++++++++ .../disable_uac_remote_restriction.test.yml | 12 ++++ ...ime_provider_persistence_registry.test.yml | 12 ++++ 4 files changed, 163 insertions(+) create mode 100644 detections/endpoint/disable_uac_remote_restriction.yml create mode 100644 detections/endpoint/time_provider_persistence_registry.yml create mode 100644 tests/endpoint/disable_uac_remote_restriction.test.yml create mode 100644 tests/endpoint/time_provider_persistence_registry.test.yml diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml new file mode 100644 index 0000000000..b4edf0f040 --- /dev/null +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -0,0 +1,70 @@ +name: Disable UAC Remote Restriction +id: 9928b732-210e-11ec-b65e-acde48001122 +version: 1 +date: '2021-09-29' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious modification of registry to disable UAC remote restriction. + This technique was well documented in Microsoft page where attacker may modify this registry value to bypassed UAC feature of windows host. + This is a good indicator that some tries to bypassed UAC to suspicious process or gain privilege escalation. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path ="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" + by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `disable_uac_remote_restriction_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: admin may set this policy for non-critical machine. +references: +- https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Suspicious Windows Registry Activities + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1548.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.registry_value_data + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + + \ No newline at end of file diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml new file mode 100644 index 0000000000..2361331d40 --- /dev/null +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -0,0 +1,69 @@ +name: Time Provider Persistence Registry +id: 5ba382c4-2105-11ec-8d8f-acde48001122 +version: 1 +date: '2021-09-29' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspiciouos modification of time provider registry for persistence and autostart. + This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. + This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" + by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `time_provider_persistence_registry_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://pentestlab.blog/2019/10/22/persistence-time-providers/ +- https://attack.mitre.org/techniques/T1547/003/ +tags: + analytic_story: + - Windows Persistence Techniques + - Windows Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1547.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + \ No newline at end of file diff --git a/tests/endpoint/disable_uac_remote_restriction.test.yml b/tests/endpoint/disable_uac_remote_restriction.test.yml new file mode 100644 index 0000000000..4adb6f2d25 --- /dev/null +++ b/tests/endpoint/disable_uac_remote_restriction.test.yml @@ -0,0 +1,12 @@ +name: Disable UAC Remote Restriction Unit Test +tests: +- name: Disable UAC Remote Restriction + file: endpoint/disable_uac_remote_restriction.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/time_provider_persistence_registry.test.yml b/tests/endpoint/time_provider_persistence_registry.test.yml new file mode 100644 index 0000000000..4de49c3411 --- /dev/null +++ b/tests/endpoint/time_provider_persistence_registry.test.yml @@ -0,0 +1,12 @@ +name: Time Provider Persistence Registry Unit Test +tests: +- name: Time Provider Persistence Registry + file: endpoint/time_provider_persistence_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 79ff8104e57ee00f96cebc37c4b57a31af435117 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 30 Sep 2021 08:49:13 +0000 Subject: [PATCH 15/40] Added detection testing service results inTime Provider Persistence Registry --- .../time_provider_persistence_registry.yml | 31 +++++++++---------- 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index 2361331d40..fcf99f419e 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspiciouos modification of time provider registry for persistence and autostart. - This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. - This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin. +description: This analytic is to detect a suspiciouos modification of time provider + registry for persistence and autostart. This technique can allow the attacker to + persist on the compromised host and autostart as soon as the machine boot up. This + TTP can be a good indicator of suspicious behavior since this registry is not commonly + modified by normal user or even an admin. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" - by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path + ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" by Registry.dest Registry.user + Registry.registry_path Registry.registry_key_name Registry.registry_value_name | + `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `time_provider_persistence_registry_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model @@ -43,15 +43,14 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - source:endpoint @@ -66,4 +65,4 @@ tags: type: user role: - Victim - \ No newline at end of file + automated_detection_testing: passed From a7e7935b54e698164b9f694e6a91fe53637ea8e8 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 30 Sep 2021 08:55:04 +0000 Subject: [PATCH 16/40] Added detection testing service results inDisable UAC Remote Restriction --- .../disable_uac_remote_restriction.yml | 35 +++++++++---------- 1 file changed, 17 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml index b4edf0f040..80d564165f 100644 --- a/detections/endpoint/disable_uac_remote_restriction.yml +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -6,16 +6,17 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious modification of registry to disable UAC remote restriction. - This technique was well documented in Microsoft page where attacker may modify this registry value to bypassed UAC feature of windows host. - This is a good indicator that some tries to bypassed UAC to suspicious process or gain privilege escalation. +description: This analytic is to detect a suspicious modification of registry to disable + UAC remote restriction. This technique was well documented in Microsoft page where + attacker may modify this registry value to bypassed UAC feature of windows host. + This is a good indicator that some tries to bypassed UAC to suspicious process or + gain privilege escalation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path ="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" - by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path + ="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" + Registry.registry_value_data="0x00000001" by Registry.dest Registry.user Registry.registry_path + Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `disable_uac_remote_restriction_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model @@ -25,7 +26,7 @@ how_to_implement: To successfully implement this search, you must be ingesting d to the registry. known_false_positives: admin may set this policy for non-critical machine. references: -- https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction +- https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction tags: analytic_story: - Windows Defense Evasion Tactics @@ -42,16 +43,15 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name - Registry.registry_value_data security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - source:endpoint @@ -66,5 +66,4 @@ tags: type: user role: - Victim - - \ No newline at end of file + automated_detection_testing: passed From a2132aa445080ce562dbaf68d3844aebc9ddcffe Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 1 Oct 2021 10:25:56 +0200 Subject: [PATCH 17/40] privilege_escalation_persistence --- .../vbscript_execution_using_wscript_app.yml | 70 +++++++++++++++++++ ...cript_execution_using_wscript_app.test.yml | 12 ++++ 2 files changed, 82 insertions(+) create mode 100644 detections/endpoint/vbscript_execution_using_wscript_app.yml create mode 100644 tests/endpoint/vbscript_execution_using_wscript_app.test.yml diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml new file mode 100644 index 0000000000..ec5be43d3c --- /dev/null +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -0,0 +1,70 @@ +name: Vbscript Execution Using Wscript App +id: 35159940-228f-11ec-8a49-acde48001122 +version: 1 +date: '2021-10-01' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious wscript commandline to execute vbscript. + This technique was seen in several malware to execute malicious vbs file using wscript application. + commonly vbs script is associated to cscript process and this can be a technique to evade process parent child detections or + even some av script emulation system. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name + = "wscript.exe" AND Processes.parent_process = "*//e:vbscript*") OR (Processes.process_name + = "wscript.exe" AND Processes.process = "*//e:vbscript*") by Processes.parent_process_name + Processes.parent_process Processes.process_name Processes.process_id Processes.process + Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `vbscript_execution_using_wscript_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://www.joesandbox.com/analysis/369332/0/html +tags: + analytic_story: + - FIN7 + - Remcos + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Execution + message: Process name $process_name$ with commandline $process$ to execute vbsscript + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/vbscript_execution_using_wscript_app.test.yml b/tests/endpoint/vbscript_execution_using_wscript_app.test.yml new file mode 100644 index 0000000000..2139a83584 --- /dev/null +++ b/tests/endpoint/vbscript_execution_using_wscript_app.test.yml @@ -0,0 +1,12 @@ +name: Vbscript Execution Using Wscript App Unit Test +tests: +- name: Vbscript Execution Using Wscript App + file: endpoint/vbscript_execution_using_wscript_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 22809d6cf3a84f73e84221ddf797b08f373f4fd2 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 1 Oct 2021 08:47:12 +0000 Subject: [PATCH 18/40] Added detection testing service results inVbscript Execution Using Wscript App --- .../vbscript_execution_using_wscript_app.yml | 22 +++++++++---------- 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml index ec5be43d3c..9abcbf230d 100644 --- a/detections/endpoint/vbscript_execution_using_wscript_app.yml +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -6,27 +6,25 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious wscript commandline to execute vbscript. - This technique was seen in several malware to execute malicious vbs file using wscript application. - commonly vbs script is associated to cscript process and this can be a technique to evade process parent child detections or - even some av script emulation system. +description: This analytic is to detect a suspicious wscript commandline to execute + vbscript. This technique was seen in several malware to execute malicious vbs file + using wscript application. commonly vbs script is associated to cscript process + and this can be a technique to evade process parent child detections or even some + av script emulation system. