From d2c419e59663d027ef4509e20386c8cb9668f33a Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 22 Jun 2022 13:31:48 +0200 Subject: [PATCH 01/19] azorult-bomb --- ...emote_services_allow_remote_assistance.yml | 70 +++++++++++++++++ .../windows_remote_services_rdp_enable.yml | 68 +++++++++++++++++ .../windows_service_stop_by_deletion.yml | 75 +++++++++++++++++++ ..._services_allow_remote_assistance.test.yml | 13 ++++ ...indows_remote_services_rdp_enable.test.yml | 13 ++++ .../windows_service_stop_by_deletion.test.yml | 13 ++++ 6 files changed, 252 insertions(+) create mode 100644 detections/endpoint/windows_remote_services_allow_remote_assistance.yml create mode 100644 detections/endpoint/windows_remote_services_rdp_enable.yml create mode 100644 detections/endpoint/windows_service_stop_by_deletion.yml create mode 100644 tests/endpoint/windows_remote_services_allow_remote_assistance.test.yml create mode 100644 tests/endpoint/windows_remote_services_rdp_enable.test.yml create mode 100644 tests/endpoint/windows_service_stop_by_deletion.test.yml diff --git a/detections/endpoint/windows_remote_services_allow_remote_assistance.yml b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml new file mode 100644 index 0000000000..36e10cc707 --- /dev/null +++ b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml @@ -0,0 +1,70 @@ +name: Windows Remote Services Allow Remote Assistance +id: 9bce3a97-bc97-4e89-a1aa-ead151c82fbb +version: 1 +date: '2022-06-21' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic is to identify a modification in the Windows registry + to enable remoted desktop assitance on a targeted machine. This technique was seen in several adversaries, malware or red teamer + like azorult to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some + production environment, This Anomaly behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common. + And as per stated in microsoft documentation the default value of this registry is false that makes this a good indicator of suspicious behavior. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path= "*\\Control\\Terminal Server\\fAllowToGetHelp*" Registry.registry_value_data="0x00000001" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_remote_services_allow_remote_assistance_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: administrators may enable or disable this feature that may cause some false positive. +references: +- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: the registry for rdp protocol was modified to enable in $dest$ + mitre_attack_id: + - T1021.001 + - T1021 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + risk_score: 49 + security_domain: endpoint diff --git a/detections/endpoint/windows_remote_services_rdp_enable.yml b/detections/endpoint/windows_remote_services_rdp_enable.yml new file mode 100644 index 0000000000..9588145949 --- /dev/null +++ b/detections/endpoint/windows_remote_services_rdp_enable.yml @@ -0,0 +1,68 @@ +name: Windows Remote Services Rdp Enable +id: 8fbd2e88-4ea5-40b9-9217-fd0855e08cc0 +version: 1 +date: '2022-06-21' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic is to identify a modification in the Windows registry + to enable remoted desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer + to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some + production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path= "*\\Control\\Terminal Server\\fDenyTSConnections*" Registry.registry_value_data="0x00000000" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_remote_services_rdp_enable_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: administrators may enable or disable this feature that may cause some false positive. +references: +- https://www.hybrid-analysis.com/sample/9d6611c2779316f1ef4b4a6edcfdfb5e770fe32b31ec2200df268c3bd236ed75?environmentId=100 +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: the registry for rdp protocol was modified to enable in $dest$ + mitre_attack_id: + - T1021.001 + - T1021 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + risk_score: 49 + security_domain: endpoint diff --git a/detections/endpoint/windows_service_stop_by_deletion.yml b/detections/endpoint/windows_service_stop_by_deletion.yml new file mode 100644 index 0000000000..b9630d6300 --- /dev/null +++ b/detections/endpoint/windows_service_stop_by_deletion.yml @@ -0,0 +1,75 @@ +name: Windows Service Stop By Deletion +id: 196ff536-58d9-4d1b-9686-b176b04e430b +version: 1 +date: '2022-06-21' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies Windows Service Control, `sc.exe`, + attempting to delete a service. This is typically identified in parallel with other + instances of service enumeration of attempts to stop a service and then delete it. + Adversaries utilize this technique to terminate security services or other related + services to continue there objective and evade detections. