Updated PowerShell and Exchange Web Shell

detections/endpoint/detect_exchange_web_shell.yml

@@ -1,8 +1,8 @@
 name: Detect Exchange Web Shell
 id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a
-version: 2
-date: '2021-03-09'
-author: Michael Haag, Shannon Davis, Splunk
+version: 3
+date: '2021-10-05'
+author: Michael Haag, Shannon Davis, David Dorsey, Splunk
 type: TTP
 datamodel:
 - Endpoint
@@ -12,7 +12,13 @@ description: 'The following query identifies suspicious .aspx created in 3 paths
   `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious
   .aspx file will likely look obvious on the surface. inspect the contents for script
   code inside. Identify additional log sources, IIS included, to review source and
-  other potential exploitation.'
+  other potential exploitation. 
+  It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. 
+  Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. 
+  Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. 
+  A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. 
+  If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. 
+  However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant.'
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where Processes.process_name=System  by _time span=1h Processes.process_id Processes.process_name
   Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
@@ -31,10 +37,10 @@ known_false_positives: The query is structured in a way that `action` (read, cre
   is not defined. Review the results of this query, filter, and tune as necessary.
   It may be necessary to generate this query specific to your endpoint product.
 references:
-- https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv
-- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
-- https://www.youtube.com/watch?v=FC6iHw258RI
-- https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do
+  - https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv
+  - https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
+  - https://www.youtube.com/watch?v=FC6iHw258RI
+  - https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do
 tags:
   analytic_story:
   - HAFNIUM Group
@@ -79,4 +85,4 @@ tags:
   - Filesystem.file_hash
   - Filesystem.user
   risk_score: 81
-  security_domain: endpoint
+  security_domain: endpoint

detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml

@@ -1,32 +1,34 @@
 name: Malicious PowerShell Process - Connect To Internet With Hidden Window
 id: ee18ed37-0802-4268-9435-b3b91aaa18db
-version: 6
-date: '2020-11-20'
-author: David Dorsey, Splunk
-type: TTP
+version: 7
+date: '2021-10-05'
+author: David Dorsey, Michael Haag Splunk
+type: Hunting
 datamodel:
-- Endpoint
-description: This search looks for PowerShell processes started with parameters to
-  modify the execution policy of the run, run in a hidden window, and connect to the
-  Internet. This combination of command-line options is suspicious because it's overriding
-  the default PowerShell execution policy, attempts to hide its activity from the
-  user, and connects to the Internet. Deprecated becaue hidden is not needed when
-  download file with System.Net.WebClient.
-search: '| tstats `security_content_summariesonly` count values(Processes.process)
-  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell`
-  Processes.process=*-WindowStyle* Processes.process=*hidden* Processes.process="*New-Object*"
-  by Processes.user Processes.process_name Processes.original_file_name Processes.parent_process_name
-  Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  - Endpoint
+description: 'The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. 
+  Removed in this version of the query is New-Object.
+  The analytic identifies all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+    as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user
+    Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | where match(process,"(?i)[\-|\/|–|—|―]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]")
+  | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter`'
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
 known_false_positives: Legitimate process can have this combination of command-line
   options, but it's not common.
-references: []
+references: 
+  - https://regexr.com/663rr
+  - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
+  - https://ss64.com/ps/powershell.html
+  - https://twitter.com/M_haggis/status/1440758396534214658?s=20
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -77,16 +79,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest
+  - Processes.process
+  - Processes.process_name
   - Processes.user
   - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Processes.dest
   risk_score: 81
-  security_domain: endpoint
+  security_domain: endpoint

detections/endpoint/malicious_powershell_process___encoded_command.yml

@@ -1,22 +1,25 @@
 name: Malicious PowerShell Process - Encoded Command
 id: c4db14d9-7909-48b4-a054-aa14d89dbb19
-version: 5
-date: '2021-09-22'
+version: 6
+date: '2021-10-05'
 author: David Dorsey, Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint
-description: The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code. 
-  The analytic identifies all variations of EncodedCommand, as PowerShell allows the ability to shorten the parameter. For example enc, enco, encod and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
-  During triage, review parallel events to determine legitimacy. Tune as needed based on admin scripts in use.
+  - Endpoint
+description: 'The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code. \
+  
+  The analytic identifies all variations of EncodedCommand, as PowerShell allows the ability to shorten the parameter. For example enc, enco, encod and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. \
+  
+  During triage, review parallel events to determine legitimacy. Tune as needed based on admin scripts in use. \
+  
+  Alternatively, may use regex per matching here https://regexr.com/662ov.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_powershell`
-  by Processes.user
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user
   Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id 
-  | regex Processes.process="[\-|\/|–|—|―][Ee^]{1,2}[NnCcOoDdEeMmAa^]+\s+[A-Za-z0-9+/=]{5,}" 
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`
+  | where match(process,"(?i)[\-|\/|–|—|―]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]")
   | `malicious_powershell_process___encoded_command_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: System administrators may use this option, but it's not common.
@@ -72,4 +75,4 @@ tags:
   - Processes.dest
   - Processes.process_id
   risk_score: 35
-  security_domain: endpoint
+  security_domain: endpoint