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "wscript.exe" AND Processes.parent_process = "*//e:vbscript*") OR (Processes.process_name = "wscript.exe" AND Processes.process = "*//e:vbscript*") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process_id Processes.process - Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `vbscript_execution_using_wscript_app_filter`' + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `vbscript_execution_using_wscript_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. known_false_positives: unknown references: -- https://www.joesandbox.com/analysis/369332/0/html +- https://www.joesandbox.com/analysis/369332/0/html tags: analytic_story: - FIN7 @@ -53,7 +51,6 @@ tags: security_domain: endpoint impact: 70 confidence: 70 - # (impact * confidence)/100 risk_score: 49 context: - Source:Endpoint @@ -67,4 +64,5 @@ tags: - name: user type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From f4856f0d102e3c3e34f3827b9dc113df8c2a41ad Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 1 Oct 2021 10:54:47 +0200 Subject: [PATCH 19/40] privilege_escalation_persistence --- tests/endpoint/print_processor_registry_autostart.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/print_processor_registry_autostart.test.yml b/tests/endpoint/print_processor_registry_autostart.test.yml index 8723a93d14..35d0f7985e 100644 --- a/tests/endpoint/print_processor_registry_autostart.test.yml +++ b/tests/endpoint/print_processor_registry_autostart.test.yml @@ -3,7 +3,7 @@ tests: - name: Print Processor Registry Autostart file: endpoint/print_processor_registry_autostart.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-21d' + earliest_time: '-365d' latest_time: 'now' attack_data: - file_name: sysmon.log From 1bd28e6bd323fba64aee950add52b93ef99b94c0 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 1 Oct 2021 11:31:37 +0200 Subject: [PATCH 20/40] privilege_escalation_persistence --- detections/endpoint/print_processor_registry_autostart.yml | 2 +- tests/endpoint/print_processor_registry_autostart.test.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/print_processor_registry_autostart.yml b/detections/endpoint/print_processor_registry_autostart.yml index 144544ae94..dab28eac10 100644 --- a/detections/endpoint/print_processor_registry_autostart.yml +++ b/detections/endpoint/print_processor_registry_autostart.yml @@ -32,7 +32,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon_print.log kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/tests/endpoint/print_processor_registry_autostart.test.yml b/tests/endpoint/print_processor_registry_autostart.test.yml index 35d0f7985e..c32f529f1b 100644 --- a/tests/endpoint/print_processor_registry_autostart.test.yml +++ b/tests/endpoint/print_processor_registry_autostart.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-365d' latest_time: 'now' attack_data: - - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon.log + - file_name: sysmon_print.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon_print.log source: WinEventLog:Microsoft-Windows-PrintService/Operational sourcetype: WinEventLog \ No newline at end of file From ff39ef4a931ca6f44c947e32925c55aaee81ad14 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 4 Oct 2021 11:33:46 +0200 Subject: [PATCH 21/40] cars-mitre --- ...d_suspicious_spawned_by_script_process.yml | 65 +++++++++++++++++ .../endpoint/powershell_reflective_load.yml | 59 ++++++++++++++++ .../regsvr32_silent_param_dll_loading.yml | 69 +++++++++++++++++++ ...picious_spawned_by_script_process.test.yml | 12 ++++ .../powershell_reflective_load.test.yml | 12 ++++ ...regsvr32_silent_param_dll_loading.test.yml | 12 ++++ 6 files changed, 229 insertions(+) create mode 100644 detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml create mode 100644 detections/endpoint/powershell_reflective_load.yml create mode 100644 detections/endpoint/regsvr32_silent_param_dll_loading.yml create mode 100644 tests/endpoint/msbuild_suspicious_spawned_by_script_process.test.yml create mode 100644 tests/endpoint/powershell_reflective_load.test.yml create mode 100644 tests/endpoint/regsvr32_silent_param_dll_loading.test.yml diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml new file mode 100644 index 0000000000..3366e7112d --- /dev/null +++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml @@ -0,0 +1,65 @@ +name: MSBuild Suspicious Spawned By Script Process +id: 213b3148-24ea-11ec-93a2-acde48001122 +version: 1 +date: '2021-10-04' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious msbuild process by MS scripting process. + This behavior or event are commonly seen and used by malware or adversaries to execute malicious msbuild process using malicious script in the + compromised host. This behavior is not common and can be a good indicator to start checking the content of the script that execute the said msbuild process. +search: '| tstats `security_content_summariesonly` count values(Processes.process_name) + as process_name values(Processes.process) as process min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("wscript.exe", "cscript.exe") + AND `process_msbuild` by Processes.dest Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `msbuild_suspicious_spawned_by_script_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# +tags: + analytic_story: + - Trusted Developer Utilities Proxy Execution MSBuild + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1127.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.parent_process + - Processes.parent_process_name + - Processes.process_name + - Processes.original_file_name + - Processes.user + security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Stage:Execution + - Stage:Defense Evasion + message: Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/powershell_reflective_load.yml b/detections/endpoint/powershell_reflective_load.yml new file mode 100644 index 0000000000..8fa5537f7a --- /dev/null +++ b/detections/endpoint/powershell_reflective_load.yml @@ -0,0 +1,59 @@ +name: Powershell Reflective Load +id: 8aa0d0a2-24f4-11ec-b77a-acde48001122 +version: 1 +date: '2021-10-04' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious powershell loading a dll or executable using reflective load function. + this technique is commonly seen in file less malware where it download a file and directly load the downloaded file that are place in a stream memory to execute it. + this TTP is a good indicator to check the powershell that execute and what file or stream it execute. +search: '`powershell` EventCode=4104 Message = "*[Reflection.Assembly]::Load*" +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `powershell_reflective_load_filter`' +how_to_implement: o successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: third party powershell may use this function to execute binary. +references: +- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# +tags: + analytic_story: + - Malicious PowerShell + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/powershell.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - source:endpoint + - stage: Defense Evasion + message: a powershell that execute binary using reflective load in command $Message$ in $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/regsvr32_silent_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_param_dll_loading.yml new file mode 100644 index 0000000000..1562c09624 --- /dev/null +++ b/detections/endpoint/regsvr32_silent_param_dll_loading.yml @@ -0,0 +1,69 @@ +name: Regsvr32 Silent Param Dll Loading +id: f421c250-24e7-11ec-bc43-acde48001122 +version: 1 +date: '2021-10-04' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. + This technique was seen in several RAT malware like remcos, njrat and APT's to load their malicious dll in the compromised machine. + This TTP may executed by normal 3rd party application so it is better to pivot the parent process, parent commandline and commandline of the file that execute this regsvr32. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = regsvr32.exe Processes.process="*/i*" Processes.process="*/s*" + by Processes.dest Processes.parent_process Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `regsvr32_silent_param_dll_loading_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: other third part application may used this parameter but not so common in base windows environment +references: +- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# +tags: + analytic_story: + - Suspicious Regsvr32 Activity + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.010 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 60 + confidence: 60 + # (impact * confidence)/100 + risk_score: 36 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: regsvr32 process with $process$ commandline in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/msbuild_suspicious_spawned_by_script_process.test.yml b/tests/endpoint/msbuild_suspicious_spawned_by_script_process.test.yml new file mode 100644 index 0000000000..4f5a6f717d --- /dev/null +++ b/tests/endpoint/msbuild_suspicious_spawned_by_script_process.test.yml @@ -0,0 +1,12 @@ +name: MSBuild Suspicious Spawned By Script Process Unit Test +tests: +- name: MSBuild Suspicious Spawned By Script Process + file: endpoint/msbuild_suspicious_spawned_by_script_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/powershell_reflective_load.test.yml b/tests/endpoint/powershell_reflective_load.test.yml new file mode 100644 index 0000000000..36020cf594 --- /dev/null +++ b/tests/endpoint/powershell_reflective_load.test.yml @@ -0,0 +1,12 @@ +name: Powershell Reflective Load Unit Test +tests: +- name: Powershell Reflective Load + file: endpoint/powershell_reflective_load.