From eb39fe5937b4e27309cff27dd315d9e899afcd4a Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 5 Oct 2021 09:50:13 -0600 Subject: [PATCH] Updated PowerShell and Exchange Web Shell --- .../endpoint/detect_exchange_web_shell.yml | 24 ++++--- ...connect_to_internet_with_hidden_window.yml | 64 +++++++++---------- ...s_powershell_process___encoded_command.yml | 23 ++++--- 3 files changed, 58 insertions(+), 53 deletions(-) diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index bfbd39056f..2a83c2cf81 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -1,8 +1,8 @@ name: Detect Exchange Web Shell id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a -version: 2 -date: '2021-03-09' -author: Michael Haag, Shannon Davis, Splunk +version: 3 +date: '2021-10-05' +author: Michael Haag, Shannon Davis, David Dorsey, Splunk type: TTP datamodel: - Endpoint @@ -12,7 +12,13 @@ description: 'The following query identifies suspicious .aspx created in 3 paths `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and - other potential exploitation.' + other potential exploitation. + It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. + Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. + Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. + A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. + If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. + However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant.' search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=System by _time span=1h Processes.process_id Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| @@ -31,10 +37,10 @@ known_false_positives: The query is structured in a way that `action` (read, cre is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product. references: -- https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv -- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell -- https://www.youtube.com/watch?v=FC6iHw258RI -- https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do + - https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv + - https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell + - https://www.youtube.com/watch?v=FC6iHw258RI + - https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do tags: analytic_story: - HAFNIUM Group @@ -79,4 +85,4 @@ tags: - Filesystem.file_hash - Filesystem.user risk_score: 81 - security_domain: endpoint + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml index 72c9271cdf..7b5444fb72 100644 --- a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml @@ -1,32 +1,34 @@ name: Malicious PowerShell Process - Connect To Internet With Hidden Window id: ee18ed37-0802-4268-9435-b3b91aaa18db -version: 6 -date: '2020-11-20' -author: David Dorsey, Splunk -type: TTP +version: 7 +date: '2021-10-05' +author: David Dorsey, Michael Haag Splunk +type: Hunting datamodel: -- Endpoint -description: This search looks for PowerShell processes started with parameters to - modify the execution policy of the run, run in a hidden window, and connect to the - Internet. This combination of command-line options is suspicious because it's overriding - the default PowerShell execution policy, attempts to hide its activity from the - user, and connects to the Internet. Deprecated becaue hidden is not needed when - download file with System.Net.WebClient. -search: '| tstats `security_content_summariesonly` count values(Processes.process) - as process values(Processes.parent_process) as parent_process min(_time) as firstTime - max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` - Processes.process=*-WindowStyle* Processes.process=*hidden* Processes.process="*New-Object*" - by Processes.user Processes.process_name Processes.original_file_name Processes.parent_process_name - Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. + - Endpoint +description: 'The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. + Removed in this version of the query is New-Object. + The analytic identifies all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user + Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | where match(process,"(?i)[\-|\/|–|—|―]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]") + | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter`' +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. known_false_positives: Legitimate process can have this combination of command-line options, but it's not common. -references: [] +references: + - https://regexr.com/663rr + - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1 + - https://ss64.com/ps/powershell.html + - https://twitter.com/M_haggis/status/1440758396534214658?s=20 tags: analytic_story: - Malicious PowerShell @@ -77,16 +79,10 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest + - Processes.process + - Processes.process_name - Processes.user - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Processes.dest risk_score: 81 - security_domain: endpoint + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index e5242cc6de..0c9e87b655 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -1,22 +1,25 @@ name: Malicious PowerShell Process - Encoded Command id: c4db14d9-7909-48b4-a054-aa14d89dbb19 -version: 5 -date: '2021-09-22' +version: 6 +date: '2021-10-05' author: David Dorsey, Michael Haag, Splunk type: Hunting datamodel: -- Endpoint -description: The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code. - The analytic identifies all variations of EncodedCommand, as PowerShell allows the ability to shorten the parameter. For example enc, enco, encod and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. - During triage, review parallel events to determine legitimacy. Tune as needed based on admin scripts in use. + - Endpoint +description: 'The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code. \ + + The analytic identifies all variations of EncodedCommand, as PowerShell allows the ability to shorten the parameter. For example enc, enco, encod and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. \ + + During triage, review parallel events to determine legitimacy. Tune as needed based on admin scripts in use. \ + + Alternatively, may use regex per matching here https://regexr.com/662ov.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_powershell` - by Processes.user + as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id - | regex Processes.process="[\-|\/|–|—|―][Ee^]{1,2}[NnCcOoDdEeMmAa^]+\s+[A-Za-z0-9+/=]{5,}" | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | where match(process,"(?i)[\-|\/|–|—|―]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]") | `malicious_powershell_process___encoded_command_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: System administrators may use this option, but it's not common. @@ -72,4 +75,4 @@ tags: - Processes.dest - Processes.process_id risk_score: 35 - security_domain: endpoint + security_domain: endpoint \ No newline at end of file