From f50008a88f7135e7a14bea0a22c3cb0d16507dfb Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 2 Feb 2023 13:42:18 -0800 Subject: [PATCH 1/4] adding commits --- ...no_command_line_arguments_with_network.yml | 27 ++++++++++--------- .../office_application_drop_executable.yml | 21 +++++++-------- ...no_command_line_arguments_with_network.yml | 26 +++++++++--------- 3 files changed, 37 insertions(+), 37 deletions(-) diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index f6e063ff1c..a0def99da1 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -1,8 +1,8 @@ name: DLLHost with no Command Line Arguments with Network id: f1c07594-a141-11eb-8407-acde48001122 -version: 3 +version: 4 date: '2022-03-15' -author: Michael Haag, Splunk +author: Steven Dick, Michael Haag, Splunk type: TTP datamodel: - Endpoint @@ -12,15 +12,16 @@ description: The following analytic identifies DLLHost.exe with no command line including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=dllhost.exe by _time span=1h Processes.process_id - Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(?i)(dllhost\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` - count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id - All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] - | table _time dest parent_process_name process_name process_path process process_id dest_port C2 - | `dllhost_with_no_command_line_arguments_with_network_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=dllhost.exe Processes.action!="blocked" by host _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.parent_process +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| regex process="(?i)(dllhost\.exe.{0,4}$)" +| rename dest as src +| join host process_id + [| tstats `security_content_summariesonly` count latest(All_Traffic.dest) as dest latest(All_Traffic.dest_ip) as dest_ip latest(All_Traffic.dest_port) as dest_port FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by host All_Traffic.process_id + | `drop_dm_object_name(All_Traffic)`] +| `dllhost_with_no_command_line_arguments_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. @@ -41,8 +42,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: The process $process_name$ was spawned by $parent_image$ without any command-line - arguments on $dest$ by $user$. + message: The process $process_name$ was spawned by $parent_process_name$ without any command-line + arguments on $src$ by $user$. mitre_attack_id: - T1055 observable: diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml index 8f823f7d13..f105bb08bf 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/office_application_drop_executable.yml @@ -1,8 +1,8 @@ name: Office Application Drop Executable id: 73ce70c4-146d-11ec-9184-acde48001122 -version: 2 +version: 3 date: '2023-01-24' -author: Teoderick Contreras, Michael Haag Splunk +author: Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github type: TTP datamodel: - Endpoint @@ -15,13 +15,12 @@ description: This search is to detect a suspicious MS office application that dr search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe") by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count + Processes.process_guid | `drop_dm_object_name(Processes)` |join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` - | rename process_guid as proc_guid | fields _time dest file_create_time file_name + | fields _time dest file_create_time file_name file_path process_name process_path process proc_guid] | dedup file_create_time | table dest, process_name, process, file_create_time, file_name, file_path, proc_guid | `office_application_drop_executable_filter`' @@ -48,12 +47,12 @@ tags: impact: 80 kill_chain_phases: - Exploitation - message: process $process_name$ drops a file $TargetFilename$ in host $dest$ + message: process $process_name$ drops a file $file_name$ in host $dest$ mitre_attack_id: - T1566 - T1566.001 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -67,11 +66,11 @@ tags: - Splunk Cloud required_fields: - _time - - Image - - TargetFilename - - ProcessGuid + - process_name + - file_name + - process_guid - dest - user_id risk_score: 64 security_domain: endpoint - asset_type: Endpoint + asset_type: Endpoint \ No newline at end of file diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index 4ece57a8bc..f1f4feb0ae 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -2,7 +2,7 @@ name: Rundll32 with no Command Line Arguments with Network id: 35307032-a12d-11eb-835f-acde48001122 version: 4 date: '2022-03-15' -author: Michael Haag, Splunk +author: Steven Dick, Michael Haag, Splunk type: TTP datamodel: - Endpoint @@ -13,16 +13,16 @@ description: The following analytic identifies rundll32.exe with no command line and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_rundll32` by _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process Processes.parent_process_name - Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | regex process="(?i)(rundll32\.exe.