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: powershell.log + data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/regsvr32_silent_param_dll_loading.test.yml b/tests/endpoint/regsvr32_silent_param_dll_loading.test.yml new file mode 100644 index 0000000000..a28aa579c6 --- /dev/null +++ b/tests/endpoint/regsvr32_silent_param_dll_loading.test.yml @@ -0,0 +1,12 @@ +name: Regsvr32 Silent Param Dll Loading Unit Test +tests: +- name: Regsvr32 Silent Param Dll Loading + file: endpoint/regsvr32_silent_param_dll_loading.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 31f5669d11c156a60209c6e7db2896b50862db28 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 4 Oct 2021 11:36:50 +0200 Subject: [PATCH 22/40] cars-mitre --- tests/endpoint/powershell_reflective_load.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/powershell_reflective_load.test.yml b/tests/endpoint/powershell_reflective_load.test.yml index 36020cf594..765708d510 100644 --- a/tests/endpoint/powershell_reflective_load.test.yml +++ b/tests/endpoint/powershell_reflective_load.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: powershell.log - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/powershell.log source: WinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: WinEventLog \ No newline at end of file From 2f32f733a8a8ea459ba1030b1486d717a3326a65 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 4 Oct 2021 10:13:07 +0000 Subject: [PATCH 23/40] Added detection testing service results inRegsvr32 Silent Param Dll Loading --- .../regsvr32_silent_param_dll_loading.yml | 33 ++++++++++--------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/regsvr32_silent_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_param_dll_loading.yml index 1562c09624..c9d0d3b0cc 100644 --- a/detections/endpoint/regsvr32_silent_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_param_dll_loading.yml @@ -6,23 +6,26 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. - This technique was seen in several RAT malware like remcos, njrat and APT's to load their malicious dll in the compromised machine. - This TTP may executed by normal 3rd party application so it is better to pivot the parent process, parent commandline and commandline of the file that execute this regsvr32. +description: This analytic is to detect a loading of dll using regsvr32 application + with silent parameter and dllinstall execution. This technique was seen in several + RAT malware like remcos, njrat and APT's to load their malicious dll in the compromised + machine. This TTP may executed by normal 3rd party application so it is better to + pivot the parent process, parent commandline and commandline of the file that execute + this regsvr32. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name = regsvr32.exe Processes.process="*/i*" Processes.process="*/s*" - by Processes.dest Processes.parent_process Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `regsvr32_silent_param_dll_loading_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = regsvr32.exe + Processes.process="*/i*" Processes.process="*/s*" by Processes.dest Processes.parent_process + Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `regsvr32_silent_param_dll_loading_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: other third part application may used this parameter but not so common in base windows environment + Sysmon TA. +known_false_positives: other third part application may used this parameter but not + so common in base windows environment references: -- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# +- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# tags: analytic_story: - Suspicious Regsvr32 Activity @@ -52,9 +55,8 @@ tags: security_domain: endpoint impact: 60 confidence: 60 - # (impact * confidence)/100 risk_score: 36 - context: + context: - Source:Endpoint - Stage:Defense Evasion message: regsvr32 process with $process$ commandline in $dest$ @@ -66,4 +68,5 @@ tags: - name: dest type: Hostname role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 9007d5bae95e31d6eaaa675fc874ab8b2c5753f9 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 4 Oct 2021 13:17:04 +0200 Subject: [PATCH 24/40] privilege_escalation_persistence --- .../endpoint/msbuild_suspicious_spawned_by_script_process.yml | 2 +- detections/endpoint/powershell_reflective_load.yml | 2 +- .../msbuild_suspicious_spawned_by_script_process.test.yml | 2 +- tests/endpoint/powershell_reflective_load.test.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml index 3366e7112d..b7694505f9 100644 --- a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml +++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml @@ -28,7 +28,7 @@ tags: analytic_story: - Trusted Developer Utilities Proxy Execution MSBuild dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/powershell_reflective_load.yml b/detections/endpoint/powershell_reflective_load.yml index 8fa5537f7a..688a3709f1 100644 --- a/detections/endpoint/powershell_reflective_load.yml +++ b/detections/endpoint/powershell_reflective_load.yml @@ -24,7 +24,7 @@ tags: analytic_story: - Malicious PowerShell dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/powershell.log kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/tests/endpoint/msbuild_suspicious_spawned_by_script_process.test.yml b/tests/endpoint/msbuild_suspicious_spawned_by_script_process.test.yml index 4f5a6f717d..4407f84aa1 100644 --- a/tests/endpoint/msbuild_suspicious_spawned_by_script_process.test.yml +++ b/tests/endpoint/msbuild_suspicious_spawned_by_script_process.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/powershell_reflective_load.test.yml b/tests/endpoint/powershell_reflective_load.test.yml index 765708d510..167a524ebc 100644 --- a/tests/endpoint/powershell_reflective_load.test.yml +++ b/tests/endpoint/powershell_reflective_load.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/T1127.001/regsvr32_silent/powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/powershell.log source: WinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: WinEventLog \ No newline at end of file From f89631895505b402438e9a550881647ccd845626 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 4 Oct 2021 11:41:23 +0000 Subject: [PATCH 25/40] Added detection testing service results inMSBuild Suspicious Spawned By Script Process --- ...d_suspicious_spawned_by_script_process.yml | 42 ++++++++++--------- 1 file changed, 22 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml index b7694505f9..a8165b8d65 100644 --- a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml +++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml @@ -6,24 +6,25 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious msbuild process by MS scripting process. - This behavior or event are commonly seen and used by malware or adversaries to execute malicious msbuild process using malicious script in the - compromised host. This behavior is not common and can be a good indicator to start checking the content of the script that execute the said msbuild process. +description: This analytic is to detect a suspicious msbuild process by MS scripting + process. This behavior or event are commonly seen and used by malware or adversaries + to execute malicious msbuild process using malicious script in the compromised host. + This behavior is not common and can be a good indicator to start checking the content + of the script that execute the said msbuild process. search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("wscript.exe", "cscript.exe") - AND `process_msbuild` by Processes.dest Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `msbuild_suspicious_spawned_by_script_process_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name + IN ("wscript.exe", "cscript.exe") AND `process_msbuild` by Processes.dest Processes.parent_process + Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `msbuild_suspicious_spawned_by_script_process_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown references: -- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# +- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# tags: analytic_story: - Trusted Developer Utilities Proxy Execution MSBuild @@ -39,21 +40,21 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.parent_process - - Processes.parent_process_name - - Processes.process_name - - Processes.original_file_name - - Processes.user + - Processes.dest + - Processes.parent_process + - Processes.parent_process_name + - Processes.process_name + - Processes.original_file_name + - Processes.user security_domain: endpoint impact: 70 confidence: 70 - # (impact * confidence)/100 risk_score: 49 context: - Stage:Execution - Stage:Defense Evasion - message: Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed by $user$ + message: Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed + by $user$ observable: - name: dest type: Endpoint @@ -62,4 +63,5 @@ tags: - name: User type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 80ceb52382a9f69f6f18e8ba19f910ebf2c9eb52 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 4 Oct 2021 11:42:27 +0000 Subject: [PATCH 26/40] Added detection testing service results inPowershell Reflective Load --- .../endpoint/powershell_reflective_load.yml | 36 ++++++++++--------- 1 file changed, 19 insertions(+), 17 deletions(-) diff --git a/detections/endpoint/powershell_reflective_load.yml b/detections/endpoint/powershell_reflective_load.yml index 688a3709f1..ae5a966426 100644 --- a/detections/endpoint/powershell_reflective_load.yml +++ b/detections/endpoint/powershell_reflective_load.yml @@ -6,20 +6,21 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious powershell loading a dll or executable using reflective load function. - this technique is commonly seen in file less malware where it download a file and directly load the downloaded file that are place in a stream memory to execute it. - this TTP is a good indicator to check the powershell that execute and what file or stream it execute. -search: '`powershell` EventCode=4104 Message = "*[Reflection.Assembly]::Load*" -| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `powershell_reflective_load_filter`' +description: This analytic is to detect a suspicious powershell loading a dll or executable + using reflective load function. this technique is commonly seen in file less malware + where it download a file and directly load the downloaded file that are place in + a stream memory to execute it. this TTP is a good indicator to check the powershell + that execute and what file or stream it execute. +search: '`powershell` EventCode=4104 Message = "*[Reflection.Assembly]::Load*" | stats + count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName + User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `powershell_reflective_load_filter`' how_to_implement: o successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. known_false_positives: third party powershell may use this function to execute binary. references: -- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# +- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# tags: analytic_story: - Malicious PowerShell @@ -35,19 +36,19 @@ tags: - Splunk Cloud required_fields: - _time - - EventCode - - Message - - ComputerName - - User + - EventCode + - Message + - ComputerName + - User security_domain: endpoint impact: 70 confidence: 70 - # (impact * confidence)/100 risk_score: 49 - context: + context: - source:endpoint - stage: Defense Evasion - message: a powershell that execute binary using reflective load in command $Message$ in $ComputerName$ + message: a powershell that execute binary using reflective load in command $Message$ + in $ComputerName$ observable: - name: ComputerName type: Hostname @@ -56,4 +57,5 @@ tags: - name: User type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 82633e151ac3fe905f82113ebc64fa1a17bddd34 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 5 Oct 2021 11:56:48 +0200 Subject: [PATCH 27/40] privilege_escalation_persistence --- ...le_security_logs_using_minint_registry.yml | 61 +++++++++++++++++ ...le_wdigest_uselogoncredential_registry.yml | 65 +++++++++++++++++++ .../endpoint/rundll32_shimcache_flush.yml | 65 +++++++++++++++++++ .../endpoint/suspicious_copy_on_system32.yml | 64 ++++++++++++++++++ macros/process_copy.yml | 3 + ...curity_logs_using_minint_registry.test.yml | 12 ++++ ...igest_uselogoncredential_registry.test.yml | 12 ++++ .../rundll32_shimcache_flush.test.yml | 12 ++++ .../suspicious_copy_on_system32.test.yml | 12 ++++ 9 files changed, 306 insertions(+) create mode 100644 detections/endpoint/disable_security_logs_using_minint_registry.yml create mode 100644 detections/endpoint/enable_wdigest_uselogoncredential_registry.yml create mode 100644 detections/endpoint/rundll32_shimcache_flush.yml create mode 100644 detections/endpoint/suspicious_copy_on_system32.yml create mode 100644 macros/process_copy.yml create mode 100644 tests/endpoint/disable_security_logs_using_minint_registry.test.yml create mode 100644 tests/endpoint/enable_wdigest_uselogoncredential_registry.test.yml create mode 100644 tests/endpoint/rundll32_shimcache_flush.test.yml create mode 100644 tests/endpoint/suspicious_copy_on_system32.test.yml diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml new file mode 100644 index 0000000000..b5f50ac0b3 --- /dev/null +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -0,0 +1,61 @@ +name: Disable Security Logs Using MiniNt Registry +id: 39ebdc68-25b9-11ec-aec7-acde48001122 +version: 1 +date: '2021-10-05' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: THis analytic is to detect a suspicious registry modification to disable security audit logs. + This technique was shared by a researcher to disable Security logs of windows by adding this registry. + The Windows will think it is WinPE and will not log any event to the Security Log +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path="*\\Control\\MiniNt\\*" + by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `disable_security_logs_using_minint_registry_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://twitter.com/0gtweet/status/1182516740955226112 +tags: + analytic_story: + - Windows Defense Evasion Tactics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1112 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: wdigest registry $registry_path$ was added in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml new file mode 100644 index 0000000000..378b82d273 --- /dev/null +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -0,0 +1,65 @@ +name: Enable WDigest UseLogonCredential Registry +id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 +version: 1 +date: '2021-10-05' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious registry modification to enable plain text credential feature of windows. + This technique was used by several malware and also by mimikatz to be able to dumpe the a plain text credential to the compromised or target host. + This TTP is really a good indicator that someone wants to dump the crendential of the host so it must be a good pivot for credential dumping techniques. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" + Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data = 0x00000001 + by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `enable_wdigest_uselogoncredential_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html +tags: + analytic_story: + - Credential Dumping + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/wdigest_enable/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1112 + - T1003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Credential Access + message: wdigest registry $registry_path$ was modified in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml new file mode 100644 index 0000000000..5b2bc12cb0 --- /dev/null +++ b/detections/endpoint/rundll32_shimcache_flush.yml @@ -0,0 +1,65 @@ +name: Rundll32 Shimcache Flush +id: a913718a-25b6-11ec-96d3-acde48001122 +version: 1 +date: '2021-10-05' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious rundll32 commandline to clear shim cache. + This technique is a anti-forensic technique to clear the cache taht are one important artifacts in terms of digital forensic during attacks or incident. + This TTP is a good indicator that someone tries to evade some tools and clear foothold on the machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_rundll32` AND Processes.process = "*apphelp.dll,ShimFlushCache*" + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `rundll32_shimcache_flush_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://blueteamops.medium.com/shimcache-flush-89daff28d15e +tags: + analytic_story: + - Unusual Processes + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/shimcache_flush/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1112 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Stage:Execution + - Stage:Defense Evasion + message: rundll32 process execute $process$ to clear shim cache in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml new file mode 100644 index 0000000000..8be22cd551 --- /dev/null +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -0,0 +1,64 @@ +name: Suspicious Copy on System32 +id: ce633e56-25b2-11ec-9e76-acde48001122 +version: 1 +date: '2021-10-05' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: this analytic is to detect a suspicious copy of file from systemroot folder of the windows OS. + This technique is commonly used by APT or other malware as part of execution (LOLBIN) to run its malicious code using the available legitimate tool in OS. + this type of event may seen or may execute of normal user in some instance but this is really a anomaly that needs to be check within the network. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.parent_process_name IN("cmd.exe", "powershell*") AND `process_copy` AND Processes.process IN("*\\Windows\\System32\*", "*\\Windows\\SysWow64\\*") AND Processes.process = "*copy*" + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `suspicious_copy_on_system32_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: every user may do this event but very un-ussual. +references: +- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 +tags: + analytic_story: + - Unusual Processes + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1036.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - Stage:Execution + - Stage:Defense Evasion + message: execution of copy exe to copy file from $process$ in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: User + type: User + role: + - Victim \ No newline at end of file diff --git a/macros/process_copy.yml b/macros/process_copy.yml new file mode 100644 index 0000000000..06d1c3b28f --- /dev/null +++ b/macros/process_copy.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=copy.exe OR Processes.original_file_name=copy.exe OR Processes.process_name=xcopy.exe OR Processes.original_file_name=xcopy.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_copy \ No newline at end of file diff --git a/tests/endpoint/disable_security_logs_using_minint_registry.test.yml b/tests/endpoint/disable_security_logs_using_minint_registry.test.yml new file mode 100644 index 0000000000..b54ddced69 --- /dev/null +++ b/tests/endpoint/disable_security_logs_using_minint_registry.test.yml @@ -0,0 +1,12 @@ +name: Disable Security Logs Using MiniNt Registry Unit Test +tests: +- name: Disable Security Logs Using MiniNt Registry + file: endpoint/disable_security_logs_using_minint_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/enable_wdigest_uselogoncredential_registry.test.yml b/tests/endpoint/enable_wdigest_uselogoncredential_registry.test.yml new file mode 100644 index 0000000000..735c79499f --- /dev/null +++ b/tests/endpoint/enable_wdigest_uselogoncredential_registry.test.yml @@ -0,0 +1,12 @@ +name: Enable WDigest UseLogonCredential Registry Unit Test +tests: +- name: Enable WDigest UseLogonCredential Registry + file: endpoint/enable_wdigest_uselogoncredential_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/wdigest_enable/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/rundll32_shimcache_flush.test.yml b/tests/endpoint/rundll32_shimcache_flush.test.yml new file mode 100644 index 0000000000..2a416381a6 --- /dev/null +++ b/tests/endpoint/rundll32_shimcache_flush.test.yml @@ -0,0 +1,12 @@ +name: Rundll32 Shimcache Flush Unit Test +tests: +- name: Rundll32 Shimcache Flush + file: endpoint/rundll32_shimcache_flush.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/shimcache_flush/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_copy_on_system32.test.yml b/tests/endpoint/suspicious_copy_on_system32.test.yml new file mode 100644 index 0000000000..918c57dd1b --- /dev/null +++ b/tests/endpoint/suspicious_copy_on_system32.test.yml @@ -0,0 +1,12 @@ +name: Suspicious Copy on System32 Unit Test +tests: +- name: Suspicious Copy on System32 + file: endpoint/suspicious_copy_on_system32.