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name = sc.exe OR Processes.original_file_name = sc.exe) Processes.process="* delete *" by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_service_stop_by_deletion_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: It is possible administrative scripts may start/stop/delete + services. Filter as needed. +references: +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ attempting to delete a service. + mitre_attack_id: + - T1489 + nist: + - DE.CM + observable: + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process + - parent_process_name + - parent_process + - process_id + - parent_process_id + - dest + - user + risk_score: 49 + security_domain: endpoint diff --git a/tests/endpoint/windows_remote_services_allow_remote_assistance.test.yml b/tests/endpoint/windows_remote_services_allow_remote_assistance.test.yml new file mode 100644 index 0000000000..478063376a --- /dev/null +++ b/tests/endpoint/windows_remote_services_allow_remote_assistance.test.yml @@ -0,0 +1,13 @@ +name: Windows Remote Services Allow Remote Assistance Unit Test +tests: +- name: Windows Remote Services Allow Remote Assistance + file: endpoint/windows_remote_services_allow_remote_assistance.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_remote_services_rdp_enable.test.yml b/tests/endpoint/windows_remote_services_rdp_enable.test.yml new file mode 100644 index 0000000000..6140a7f3e4 --- /dev/null +++ b/tests/endpoint/windows_remote_services_rdp_enable.test.yml @@ -0,0 +1,13 @@ +name: Windows Remote Services Rdp Enable Unit Test +tests: +- name: Windows Remote Services Rdp Enable + file: endpoint/windows_remote_services_rdp_enable.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_service_stop_by_deletion.test.yml b/tests/endpoint/windows_service_stop_by_deletion.test.yml new file mode 100644 index 0000000000..d969ad82ee --- /dev/null +++ b/tests/endpoint/windows_service_stop_by_deletion.test.yml @@ -0,0 +1,13 @@ +name: Windows Service Stop By Deletion Unit Test +tests: +- name: Windows Service Stop By Deletion + file: endpoint/windows_service_stop_by_deletion.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 9d9b782b4eb821648a2af47839454312b89461ba Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 23 Jun 2022 12:27:43 +0200 Subject: [PATCH 02/19] azorult-bomb --- ...y_registry_disable_toast_notifications.yml | 69 +++++++++++++++++ ..._windows_security_center_notifications.yml | 69 +++++++++++++++++ ..._remote_services_allow_rdp_in_firewall.yml | 74 +++++++++++++++++++ ...istry_disable_toast_notifications.test.yml | 13 ++++ ...ows_security_center_notifications.test.yml | 13 ++++ ...te_services_allow_rdp_in_firewall.test.yml | 13 ++++ 6 files changed, 251 insertions(+) create mode 100644 detections/endpoint/windows_modify_registry_disable_toast_notifications.yml create mode 100644 detections/endpoint/windows_modify_registry_disable_windows_security_center_notifications.yml create mode 100644 detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml create mode 100644 tests/endpoint/windows_modify_registry_disable_toast_notifications.test.yml create mode 100644 tests/endpoint/windows_modify_registry_disable_windows_security_center_notifications.test.yml create mode 100644 tests/endpoint/windows_remote_services_allow_rdp_in_firewall.test.yml diff --git a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml new file mode 100644 index 0000000000..89f4216af9 --- /dev/null +++ b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml @@ -0,0 +1,69 @@ +name: Windows Modify Registry Disable Toast Notifications +id: ed4eeacb-8d5a-488e-bc97-1ce6ded63b84 +version: 1 +date: '2022-06-22' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic is to identify a modification in the Windows registry + to disable toast notifications. This Windows Operating System feature is responsible for alerting or notifying + user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important + update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion + and execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*" Registry.registry_value_data="0x00000000" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_modify_registry_disable_toast_notifications_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: administrators may enable or disable this feature that may cause some false positive. +references: +- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: the registry for DisallowRun settings was modified to enable in $dest$ + mitre_attack_id: + - T1112 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notifications.yml b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notifications.yml new file mode 100644 index 0000000000..44064b3b74 --- /dev/null +++ b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notifications.yml @@ -0,0 +1,69 @@ +name: Windows Modify Registry Disable Windows Security Center Notifications +id: 27ed3e79-6d86-44dd-b9ab-524451c97a7b +version: 1 +date: '2022-06-22' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic is to identify a modification in the Windows registry + to disable windows center notifications. This Windows Operating System feature is responsible for alerting or notifying + user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important + update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion + and execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path= "*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*" Registry.registry_value_data="0x00000000" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_modify_registry_disable_windows_security_center_notifications_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: administrators may enable or disable this feature that may cause some false positive. +references: +- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: the registry for security center notification settings was modified to disable in $dest$ + mitre_attack_id: + - T1112 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + risk_score: 49 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml new file mode 100644 index 0000000000..7fa6ad7cde --- /dev/null +++ b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml @@ -0,0 +1,74 @@ +name: Windows Remote Services Allow Rdp In Firewall +id: 9170cb54-ea15-41e1-9dfc-9f3363ce9b02 +version: 1 +date: '2022-06-21' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic is to identify a modification in the Windows firewall + to enable remoted desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer + to remotely access the compromised or targeted host by allowing this protocol in firewall. Even this protocol might be allowed in some + production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through firewall which is also common traits + of attack to start lateral movement. +search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline + values(Processes.parent_process_name) as parent_process values(Processes.process_name) + count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name = "netsh.exe" OR Processes.original_file_name= "netsh.exe") AND Processes.process = "*firewall*" AND Processes.process = "*add*" AND Processes.process = "*protocol=TCP*" + AND Processes.process = "*localport=3389*" AND Processes.process = "*action=allow*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_remote_services_allow_rdp_in_firewall_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records process activity from your hosts to populate the endpoint data model + in the processes node. If you are using Sysmon, you must have at least version 6.0.4 + of the Sysmon TA. +known_false_positives: administrators may enable or disable this feature that may cause some false positive. +references: +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: new firewall rules was added to allow rdp connection to $dest$ + mitre_attack_id: + - T1021.001 + - T1021 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process + - parent_process_name + - parent_process + - process_id + - parent_process_id + - dest + - user + risk_score: 49 + security_domain: endpoint diff --git a/tests/endpoint/windows_modify_registry_disable_toast_notifications.test.yml b/tests/endpoint/windows_modify_registry_disable_toast_notifications.test.yml new file mode 100644 index 0000000000..4ce8c9ecd0 --- /dev/null +++ b/tests/endpoint/windows_modify_registry_disable_toast_notifications.test.yml @@ -0,0 +1,13 @@ +name: Windows Modify Registry Disable Toast Notifications Unit Test +tests: +- name: Windows Modify Registry Disable Toast Notifications + file: endpoint/windows_modify_registry_disable_toast_notifications.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: UPDATE + data: UPDATE + source: UPDATE + sourcetype: UPDATE + update_timestamp: true diff --git a/tests/endpoint/windows_modify_registry_disable_windows_security_center_notifications.test.yml b/tests/endpoint/windows_modify_registry_disable_windows_security_center_notifications.test.yml new file mode 100644 index 0000000000..35d99fecc9 --- /dev/null +++ b/tests/endpoint/windows_modify_registry_disable_windows_security_center_notifications.test.yml @@ -0,0 +1,13 @@ +name: Windows Modify Registry Disable Windows Security Center Notifications Unit Test +tests: +- name: Windows Modify Registry Disable Windows Security Center Notifications + file: endpoint/windows_modify_registry_disable_windows_security_center_notifications.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_remote_services_allow_rdp_in_firewall.test.yml b/tests/endpoint/windows_remote_services_allow_rdp_in_firewall.test.yml new file mode 100644 index 0000000000..b6dd69acc2 --- /dev/null +++ b/tests/endpoint/windows_remote_services_allow_rdp_in_firewall.test.yml @@ -0,0 +1,13 @@ +name: Windows Remote Services Allow Rdp In Firewall Unit Test +tests: +- name: Windows Remote Services Allow Rdp In Firewall + file: endpoint/windows_remote_services_allow_rdp_in_firewall.