Branch was auto-updated.

detections/endpoint/lolbas_with_network_traffic.yml

@@ -0,0 +1,146 @@
+name: LOLBAS With Network Traffic
+id: 2820f032-19eb-497e-8642-25b04a880359
+version: 1
+date: '2021-12-09'
+author: Steven Dick
+type: TTP
+datamodel:
+- Network_Traffic
+- Endpoint
+description: 'The following analytic identifies LOLBAS with network traffic. 
+When adversaries abuse LOLBAS they are often used to download malicious code or executables. 
+The LOLBAS project documents Windows native binaries that can be abused by threat actors to 
+perform tasks like downloading malicious code. Looking for these process can help defenders 
+identify lateral movement, command-and-control, or exfiltration activies.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where (All_Traffic.app IN ("*Regsvcs.exe",
+"*\\Ftp.exe",
+"*OfflineScannerShell.exe",
+"*Rasautou.exe",
+"*Schtasks.exe",
+"*Xwizard.exe",
+"*Pnputil.exe",
+"*Atbroker.exe",
+"*Pcwrun.exe",
+"*Ttdinject.exe",
+"*Mshta.exe",
+"*Bitsadmin.exe",
+"*Certoc.exe",
+"*Ieexec.exe",
+"*Microsoft.Workflow.Compiler.exe",
+"*Runscripthelper.exe",
+"*Forfiles.exe",
+"*Msbuild.exe",
+"*Register-cimprovider.exe",
+"*Tttracer.exe",
+"*Ie4uinit.exe",
+"*Bash.exe",
+"*Hh.exe",
+"*SettingSyncHost.exe",
+"*Cmstp.exe",
+"*Stordiag.exe",
+"*Scriptrunner.exe",
+"*Odbcconf.exe",
+"*Extexport.exe",
+"*Msdt.exe",
+"*WorkFolders.exe",
+"*Diskshadow.exe",
+"*Mavinject.exe",
+"*Regasm.exe",
+"*Gpscript.exe",
+"*Regsvr32.exe",
+"*Msiexec.exe",
+"*Wuauclt.exe",
+"*Presentationhost.exe",
+"*Wmic.exe",
+"*Runonce.exe",
+"*Syncappvpublishingserver.exe",
+"*Verclsid.exe",
+"*Infdefaultinstall.exe",
+"*Installutil.exe",
+"*Netsh.exe",
+"*Wab.exe",
+"*Dnscmd.exe",
+"*\\At.exe",
+"*Pcalua.exe",
+"*Msconfig.exe",
+"*makecab.exe",
+"*cscript.exe",
+"*notepad.exe",
+"*\\cmd.exe",
+"*certutil.exe",
+"*\\powershell.exe",
+"*powershell_ise.exe")) by All_Traffic.app,All_Traffic.src,All_Traffic.src_ip,All_Traffic.user,All_Traffic.dest,All_Traffic.dest_ip
+| `drop_dm_object_name(All_Traffic)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`
+| rex field=app ".*\\\(?<process_name>.*)$"
+| rename app as process
+| `lolbas_with_network_traffic_filter`'
+how_to_implement: 'To successfully implement this detection you must ingest events into the Network
+traffic data model that contain the source, destination, and communicating process in the app feild. 
+Relevant processes must also be ingested in the Endpoint data model with matching process_id feild.
+Sysmon EID1 and EID3 are good examples of this type this data type.'
+known_false_positives: 'Legitmate usage of internal automation or scripting, espically powershell.exe internal to internal or logon scripts.
+It may be necessary to omit internal IP ranges if extremely noisy. ie NOT dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","170.98.0.0/16","0:0:0:0:0:0:0:1")
+'
+references:
+- https://lolbas-project.github.io/#
+- https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/
+tags:
+  analytic_story:
+  - Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 4
+  - CIS 6
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  - Command & Control
+  - Actions on Objectives
+  message: The LOLBAS $process_name$ on device $src$ was seen communicating with $dest$.
+  mitre_attack_id:
+  - T1105
+  - T1567
+  - T1218
+  nist:
+  - DE.AE
+  - DE.CM
+  observable:
+  - name: src
+    type: Hostname
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.user
+  - Processes.process_id
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_path
+  - Processes.dest 
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_guid
+  - All_Traffic.app
+  - All_Traffic.src
+  - All_Traffic.src_ip
+  - All_Traffic.dest
+  - All_Traffic.dest_ip
+  - All_Traffic.process_id
+  risk_score: 25
+  security_domain: network