{0,4}$)" - | join process_id [| tstats `security_content_summariesonly` - count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id - All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] - | table _time dest parent_process_name process_name process_path process process_id dest_port C2 - | `rundll32_with_no_command_line_arguments_with_network_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where `process_rundll32` AND Processes.action!="blocked" by host _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.parent_process +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| regex process="(?i)(rundll32\.exe.{0,4}$)" +| rename dest as src +| join host process_id + [| tstats `security_content_summariesonly` count latest(All_Traffic.dest) as dest latest(All_Traffic.dest_ip) as dest_ip latest(All_Traffic.dest_port) as dest_port FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by host All_Traffic.process_id + | `drop_dm_object_name(All_Traffic)`] +| `rundll32_with_no_command_line_arguments_with_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. @@ -54,7 +54,7 @@ tags: kill_chain_phases: - Exploitation message: A rundll32 process $process_name$ with no commandline argument like this - process commandline $process$ in host $dest$ + process commandline $process$ in host $src$ mitre_attack_id: - T1218 - T1218.011 @@ -88,4 +88,4 @@ tags: security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon - asset_type: Endpoint + asset_type: Endpoint \ No newline at end of file From ddc779103b6956d986666fb13f01757903db9b67 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 2 Feb 2023 16:30:42 -0800 Subject: [PATCH 2/4] Update office_application_drop_executable.yml --- detections/endpoint/office_application_drop_executable.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml index f105bb08bf..34849ad7a0 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/office_application_drop_executable.yml @@ -21,8 +21,8 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name - file_path process_name process_path process proc_guid] | dedup file_create_time - | table dest, process_name, process, file_create_time, file_name, file_path, proc_guid + file_path process_name process_path process process_guid] | dedup file_create_time + | table dest, process_name, process, file_create_time, file_name, file_path, process_guid | `office_application_drop_executable_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -73,4 +73,4 @@ tags: - user_id risk_score: 64 security_domain: endpoint - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint From 525f26ac7304ff1a37f502cbfcf638fddea82406 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 2 Feb 2023 16:40:32 -0800 Subject: [PATCH 3/4] adding new detection from community --- .../endpoint/lolbas_with_network_traffic.yml | 146 ++++++++++++++++++ .../lolbas_with_network_traffic.test.yml | 13 ++ 2 files changed, 159 insertions(+) create mode 100644 detections/endpoint/lolbas_with_network_traffic.yml create mode 100644 tests/endpoint/lolbas_with_network_traffic.test.yml diff --git a/detections/endpoint/lolbas_with_network_traffic.yml b/detections/endpoint/lolbas_with_network_traffic.yml new file mode 100644 index 0000000000..43f3083d92 --- /dev/null +++ b/detections/endpoint/lolbas_with_network_traffic.yml @@ -0,0 +1,146 @@ +name: LOLBAS With Network Traffic +id: 2820f032-19eb-497e-8642-25b04a880359 +version: 1 +date: '2021-12-09' +author: Steven Dick +type: TTP +datamodel: +- Network_Traffic +- Endpoint +description: 'The following analytic identifies LOLBAS with network traffic. +When adversaries abuse LOLBAS they are often used to download malicious code or executables. +The LOLBAS project documents Windows native binaries that can be abused by threat actors to +perform tasks like downloading malicious code. Looking for these process can help defenders +identify lateral movement, command-and-control, or exfiltration activies.