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 1304e38f5ad0a188ca40e2cf7ab191380a22eb86 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 5 Oct 2021 11:50:49 +0000 Subject: [PATCH 28/40] Added detection testing service results inSuspicious Copy on System32 --- .../endpoint/suspicious_copy_on_system32.yml | 41 ++++++++++--------- 1 file changed, 22 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index 8be22cd551..fce0614870 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -6,22 +6,25 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: this analytic is to detect a suspicious copy of file from systemroot folder of the windows OS. - This technique is commonly used by APT or other malware as part of execution (LOLBIN) to run its malicious code using the available legitimate tool in OS. - this type of event may seen or may execute of normal user in some instance but this is really a anomaly that needs to be check within the network. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.parent_process_name IN("cmd.exe", "powershell*") AND `process_copy` AND Processes.process IN("*\\Windows\\System32\*", "*\\Windows\\SysWow64\\*") AND Processes.process = "*copy*" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` +description: this analytic is to detect a suspicious copy of file from systemroot + folder of the windows OS. This technique is commonly used by APT or other malware + as part of execution (LOLBIN) to run its malicious code using the available legitimate + tool in OS. this type of event may seen or may execute of normal user in some instance + but this is really a anomaly that needs to be check within the network. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name + IN("cmd.exe", "powershell*") AND `process_copy` AND Processes.process IN("*\\Windows\\System32\*", + "*\\Windows\\SysWow64\\*") AND Processes.process = "*copy*" by Processes.dest Processes.user + Processes.parent_process_name Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `suspicious_copy_on_system32_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: every user may do this event but very un-ussual. references: -- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 +- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 tags: analytic_story: - Unusual Processes @@ -37,17 +40,16 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint impact: 70 confidence: 90 - # (impact * confidence)/100 risk_score: 63 context: - Stage:Execution @@ -61,4 +63,5 @@ tags: - name: User type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 457fc3c73ae361878c7f523274e65c26a24006d4 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 5 Oct 2021 12:11:12 +0000 Subject: [PATCH 29/40] Added detection testing service results inRundll32 Shimcache Flush --- .../endpoint/rundll32_shimcache_flush.yml | 41 ++++++++++--------- 1 file changed, 21 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml index 5b2bc12cb0..fccda13479 100644 --- a/detections/endpoint/rundll32_shimcache_flush.yml +++ b/detections/endpoint/rundll32_shimcache_flush.yml @@ -6,23 +6,24 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious rundll32 commandline to clear shim cache. - This technique is a anti-forensic technique to clear the cache taht are one important artifacts in terms of digital forensic during attacks or incident. - This TTP is a good indicator that someone tries to evade some tools and clear foothold on the machine. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_rundll32` AND Processes.process = "*apphelp.dll,ShimFlushCache*" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytic is to detect a suspicious rundll32 commandline to clear + shim cache. This technique is a anti-forensic technique to clear the cache taht + are one important artifacts in terms of digital forensic during attacks or incident. + This TTP is a good indicator that someone tries to evade some tools and clear foothold + on the machine. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_rundll32` AND Processes.process + = "*apphelp.dll,ShimFlushCache*" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_shimcache_flush_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown references: -- https://blueteamops.medium.com/shimcache-flush-89daff28d15e +- https://blueteamops.medium.com/shimcache-flush-89daff28d15e tags: analytic_story: - Unusual Processes @@ -38,17 +39,16 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - Stage:Execution @@ -62,4 +62,5 @@ tags: - name: User type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From ca610d934fd150da49d929666827cb5234a3bd38 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 5 Oct 2021 13:07:19 +0000 Subject: [PATCH 30/40] Added detection testing service results inEnable WDigest UseLogonCredential Registry --- ...le_wdigest_uselogoncredential_registry.yml | 43 ++++++++++--------- 1 file changed, 22 insertions(+), 21 deletions(-) diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index 378b82d273..d72f368b88 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -6,23 +6,24 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious registry modification to enable plain text credential feature of windows. - This technique was used by several malware and also by mimikatz to be able to dumpe the a plain text credential to the compromised or target host. - This TTP is really a good indicator that someone wants to dump the crendential of the host so it must be a good pivot for credential dumping techniques. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" - Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data = 0x00000001 - by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `enable_wdigest_uselogoncredential_registry_filter`' +description: This analytic is to detect a suspicious registry modification to enable + plain text credential feature of windows. This technique was used by several malware + and also by mimikatz to be able to dumpe the a plain text credential to the compromised + or target host. This TTP is really a good indicator that someone wants to dump the + crendential of the host so it must be a good pivot for credential dumping techniques. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" + Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data + = 0x00000001 by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name + Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `enable_wdigest_uselogoncredential_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown references: -- https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html +- https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html tags: analytic_story: - Credential Dumping @@ -39,21 +40,20 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.dest - - Registry.user - - Registry.registry_value_name - - Registry.registry_key_name - - Registry.registry_path - - Registry.registry_value_data + - Registry.dest + - Registry.user + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - Source:Endpoint - Stage:Credential Access - message: wdigest registry $registry_path$ was modified in $dest$ + message: wdigest registry $registry_path$ was modified in $dest$ observable: - name: user type: User @@ -62,4 +62,5 @@ tags: - name: dest type: Hostname role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 9079efb69212895a982fcfee5adb56bd40a6999e Mon Sep 17 00:00:00 2001 From: root Date: Tue, 5 Oct 2021 14:00:35 +0000 Subject: [PATCH 31/40] Added detection testing service results inDisable Security Logs Using MiniNt Registry --- ...le_security_logs_using_minint_registry.yml | 37 +++++++++---------- 1 file changed, 18 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index b5f50ac0b3..11f3ccaf5a 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -6,19 +6,19 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: THis analytic is to detect a suspicious registry modification to disable security audit logs. - This technique was shared by a researcher to disable Security logs of windows by adding this registry. - The Windows will think it is WinPE and will not log any event to the Security Log -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - where Registry.registry_path="*\\Control\\MiniNt\\*" - by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `disable_security_logs_using_minint_registry_filter`' +description: THis analytic is to detect a suspicious registry modification to disable + security audit logs. This technique was shared by a researcher to disable Security + logs of windows by adding this registry. The Windows will think it is WinPE and + will not log any event to the Security Log +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control\\MiniNt\\*" + by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name + Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `disable_security_logs_using_minint_registry_filter`' how_to_implement: UPDATE_HOW_TO_IMPLEMENT known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES references: -- https://twitter.com/0gtweet/status/1182516740955226112 +- https://twitter.com/0gtweet/status/1182516740955226112 tags: analytic_story: - Windows Defense Evasion Tactics @@ -34,21 +34,20 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.dest - - Registry.user - - Registry.registry_value_name - - Registry.registry_key_name - - Registry.registry_path - - Registry.registry_value_data + - Registry.dest + - Registry.user + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data security_domain: endpoint impact: 80 confidence: 100 - # (impact * confidence)/100 risk_score: 80 context: - Source:Endpoint - Stage:Defense Evasion - message: wdigest registry $registry_path$ was added in $dest$ + message: wdigest registry $registry_path$ was added in $dest$ observable: - name: user type: User @@ -58,4 +57,4 @@ tags: type: Hostname role: - Victim - \ No newline at end of file + automated_detection_testing: passed From fb296c850889f1dffcc176019952ca93d017b3b6 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 6 Oct 2021 11:15:47 +0200 Subject: [PATCH 32/40] privilege_escalation_persistence --- .../sdelete_application_execution.yml | 68 ++++++++++++++++++ ...pt_or_cscript_suspicious_child_process.yml | 72 +++++++++++++++++++ macros/process_sdelete.yml | 3 + .../sdelete_application_execution.test.yml | 12 ++++ ..._cscript_suspicious_child_process.test.yml | 12 ++++ 5 files changed, 167 insertions(+) create mode 100644 detections/endpoint/sdelete_application_execution.yml create mode 100644 detections/endpoint/wscript_or_cscript_suspicious_child_process.yml create mode 100644 macros/process_sdelete.yml create mode 100644 tests/endpoint/sdelete_application_execution.test.yml create mode 100644 tests/endpoint/wscript_or_cscript_suspicious_child_process.test.yml diff --git a/detections/endpoint/sdelete_application_execution.yml b/detections/endpoint/sdelete_application_execution.yml new file mode 100644 index 0000000000..0048240c1a --- /dev/null +++ b/detections/endpoint/sdelete_application_execution.yml @@ -0,0 +1,68 @@ +name: Sdelete Application Execution +id: 31702fc0-2682-11ec-85c3-acde48001122 +version: 1 +date: '2021-10-06' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect the execution of sdelete.exe application sysinternal tools. + This tool is one of the most use tool of malware and adversaries to remove or clear their tracks and artifact in the targetted host. + This tool is designed to delete securely a file in file system that remove the forensic evidence on the machine. A good TTP query to check why user + execute this application which is not a common practice. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.parent_process) as parent_process values(Processes.process_id) + as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_sdelete` by Processes.process_name Processes.original_file_name + Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `sdelete_application_execution_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: user may execute and use this application +references: +- https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/ +tags: + analytic_story: + - Masquerading - Rename System Utilities + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1485 + - T1070.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Execution + message: sdelete process $process_name$ executed in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml new file mode 100644 index 0000000000..9138639a44 --- /dev/null +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -0,0 +1,72 @@ +name: Wscript Or Cscript Suspicious Child Process +id: 1f35e1da-267b-11ec-90a9-acde48001122 +version: 1 +date: '2021-10-06' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious spawned process by wscript or cscript process. + This technique was a common technique used by adversaries and malware to execute different LOLBIN, other script like powershell or create a suspended + process to inject its code as a defense evasion. This TTP may detect some normal script that using several application tool that are in the list + of the child process it detects but a good pivot and indicator that a script is may execute suspicious code. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("cscript.exe", "wscript.exe") + Processes.process_name IN ("regsvr32.exe", "rundll32.exe","winhlp32.exe","certutil.exe","msbuild.exe","cmd.exe","powershell*","wmic.exe","mshta.exe") + by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `wscript_or_cscript_suspicious_child_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: user may create vbs or js script that use several tool as part of its execution. +references: +- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 +tags: + analytic_story: + - FIN7 + - Remcos + - Unusual Processes + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + - T1543 + - T1134.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Execution + message: wscript or cscript parent process spawned $process_name$ in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + \ No newline at end of file diff --git a/macros/process_sdelete.yml b/macros/process_sdelete.yml new file mode 100644 index 0000000000..2a5bc306d6 --- /dev/null +++ b/macros/process_sdelete.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=sdelete.exe OR Processes.original_file_name=sdelete.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_sdelete \ No newline at end of file diff --git a/tests/endpoint/sdelete_application_execution.test.yml b/tests/endpoint/sdelete_application_execution.test.yml new file mode 100644 index 0000000000..e86bfc34a9 --- /dev/null +++ b/tests/endpoint/sdelete_application_execution.test.yml @@ -0,0 +1,12 @@ +name: Sdelete Application Execution Unit Test +tests: +- name: Sdelete Application Execution + file: endpoint/sdelete_application_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/wscript_or_cscript_suspicious_child_process.test.yml b/tests/endpoint/wscript_or_cscript_suspicious_child_process.test.yml new file mode 100644 index 0000000000..9b99129f6d --- /dev/null +++ b/tests/endpoint/wscript_or_cscript_suspicious_child_process.test.yml @@ -0,0 +1,12 @@ +name: Wscript Or Cscript Suspicious Child Process Unit Test +tests: +- name: Wscript Or Cscript Suspicious Child Process + file: endpoint/wscript_or_cscript_suspicious_child_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From b910a0565043c17360f8bd054a23ecfa38aae085 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 6 Oct 2021 09:52:34 +0000 Subject: [PATCH 33/40] Added detection testing service results inWscript Or Cscript Suspicious Child Process --- ...pt_or_cscript_suspicious_child_process.yml | 32 ++++++++++--------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index 9138639a44..b1783cbfbb 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -6,26 +6,28 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious spawned process by wscript or cscript process. - This technique was a common technique used by adversaries and malware to execute different LOLBIN, other script like powershell or create a suspended - process to inject its code as a defense evasion. This TTP may detect some normal script that using several application tool that are in the list - of the child process it detects but a good pivot and indicator that a script is may execute suspicious code. +description: This analytic is to detect a suspicious spawned process by wscript or + cscript process. This technique was a common technique used by adversaries and malware + to execute different LOLBIN, other script like powershell or create a suspended + process to inject its code as a defense evasion. This TTP may detect some normal + script that using several application tool that are in the list of the child process + it detects but a good pivot and indicator that a script is may execute suspicious + code. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("cscript.exe", "wscript.exe") - Processes.process_name IN ("regsvr32.exe", "rundll32.exe","winhlp32.exe","certutil.exe","msbuild.exe","cmd.exe","powershell*","wmic.exe","mshta.exe") - by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name + IN ("cscript.exe", "wscript.exe") Processes.process_name IN ("regsvr32.exe", "rundll32.exe","winhlp32.exe","certutil.exe","msbuild.exe","cmd.exe","powershell*","wmic.exe","mshta.exe") + by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wscript_or_cscript_suspicious_child_process_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: user may create vbs or js script that use several tool as part of its execution. + Sysmon TA. +known_false_positives: user may create vbs or js script that use several tool as part + of its execution. references: -- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 +- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 tags: analytic_story: - FIN7 @@ -69,4 +71,4 @@ tags: type: User role: - Victim - \ No newline at end of file + automated_detection_testing: passed From ba99c4cee80cff8d93d2930098f903b99be5fa6d Mon Sep 17 00:00:00 2001 From: root Date: Wed, 6 Oct 2021 10:45:31 +0000 Subject: [PATCH 34/40] Added detection testing service results inSdelete Application Execution --- .../sdelete_application_execution.yml | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/sdelete_application_execution.yml b/detections/endpoint/sdelete_application_execution.yml index 0048240c1a..02de52dbf9 100644 --- a/detections/endpoint/sdelete_application_execution.yml +++ b/detections/endpoint/sdelete_application_execution.yml @@ -6,26 +6,26 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect the execution of sdelete.exe application sysinternal tools. - This tool is one of the most use tool of malware and adversaries to remove or clear their tracks and artifact in the targetted host. - This tool is designed to delete securely a file in file system that remove the forensic evidence on the machine. A good TTP query to check why user - execute this application which is not a common practice. +description: This analytic is to detect the execution of sdelete.exe application sysinternal + tools. This tool is one of the most use tool of malware and adversaries to remove + or clear their tracks and artifact in the targetted host. This tool is designed + to delete securely a file in file system that remove the forensic evidence on the + machine. A good TTP query to check why user execute this application which is not + a common practice. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_sdelete` by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sdelete_application_execution_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: user may execute and use this application references: -- https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/ +- https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/ tags: analytic_story: - Masquerading - Rename System Utilities @@ -65,4 +65,5 @@ tags: - name: user type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 87e17c35055da42141f698151e2aa682c6b0b62f Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 7 Oct 2021 14:53:56 +0200 Subject: [PATCH 35/40] privilege_escalation_persistence --- detections/endpoint/etw_registry_disabled.yml | 65 +++++++++++++++++++ tests/endpoint/etw_registry_disabled.test.yml | 12 ++++ 2 files changed, 77 insertions(+) create mode 100644 detections/endpoint/etw_registry_disabled.yml create mode 100644 tests/endpoint/etw_registry_disabled.test.yml diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml new file mode 100644 index 0000000000..55bd67bb4e --- /dev/null +++ b/detections/endpoint/etw_registry_disabled.yml @@ -0,0 +1,65 @@ +name: ETW Registry Disabled +id: 8ed523ac-276b-11ec-ac39-acde48001122 +version: 1 +date: '2021-10-07' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a registry modification to disable ETW feature of windows. + This technique is to evade EDR appliance to evade detections and hide its execution from audit logs. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*") + Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000 + by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `etw_registry_disabled_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 +tags: + analytic_story: + - Windows Persistence Techniques + - Windows Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/etw_disable/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.006 + - T1127 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.registry_value_data + security_domain: endpoint + impact: 90 + confidence: 100 + risk_score: 90 + context: + - source:endpoint + - stage:Privilege Escalation Persistence + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + \ No newline at end of file diff --git a/tests/endpoint/etw_registry_disabled.test.yml b/tests/endpoint/etw_registry_disabled.test.yml new file mode 100644 index 0000000000..4decd04292 --- /dev/null +++ b/tests/endpoint/etw_registry_disabled.test.yml @@ -0,0 +1,12 @@ +name: ETW Registry Disabled Unit Test +tests: +- name: ETW Registry Disabled + file: endpoint/etw_registry_disabled.