detections/endpoint/office_application_drop_executable.yml

@@ -1,8 +1,8 @@
 name: Office Application Drop Executable
 id: 73ce70c4-146d-11ec-9184-acde48001122
-version: 2
+version: 3
 date: '2023-01-24'
-author: Teoderick Contreras, Michael Haag Splunk
+author: Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github
 type: TTP
 datamodel:
 - Endpoint
@@ -15,15 +15,14 @@ description: This search is to detect a suspicious MS office application that dr
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe")
   by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
-  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
-  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
+  Processes.process_guid | `drop_dm_object_name(Processes)` |join process_guid, _time [| tstats `security_content_summariesonly` count
   min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
   where Filesystem.file_name IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1")
   by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
   Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)`
-  | rename process_guid as proc_guid | fields _time dest file_create_time file_name
-  file_path process_name process_path process proc_guid] | dedup file_create_time
-  | table dest, process_name, process, file_create_time, file_name, file_path, proc_guid
+  | fields _time dest file_create_time file_name
+  file_path process_name process_path process process_guid] | dedup file_create_time
+  | table dest, process_name, process, file_create_time, file_name, file_path, process_guid
   | `office_application_drop_executable_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -48,12 +47,12 @@ tags:
   impact: 80
   kill_chain_phases:
   - Exploitation
-  message: process $process_name$ drops a file $TargetFilename$ in host $dest$
+  message: process $process_name$ drops a file $file_name$ in host $dest$
   mitre_attack_id:
   - T1566
   - T1566.001
   observable:
-  - name: Computer
+  - name: dest
     type: Hostname
     role:
     - Victim
@@ -67,9 +66,9 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Image
-  - TargetFilename
-  - ProcessGuid
+  - process_name
+  - file_name
+  - process_guid
   - dest
   - user_id
   risk_score: 64

detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml

@@ -2,7 +2,7 @@ name: Rundll32 with no Command Line Arguments with Network
 id: 35307032-a12d-11eb-835f-acde48001122
 version: 4
 date: '2022-03-15'
-author: Michael Haag, Splunk
+author: Steven Dick,  Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
@@ -13,16 +13,16 @@ description: The following analytic identifies rundll32.exe with no command line
   and parallel processes. Identify any suspicious module loads related to credential
   dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and
   C:\Windows\syswow64.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where `process_rundll32` by _time span=1h  Processes.process_id Processes.process_name
-  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
-  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | regex process="(?i)(rundll32\.exe.{0,4}$)" 
-  | join  process_id [| tstats `security_content_summariesonly`
-  count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id
-  All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ]
-  | table _time dest parent_process_name process_name process_path process process_id dest_port C2 
-  | `rundll32_with_no_command_line_arguments_with_network_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where `process_rundll32` AND Processes.action!="blocked" by host _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.parent_process
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| regex process="(?i)(rundll32\.exe.{0,4}$)"
+| rename dest as src
+| join host process_id 
+    [| tstats `security_content_summariesonly` count latest(All_Traffic.dest) as dest latest(All_Traffic.dest_ip) as dest_ip latest(All_Traffic.dest_port) as dest_port FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by host All_Traffic.process_id 
+    | `drop_dm_object_name(All_Traffic)`] 
+| `rundll32_with_no_command_line_arguments_with_network_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node.
@@ -54,7 +54,7 @@ tags:
   kill_chain_phases:
   - Exploitation
   message: A rundll32 process $process_name$ with no commandline argument like this
-    process commandline $process$ in host $dest$
+    process commandline $process$ in host $src$
   mitre_attack_id:
   - T1218
   - T1218.011
@@ -88,4 +88,4 @@ tags:
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
-  asset_type: Endpoint
+  asset_type: Endpoint

detections/experimental/endpoint/dllhost_with_no_command_line_arguments_with_network.yml

@@ -1,8 +1,8 @@
 name: DLLHost with no Command Line Arguments with Network
 id: f1c07594-a141-11eb-8407-acde48001122
-version: 3
+version: 4
 date: '2022-03-15'
-author: Michael Haag, Splunk
+author: Steven Dick, Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
@@ -12,15 +12,16 @@ description: The following analytic identifies DLLHost.exe with no command line
   including Cobalt Strike. During investigation, triage any network connections and
   parallel processes. Identify any suspicious module loads related to credential dumping
   or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where Processes.process_name=dllhost.exe by _time span=1h  Processes.process_id
-  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | regex process="(?i)(dllhost\.exe.{0,4}$)" | join  process_id [| tstats `security_content_summariesonly`
-  count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id
-  All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ]
-  | table _time dest parent_process_name process_name process_path process process_id dest_port C2 
-  | `dllhost_with_no_command_line_arguments_with_network_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=dllhost.exe Processes.action!="blocked" by host _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.parent_process
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| regex process="(?i)(dllhost\.exe.{0,4}$)"
+| rename dest as src
+| join host process_id 
+    [| tstats `security_content_summariesonly` count latest(All_Traffic.dest) as dest latest(All_Traffic.dest_ip) as dest_ip latest(All_Traffic.dest_port) as dest_port FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by host All_Traffic.process_id 
+    | `drop_dm_object_name(All_Traffic)`] 
+| `dllhost_with_no_command_line_arguments_with_network_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node.
@@ -41,8 +42,8 @@ tags:
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: The process $process_name$ was spawned by $parent_image$ without any command-line
-    arguments on $dest$ by $user$.
+  message: The process $process_name$ was spawned by $parent_process_name$ without any command-line
+    arguments on $src$ by $user$.
   mitre_attack_id:
   - T1055
   observable:
@@ -76,4 +77,4 @@ tags:
   - process_path
   risk_score: 49
   security_domain: endpoint
-  asset_type: Endpoint
+  asset_type: Endpoint

tests/endpoint/lolbas_with_network_traffic.test.yml

@@ -0,0 +1,13 @@
+name: LOLBAS With Network Traffic Unit Test
+tests:
+- name: LOLBAS With Network Traffic
+  file: endpoint/lolbas_with_network_traffic.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: lolbas_with_network_traffic.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true