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where (All_Traffic.app IN ("*Regsvcs.exe", +"*\\Ftp.exe", +"*OfflineScannerShell.exe", +"*Rasautou.exe", +"*Schtasks.exe", +"*Xwizard.exe", +"*Pnputil.exe", +"*Atbroker.exe", +"*Pcwrun.exe", +"*Ttdinject.exe", +"*Mshta.exe", +"*Bitsadmin.exe", +"*Certoc.exe", +"*Ieexec.exe", +"*Microsoft.Workflow.Compiler.exe", +"*Runscripthelper.exe", +"*Forfiles.exe", +"*Msbuild.exe", +"*Register-cimprovider.exe", +"*Tttracer.exe", +"*Ie4uinit.exe", +"*Bash.exe", +"*Hh.exe", +"*SettingSyncHost.exe", +"*Cmstp.exe", +"*Stordiag.exe", +"*Scriptrunner.exe", +"*Odbcconf.exe", +"*Extexport.exe", +"*Msdt.exe", +"*WorkFolders.exe", +"*Diskshadow.exe", +"*Mavinject.exe", +"*Regasm.exe", +"*Gpscript.exe", +"*Regsvr32.exe", +"*Msiexec.exe", +"*Wuauclt.exe", +"*Presentationhost.exe", +"*Wmic.exe", +"*Runonce.exe", +"*Syncappvpublishingserver.exe", +"*Verclsid.exe", +"*Infdefaultinstall.exe", +"*Installutil.exe", +"*Netsh.exe", +"*Wab.exe", +"*Dnscmd.exe", +"*\\At.exe", +"*Pcalua.exe", +"*Msconfig.exe", +"*makecab.exe", +"*cscript.exe", +"*notepad.exe", +"*\\cmd.exe", +"*certutil.exe", +"*\\powershell.exe", +"*powershell_ise.exe")) by All_Traffic.app,All_Traffic.src,All_Traffic.src_ip,All_Traffic.user,All_Traffic.dest,All_Traffic.dest_ip +| `drop_dm_object_name(All_Traffic)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| rex field=app ".*\\\(?.*)$" +| rename app as process +| `lolbas_with_network_traffic_filter`' +how_to_implement: 'To successfully implement this detection you must ingest events into the Network +traffic data model that contain the source, destination, and communicating process in the app feild. +Relevant processes must also be ingested in the Endpoint data model with matching process_id feild. +Sysmon EID1 and EID3 are good examples of this type this data type.' +known_false_positives: 'Legitmate usage of internal automation or scripting, espically powershell.exe internal to internal or logon scripts. +It may be necessary to omit internal IP ranges if extremely noisy. ie NOT dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","170.98.0.0/16","0:0:0:0:0:0:0:1") +' +references: +- https://lolbas-project.github.io/# +- https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/ +tags: + analytic_story: + - Living Off The Land + asset_type: Endpoint + cis20: + - CIS 4 + - CIS 6 + confidence: 50 + context: + - Source:Endpoint + - Stage:Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log + impact: 50 + kill_chain_phases: + - Exploitation + - Command & Control + - Actions on Objectives + message: The LOLBAS $process_name$ on device $src$ was seen communicating with $dest$. + mitre_attack_id: + - T1105 + - T1567 + - T1218 + nist: + - DE.AE + - DE.CM + observable: + - name: src + type: Hostname + role: + - Victim + - name: dest + type: Hostname + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.user + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.process_path + - Processes.dest + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid + - All_Traffic.app + - All_Traffic.src + - All_Traffic.src_ip + - All_Traffic.dest + - All_Traffic.dest_ip + - All_Traffic.process_id + risk_score: 25 + security_domain: network \ No newline at end of file diff --git a/tests/endpoint/lolbas_with_network_traffic.test.yml b/tests/endpoint/lolbas_with_network_traffic.test.yml new file mode 100644 index 0000000000..7848bf8c0d --- /dev/null +++ b/tests/endpoint/lolbas_with_network_traffic.test.yml @@ -0,0 +1,13 @@ +name: LOLBAS With Network Traffic Unit Test +tests: +- name: LOLBAS With Network Traffic + file: endpoint/lolbas_with_network_traffic.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: lolbas_with_network_traffic.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true \ No newline at end of file From f44b2f1761ec462cc82fc54b6eeb503f0d0e33d1 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 6 Feb 2023 16:48:19 -0800 Subject: [PATCH 4/4] conflicts --- .../dllhost_with_no_command_line_arguments_with_network.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index a0def99da1..9b2c997835 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -77,4 +77,4 @@ tags: - process_path risk_score: 49 security_domain: endpoint - asset_type: Endpoint + asset_type: Endpoint \ No newline at end of file