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/etw_disable/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 393aad02aa6c5c115517751408162570662d83f9 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 8 Oct 2021 07:55:48 +0000 Subject: [PATCH 36/40] Added detection testing service results inETW Registry Disabled --- detections/endpoint/etw_registry_disabled.yml | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index 55bd67bb4e..f275ee28c4 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -6,22 +6,22 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a registry modification to disable ETW feature of windows. - This technique is to evade EDR appliance to evade detections and hide its execution from audit logs. +description: This analytic is to detect a registry modification to disable ETW feature + of windows. This technique is to evade EDR appliance to evade detections and hide + its execution from audit logs. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*") + max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*") Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000 - by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `etw_registry_disabled_filter`' + by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.registry_value_data | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `etw_registry_disabled_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown references: -- https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 +- https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 tags: analytic_story: - Windows Persistence Techniques @@ -62,4 +62,4 @@ tags: type: user role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 5226dbd99c5fbe87f7ef631f539bf0531cbaa181 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 8 Oct 2021 14:23:55 +0200 Subject: [PATCH 37/40] privilege_escalation_persistence --- .../endpoint/print_processor_registry_autostart.yml | 0 tests/endpoint/print_processor_registry_autostart.test.yml | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) rename detections/{ => experimental}/endpoint/print_processor_registry_autostart.yml (100%) diff --git a/detections/endpoint/print_processor_registry_autostart.yml b/detections/experimental/endpoint/print_processor_registry_autostart.yml similarity index 100% rename from detections/endpoint/print_processor_registry_autostart.yml rename to detections/experimental/endpoint/print_processor_registry_autostart.yml diff --git a/tests/endpoint/print_processor_registry_autostart.test.yml b/tests/endpoint/print_processor_registry_autostart.test.yml index c32f529f1b..0a7ef8f35f 100644 --- a/tests/endpoint/print_processor_registry_autostart.test.yml +++ b/tests/endpoint/print_processor_registry_autostart.test.yml @@ -1,7 +1,7 @@ name: Print Processor Registry Autostart Unit Test tests: - name: Print Processor Registry Autostart - file: endpoint/print_processor_registry_autostart.yml + file: experimental/endpoint/print_processor_registry_autostart.yml pass_condition: '| stats count | where count > 0' earliest_time: '-365d' latest_time: 'now' From f6804d708ba47507414e437ffb6167a9e40769ec Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 8 Oct 2021 12:33:23 -0600 Subject: [PATCH 38/40] Fixes and removed duplicate --- .../active_setup_registry_autostart.yml | 6 +- ...le_security_logs_using_minint_registry.yml | 21 ++++--- ...le_wdigest_uselogoncredential_registry.yml | 10 +-- detections/endpoint/etw_registry_disabled.yml | 10 +-- .../logon_script_event_trigger_execution.yml | 3 +- ...d_suspicious_spawned_by_script_process.yml | 16 +++-- .../endpoint/powershell_reflective_load.yml | 61 ------------------- .../regsvr32_silent_param_dll_loading.yml | 5 +- .../endpoint/rundll32_shimcache_flush.yml | 17 +++--- .../sdelete_application_execution.yml | 19 +++--- .../endpoint/suspicious_copy_on_system32.yml | 19 +++--- .../vbscript_execution_using_wscript_app.yml | 19 +++--- .../endpoint/verclsid_clsid_execution.yml | 22 ++++--- ...pt_or_cscript_suspicious_child_process.yml | 16 +++-- 14 files changed, 100 insertions(+), 144 deletions(-) delete mode 100644 detections/endpoint/powershell_reflective_load.yml diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index b90601b450..11492c7e1a 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -19,13 +19,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTim Components*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `active_setup_registry_autostart_filter`' -how_to_implement: UPDATE_HOW_To successfully implement this search, you must be ingesting +how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes - to the registry.TO_IMPLEMENT -known_false_positives: active setup installer may add or modify this registry + to the registry. +known_false_positives: Active setup installer may add or modify this registry. references: - https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E - https://attack.mitre.org/techniques/T1547/014/ diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index 11f3ccaf5a..b73414b69a 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: THis analytic is to detect a suspicious registry modification to disable +description: This analytic is to detect a suspicious registry modification to disable security audit logs. This technique was shared by a researcher to disable Security logs of windows by adding this registry. The Windows will think it is WinPE and will not log any event to the Security Log @@ -15,8 +15,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTim by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_security_logs_using_minint_registry_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: To successfully implement this search, you must be ingesting + data that records registry activity from your hosts to populate the endpoint data + model in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: Unknown. references: - https://twitter.com/0gtweet/status/1182516740955226112 tags: @@ -47,14 +52,14 @@ tags: context: - Source:Endpoint - Stage:Defense Evasion - message: wdigest registry $registry_path$ was added in $dest$ + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ observable: - - name: user - type: User - role: - - Victim - name: dest type: Hostname role: - Victim + - name: user + type: user + role: + - Victim automated_detection_testing: passed diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index d72f368b88..9f23806bae 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -17,10 +17,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTim = 0x00000001 by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `enable_wdigest_uselogoncredential_registry_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: To successfully implement this search, you must be ingesting + data that records registry activity from your hosts to populate the endpoint data + model in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. known_false_positives: unknown references: - https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index f275ee28c4..c129367c35 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -15,10 +15,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTim by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `etw_registry_disabled_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: To successfully implement this search, you must be ingesting + data that records registry activity from your hosts to populate the endpoint data + model in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. known_false_positives: unknown references: - https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml index d27bdca08a..e881970354 100644 --- a/detections/endpoint/logon_script_event_trigger_execution.yml +++ b/detections/endpoint/logon_script_event_trigger_execution.yml @@ -9,8 +9,7 @@ datamodel: description: This search is to detect a suspicious modification of registry entry to persist and gain privilege escalation upon booting up of compromised host. This technique was seen in several APT and malware where it modify UserInitMprLogonScript - registry entry to its malicious payload to be executed upon boot up of the machine - since this is a + registry entry to its malicious payload to be executed upon boot up of the machine. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Environment\\UserInitMprLogonScript") by Registry.dest Registry.user Registry.registry_path diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml index a8165b8d65..d0687e4c57 100644 --- a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml +++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml @@ -6,11 +6,12 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspicious msbuild process by MS scripting - process. This behavior or event are commonly seen and used by malware or adversaries +description: This analytic is to detect a suspicious child process of MSBuild + spawned by Windows Script Host - cscript or wscript. + This behavior or event are commonly seen and used by malware or adversaries to execute malicious msbuild process using malicious script in the compromised host. - This behavior is not common and can be a good indicator to start checking the content - of the script that execute the said msbuild process. + During triage, review parallel processes and identify any file modifications. MSBuild + may load a script from the same path without having command-line arguments. search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name @@ -18,11 +19,8 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msbuild_suspicious_spawned_by_script_process_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: unknown +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives should be limited as developers do not spawn MSBuild via a WSH. references: - https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# tags: diff --git a/detections/endpoint/powershell_reflective_load.yml b/detections/endpoint/powershell_reflective_load.yml deleted file mode 100644 index ae5a966426..0000000000 --- a/detections/endpoint/powershell_reflective_load.