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From c4f248b11b3ecf5a50d6735f4d56225a8cccb421 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 23 Jun 2022 12:38:07 +0200 Subject: [PATCH 03/19] azorult-bomb --- ...stry_disable_windows_security_center_notifs.yml} | 4 ++-- ...y_registry_suppress_win_defender_notifs.test.yml | 13 +++++++++++++ 2 files changed, 15 insertions(+), 2 deletions(-) rename detections/endpoint/{windows_modify_registry_disable_windows_security_center_notifications.yml => windows_modify_registry_disable_windows_security_center_notifs.yml} (98%) create mode 100644 tests/endpoint/windows_modify_registry_suppress_win_defender_notifs.test.yml diff --git a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notifications.yml b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notifs.yml similarity index 98% rename from detections/endpoint/windows_modify_registry_disable_windows_security_center_notifications.yml rename to detections/endpoint/windows_modify_registry_disable_windows_security_center_notifs.yml index 44064b3b74..182a5dd177 100644 --- a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notifications.yml +++ b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notifs.yml @@ -1,4 +1,4 @@ -name: Windows Modify Registry Disable Windows Security Center Notifications +name: Windows Modify Registry Disable Windows Security Center Notifs id: 27ed3e79-6d86-44dd-b9ab-524451c97a7b version: 1 date: '2022-06-22' @@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_modify_registry_disable_windows_security_center_notifications_filter`' + | `windows_modify_registry_disable_windows_security_center_notifs_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure diff --git a/tests/endpoint/windows_modify_registry_suppress_win_defender_notifs.test.yml b/tests/endpoint/windows_modify_registry_suppress_win_defender_notifs.test.yml new file mode 100644 index 0000000000..37fdf199e9 --- /dev/null +++ b/tests/endpoint/windows_modify_registry_suppress_win_defender_notifs.test.yml @@ -0,0 +1,13 @@ +name: Windows Modify Registry Suppress Win Defender Notifs Unit Test +tests: +- name: Windows Modify Registry Suppress Win Defender Notifications + file: endpoint/windows_modify_registry_suppress_win_defender_notifs.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 2e4eac9eaa8874e0973ce028729bd3487db30674 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 23 Jun 2022 13:28:26 +0200 Subject: [PATCH 04/19] Update windows_modify_registry_suppress_win_defender_notifs.test.yml --- ...indows_modify_registry_suppress_win_defender_notifs.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/windows_modify_registry_suppress_win_defender_notifs.test.yml b/tests/endpoint/windows_modify_registry_suppress_win_defender_notifs.test.yml index 37fdf199e9..68300109a1 100644 --- a/tests/endpoint/windows_modify_registry_suppress_win_defender_notifs.test.yml +++ b/tests/endpoint/windows_modify_registry_suppress_win_defender_notifs.test.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry Suppress Win Defender Notifs Unit Test tests: -- name: Windows Modify Registry Suppress Win Defender Notifications +- name: Windows Modify Registry Suppress Win Defender Notifs file: endpoint/windows_modify_registry_suppress_win_defender_notifs.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h From 8321cf9c1dfb68da59cfd1ee2699904a0089a608 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 23 Jun 2022 13:35:02 +0200 Subject: [PATCH 05/19] Update and rename windows_modify_registry_disable_windows_security_center_notifications.test.yml to windows_modify_registry_disable_windows_security_center_notifs.test.yml --- ...egistry_disable_windows_security_center_notifs.test.yml} | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) rename tests/endpoint/{windows_modify_registry_disable_windows_security_center_notifications.test.yml => windows_modify_registry_disable_windows_security_center_notifs.test.yml} (90%) diff --git a/tests/endpoint/windows_modify_registry_disable_windows_security_center_notifications.test.yml b/tests/endpoint/windows_modify_registry_disable_windows_security_center_notifs.test.yml similarity index 90% rename from tests/endpoint/windows_modify_registry_disable_windows_security_center_notifications.test.yml rename to tests/endpoint/windows_modify_registry_disable_windows_security_center_notifs.test.yml index 35d99fecc9..8cfb6d80a8 100644 --- a/tests/endpoint/windows_modify_registry_disable_windows_security_center_notifications.test.yml +++ b/tests/endpoint/windows_modify_registry_disable_windows_security_center_notifs.test.yml @@ -1,7 +1,7 @@ -name: Windows Modify Registry Disable Windows Security Center Notifications Unit Test +name: Windows Modify Registry Disable Windows Security Center Notifs Unit Test tests: -- name: Windows Modify Registry Disable Windows Security Center Notifications - file: endpoint/windows_modify_registry_disable_windows_security_center_notifications.yml +- name: Windows Modify Registry Disable Windows Security Center Notifs + file: endpoint/windows_modify_registry_disable_windows_security_center_notifs.