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Powershell Reflective Load -id: 8aa0d0a2-24f4-11ec-b77a-acde48001122 -version: 1 -date: '2021-10-04' -author: Teoderick Contreras, Splunk -type: TTP -datamodel: -- Endpoint -description: This analytic is to detect a suspicious powershell loading a dll or executable - using reflective load function. this technique is commonly seen in file less malware - where it download a file and directly load the downloaded file that are place in - a stream memory to execute it. this TTP is a good indicator to check the powershell - that execute and what file or stream it execute. -search: '`powershell` EventCode=4104 Message = "*[Reflection.Assembly]::Load*" | stats - count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName - User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `powershell_reflective_load_filter`' -how_to_implement: o successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: third party powershell may use this function to execute binary. -references: -- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# -tags: - analytic_story: - - Malicious PowerShell - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/powershell.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1059.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - EventCode - - Message - - ComputerName - - User - security_domain: endpoint - impact: 70 - confidence: 70 - risk_score: 49 - context: - - source:endpoint - - stage: Defense Evasion - message: a powershell that execute binary using reflective load in command $Message$ - in $ComputerName$ - observable: - - name: ComputerName - type: Hostname - role: - - Victim - - name: User - type: User - role: - - Victim - automated_detection_testing: passed diff --git a/detections/endpoint/regsvr32_silent_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_param_dll_loading.yml index c9d0d3b0cc..d27c7425aa 100644 --- a/detections/endpoint/regsvr32_silent_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_param_dll_loading.yml @@ -22,10 +22,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: other third part application may used this parameter but not - so common in base windows environment +known_false_positives: Other third part application may used this parameter but not + so common in base windows environment. references: - https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# +- https://attack.mitre.org/techniques/T1218/010/ tags: analytic_story: - Suspicious Regsvr32 Activity diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml index fccda13479..d4e0993b51 100644 --- a/detections/endpoint/rundll32_shimcache_flush.yml +++ b/detections/endpoint/rundll32_shimcache_flush.yml @@ -14,13 +14,10 @@ description: This analytic is to detect a suspicious rundll32 commandline to cle search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` AND Processes.process = "*apphelp.dll,ShimFlushCache*" by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_shimcache_flush_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: unknown references: - https://blueteamops.medium.com/shimcache-flush-89daff28d15e @@ -41,10 +38,14 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline - Processes.process_id + - Processes.parent_process_path + - Processes.process_path - Processes.parent_process_id security_domain: endpoint impact: 80 diff --git a/detections/endpoint/sdelete_application_execution.yml b/detections/endpoint/sdelete_application_execution.yml index 02de52dbf9..0ded4ef8bc 100644 --- a/detections/endpoint/sdelete_application_execution.yml +++ b/detections/endpoint/sdelete_application_execution.yml @@ -19,10 +19,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as Processes.dest Processes.user Processes.parent_process_name Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sdelete_application_execution_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: user may execute and use this application references: - https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/ @@ -42,13 +39,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_id - - Processes.process - Processes.dest - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint impact: 70 confidence: 70 diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index fce0614870..3eb05fde0f 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -6,22 +6,19 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: this analytic is to detect a suspicious copy of file from systemroot +description: This analytic is to detect a suspicious copy of file from systemroot folder of the windows OS. This technique is commonly used by APT or other malware as part of execution (LOLBIN) to run its malicious code using the available legitimate tool in OS. this type of event may seen or may execute of normal user in some instance but this is really a anomaly that needs to be check within the network. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - IN("cmd.exe", "powershell*") AND `process_copy` AND Processes.process IN("*\\Windows\\System32\*", + IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe") AND `process_copy` AND Processes.process IN("*\\Windows\\System32\*", "*\\Windows\\SysWow64\\*") AND Processes.process = "*copy*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `suspicious_copy_on_system32_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: every user may do this event but very un-ussual. references: - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 @@ -42,10 +39,14 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline - Processes.process_id + - Processes.parent_process_path + - Processes.process_path - Processes.parent_process_id security_domain: endpoint impact: 70 diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml index 9abcbf230d..5cb1e55d97 100644 --- a/detections/endpoint/vbscript_execution_using_wscript_app.yml +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -18,10 +18,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.parent_process Processes.process_name Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `vbscript_execution_using_wscript_app_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: unknown references: - https://www.joesandbox.com/analysis/369332/0/html @@ -41,13 +38,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_id - - Processes.process - Processes.dest - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint impact: 70 confidence: 70 diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml index 5144212fd7..556ef2e416 100644 --- a/detections/endpoint/verclsid_clsid_execution.yml +++ b/detections/endpoint/verclsid_clsid_execution.yml @@ -19,12 +19,9 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as Processes.dest Processes.user Processes.parent_process_name Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `verclsid_clsid_execution_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: windows can used this application for its normal COm object - validation +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: windows can used this application for its normal COM object + validation. references: - https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5 - https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/ @@ -43,12 +40,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_name - - Processes.original_file_name - Processes.dest - Processes.user - - Processes.parent_process_name - - Processes.parent_process + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint impact: 50 confidence: 50 diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index b1783cbfbb..1d680f7db2 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -47,13 +47,17 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_id - - Processes.process - Processes.dest - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint impact: 70 confidence: 70 @@ -61,7 +65,7 @@ tags: context: - Source:Endpoint - Stage:Execution - message: wscript or cscript parent process spawned $process_name$ in $dest$ + message: wscript or cscript parent process spawned $process_name$ in $dest$ observable: - name: dest type: Endpoint From 69d72deb158c03bf2d0084e66e4dc96453bec317 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 8 Oct 2021 12:37:20 -0600 Subject: [PATCH 39/40] Delete powershell_reflective_load.test.yml --- tests/endpoint/powershell_reflective_load.test.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 tests/endpoint/powershell_reflective_load.test.yml diff --git a/tests/endpoint/powershell_reflective_load.test.yml b/tests/endpoint/powershell_reflective_load.test.yml deleted file mode 100644 index 167a524ebc..0000000000 --- a/tests/endpoint/powershell_reflective_load.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Powershell Reflective Load Unit Test -tests: -- name: Powershell Reflective Load - file: endpoint/powershell_reflective_load.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog \ No newline at end of file From 95ad76f9bafedecb10928aedf9c92eb8c87dc13f Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 11 Oct 2021 12:17:40 -0600 Subject: [PATCH 40/40] Update suspicious_wevtutil_usage.yml Resolving #1669 . Thank you! --- .../endpoint/suspicious_wevtutil_usage.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index 61f5a11927..4c32b8f3d4 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -1,18 +1,18 @@ name: Suspicious wevtutil Usage id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f -version: 3 -date: '2020-07-22' -author: David Dorsey, Splunk +version: 4 +date: '2021-10-11' +author: David Dorsey, Michael Haag, Splunk type: TTP datamodel: - Endpoint description: The wevtutil.exe application is the windows event log utility. This searches - for wevtutil.exe with parameters for clearing the application, security, setup, + for wevtutil.exe with parameters for clearing the application, security, setup, trace or system event logs. search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = wevtutil.exe Processes.process="*cl*" (Processes.process="*System*" - OR Processes.process="*Security*" OR Processes.process="*Setup*" OR Processes.process="*Application*") + where Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*") (Processes.process="*System*" + OR Processes.process="*Security*" OR Processes.process="*Setup*" OR Processes.process="*Application*" OR Processes.process="*trace*") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `suspicious_wevtutil_usage_filter`' @@ -23,13 +23,13 @@ how_to_implement: You must be ingesting data that records process activity from model. known_false_positives: The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md tags: analytic_story: - Windows Log Manipulation - Ransomware - Clop Ransomware - asset_type: '' automated_detection_testing: passed cis20: - CIS 3