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From a259be3c32d28c52b406b49e76239e429b34260a Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 23 Jun 2022 13:36:06 +0200 Subject: [PATCH 06/19] azorult-bomb --- ...ry_suppress_win_defender_notifications.yml | 68 +++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 detections/endpoint/windows_modify_registry_suppress_win_defender_notifications.yml diff --git a/detections/endpoint/windows_modify_registry_suppress_win_defender_notifications.yml b/detections/endpoint/windows_modify_registry_suppress_win_defender_notifications.yml new file mode 100644 index 0000000000..ea8be93910 --- /dev/null +++ b/detections/endpoint/windows_modify_registry_suppress_win_defender_notifications.yml @@ -0,0 +1,68 @@ +name: Windows Modify Registry Suppress Win Defender Notifs +id: e3b42daf-fff4-429d-bec8-2a199468cea9 +version: 1 +date: '2022-06-22' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic is to identify a modification in the Windows registry + to suppress windows defender notification. This technique was abuse by adversaries and threat actor to bypassed windows defender + on the targeted host. Azorult malware is one of the malware use this technique that also disable toast notification and other windows features + as part of its malicious behavior. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path= "*\\Windows Defender\\UX Configuration\\Notification_Suppress*" Registry.registry_value_data="0x00000001" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_modify_registry_suppress_win_defender_notifs_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: administrators may enable or disable this feature that may cause some false positive. +references: +- https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +tags: + analytic_story: + - Azorult + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + impact: 70 + kill_chain_phases: + - Exploitation + message: the registry for suppresing windows fdefender notification settings was modified to disabled in $dest$ + mitre_attack_id: + - T1112 + nist: + - DE.CM + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + risk_score: 49 + security_domain: endpoint \ No newline at end of file From 0478d292f4806675a6999dbf070b56dc4bb6fd5c Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 23 Jun 2022 13:36:47 +0200 Subject: [PATCH 07/19] Rename windows_modify_registry_suppress_win_defender_notifications.yml to windows_modify_registry_suppress_win_defender_notifs.yml --- ...=> windows_modify_registry_suppress_win_defender_notifs.yml} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename detections/endpoint/{windows_modify_registry_suppress_win_defender_notifications.yml => windows_modify_registry_suppress_win_defender_notifs.yml} (98%) diff --git a/detections/endpoint/windows_modify_registry_suppress_win_defender_notifications.yml b/detections/endpoint/windows_modify_registry_suppress_win_defender_notifs.yml similarity index 98% rename from detections/endpoint/windows_modify_registry_suppress_win_defender_notifications.yml rename to detections/endpoint/windows_modify_registry_suppress_win_defender_notifs.yml index ea8be93910..1a6f8c9f43 100644 --- a/detections/endpoint/windows_modify_registry_suppress_win_defender_notifications.yml +++ b/detections/endpoint/windows_modify_registry_suppress_win_defender_notifs.yml @@ -65,4 +65,4 @@ tags: - Registry.registry_value_name - Registry.action risk_score: 49 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint From 71e4bd8ebf9ba3f143367569f3e7eb416a327403 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 23 Jun 2022 13:57:11 +0200 Subject: [PATCH 08/19] Update windows_modify_registry_disable_toast_notifications.test.yml --- ...s_modify_registry_disable_toast_notifications.test.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/endpoint/windows_modify_registry_disable_toast_notifications.test.yml b/tests/endpoint/windows_modify_registry_disable_toast_notifications.test.yml index 4ce8c9ecd0..4f9498025a 100644 --- a/tests/endpoint/windows_modify_registry_disable_toast_notifications.test.yml +++ b/tests/endpoint/windows_modify_registry_disable_toast_notifications.test.yml @@ -6,8 +6,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: UPDATE - data: UPDATE - source: UPDATE - sourcetype: UPDATE + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog update_timestamp: true From 374fd54c26e879152dab59161087b75d5321e9bc Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 23 Jun 2022 15:23:59 +0200 Subject: [PATCH 09/19] Update and rename windows_modify_registry_disable_windows_security_center_notifs.yml to windows_modify_registry_disable_windows_security_center_notif.yml --- ...dify_registry_disable_windows_security_center_notif.yml} | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) rename detections/endpoint/{windows_modify_registry_disable_windows_security_center_notifs.yml => windows_modify_registry_disable_windows_security_center_notif.yml} (98%) diff --git a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notifs.yml b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml similarity index 98% rename from detections/endpoint/windows_modify_registry_disable_windows_security_center_notifs.yml rename to detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml index 182a5dd177..ffefd39389 100644 --- a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notifs.yml +++ b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml @@ -1,4 +1,4 @@ -name: Windows Modify Registry Disable Windows Security Center Notifs +name: Windows Modify Registry Disable Windows Security Center Notif id: 27ed3e79-6d86-44dd-b9ab-524451c97a7b version: 1 date: '2022-06-22' @@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_modify_registry_disable_windows_security_center_notifs_filter`' + | `windows_modify_registry_disable_windows_security_center_notif_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -66,4 +66,4 @@ tags: - Registry.registry_value_name - Registry.action risk_score: 49 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint From edbf2c86b388bc1d432187b44bbd817a1d131f2a Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 23 Jun 2022 15:24:21 +0200 Subject: [PATCH 10/19] Update and rename windows_modify_registry_suppress_win_defender_notifs.yml to windows_modify_registry_suppress_win_defender_notif.yml --- ...> windows_modify_registry_suppress_win_defender_notif.yml} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename detections/endpoint/{windows_modify_registry_suppress_win_defender_notifs.yml => windows_modify_registry_suppress_win_defender_notif.yml} (95%) diff --git a/detections/endpoint/windows_modify_registry_suppress_win_defender_notifs.yml b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml similarity index 95% rename from detections/endpoint/windows_modify_registry_suppress_win_defender_notifs.yml rename to detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml index 1a6f8c9f43..9f431cf99b 100644 --- a/detections/endpoint/windows_modify_registry_suppress_win_defender_notifs.yml +++ b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml @@ -1,4 +1,4 @@ -name: Windows Modify Registry Suppress Win Defender Notifs +name: Windows Modify Registry Suppress Win Defender Notif id: e3b42daf-fff4-429d-bec8-2a199468cea9 version: 1 date: '2022-06-22' @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_modify_registry_suppress_win_defender_notifs_filter`' + | `windows_modify_registry_suppress_win_defender_notif_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure From 5c85507b8f9b7d2f9888f6265972d1c2c29c46b9 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 23 Jun 2022 15:24:51 +0200 Subject: [PATCH 11/19] Update and rename windows_modify_registry_disable_windows_security_center_notifs.test.yml to windows_modify_registry_disable_windows_security_center_notif.test.yml --- ...registry_disable_windows_security_center_notif.test.yml} | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) rename tests/endpoint/{windows_modify_registry_disable_windows_security_center_notifs.test.yml => windows_modify_registry_disable_windows_security_center_notif.test.yml} (93%) diff --git a/tests/endpoint/windows_modify_registry_disable_windows_security_center_notifs.test.yml b/tests/endpoint/windows_modify_registry_disable_windows_security_center_notif.test.yml similarity index 93% rename from tests/endpoint/windows_modify_registry_disable_windows_security_center_notifs.test.yml rename to tests/endpoint/windows_modify_registry_disable_windows_security_center_notif.test.yml index 8cfb6d80a8..352e602392 100644 --- a/tests/endpoint/windows_modify_registry_disable_windows_security_center_notifs.test.yml +++ b/tests/endpoint/windows_modify_registry_disable_windows_security_center_notif.test.yml @@ -1,7 +1,7 @@ -name: Windows Modify Registry Disable Windows Security Center Notifs Unit Test +name: Windows Modify Registry Disable Windows Security Center Notif Unit Test tests: -- name: Windows Modify Registry Disable Windows Security Center Notifs - file: endpoint/windows_modify_registry_disable_windows_security_center_notifs.yml +- name: Windows Modify Registry Disable Windows Security Center Notif + file: endpoint/windows_modify_registry_disable_windows_security_center_notif.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From 54a23a2a773670da1b5736595bbf922feae2d071 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 23 Jun 2022 15:25:17 +0200 Subject: [PATCH 12/19] Update and rename windows_modify_registry_suppress_win_defender_notifs.test.yml to windows_modify_registry_suppress_win_defender_notif.test.yml --- ...ws_modify_registry_suppress_win_defender_notif.test.yml} | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) rename tests/endpoint/{windows_modify_registry_suppress_win_defender_notifs.test.yml => windows_modify_registry_suppress_win_defender_notif.test.yml} (75%) diff --git a/tests/endpoint/windows_modify_registry_suppress_win_defender_notifs.test.yml b/tests/endpoint/windows_modify_registry_suppress_win_defender_notif.test.yml similarity index 75% rename from tests/endpoint/windows_modify_registry_suppress_win_defender_notifs.test.yml rename to tests/endpoint/windows_modify_registry_suppress_win_defender_notif.test.yml index 68300109a1..4644a4dd4b 100644 --- a/tests/endpoint/windows_modify_registry_suppress_win_defender_notifs.test.yml +++ b/tests/endpoint/windows_modify_registry_suppress_win_defender_notif.test.yml @@ -1,7 +1,7 @@ -name: Windows Modify Registry Suppress Win Defender Notifs Unit Test +name: Windows Modify Registry Suppress Win Defender Notif Unit Test tests: -- name: Windows Modify Registry Suppress Win Defender Notifs - file: endpoint/windows_modify_registry_suppress_win_defender_notifs.yml +- name: Windows Modify Registry Suppress Win Defender Notif + file: endpoint/windows_modify_registry_suppress_win_defender_notif.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From ecbf458418baef93748a94255b2b20115ac502d0 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 1 Jul 2022 12:07:31 +0200 Subject: [PATCH 13/19] Update windows_modify_registry_disable_windows_security_center_notif.yml --- ...ws_modify_registry_disable_windows_security_center_notif.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml index ffefd39389..40838cefad 100644 --- a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml +++ b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml @@ -43,7 +43,7 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: the registry for security center notification settings was modified to disable in $dest$ + message: the registry for security center notification settings was modified to disable mode in $dest$ mitre_attack_id: - T1112 nist: From 16a9e7c3af41d604cd0ea2d94a73bc25bbfe35e5 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 5 Jul 2022 15:36:27 +0200 Subject: [PATCH 14/19] Update windows_remote_services_allow_rdp_in_firewall.yml --- .../endpoint/windows_remote_services_allow_rdp_in_firewall.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml index 7fa6ad7cde..8f1397be06 100644 --- a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml +++ b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: - Endpoint description: The following analytic is to identify a modification in the Windows firewall - to enable remoted desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer + to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer to remotely access the compromised or targeted host by allowing this protocol in firewall. Even this protocol might be allowed in some production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through firewall which is also common traits of attack to start lateral movement. From 8a95bfd0b8ebe69e2e55c9d4e5b84f2a9653d242 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 5 Jul 2022 15:37:46 +0200 Subject: [PATCH 15/19] Update windows_remote_services_allow_remote_assistance.yml --- .../windows_remote_services_allow_remote_assistance.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_remote_services_allow_remote_assistance.yml b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml index 36e10cc707..890a3cd01c 100644 --- a/detections/endpoint/windows_remote_services_allow_remote_assistance.yml +++ b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: - Endpoint description: The following analytic is to identify a modification in the Windows registry - to enable remoted desktop assitance on a targeted machine. This technique was seen in several adversaries, malware or red teamer + to enable remote desktop assitance on a targeted machine. This technique was seen in several adversaries, malware or red teamer like azorult to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some production environment, This Anomaly behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common. And as per stated in microsoft documentation the default value of this registry is false that makes this a good indicator of suspicious behavior. From 7cea438ff9a8ac592a9993088bf30739a3aa2d4c Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 5 Jul 2022 15:38:57 +0200 Subject: [PATCH 16/19] Update windows_remote_services_allow_remote_assistance.yml --- .../windows_remote_services_allow_remote_assistance.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_remote_services_allow_remote_assistance.yml b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml index 890a3cd01c..fa07ebad2d 100644 --- a/detections/endpoint/windows_remote_services_allow_remote_assistance.yml +++ b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: - Endpoint description: The following analytic is to identify a modification in the Windows registry - to enable remote desktop assitance on a targeted machine. This technique was seen in several adversaries, malware or red teamer + to enable remote desktop assistance on a targeted machine. This technique was seen in several adversaries, malware or red teamer like azorult to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some production environment, This Anomaly behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common. And as per stated in microsoft documentation the default value of this registry is false that makes this a good indicator of suspicious behavior. From e34e8797d1ea0625144486fe65460e9dafb70406 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 5 Jul 2022 15:41:09 +0200 Subject: [PATCH 17/19] Update windows_remote_services_rdp_enable.yml --- detections/endpoint/windows_remote_services_rdp_enable.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_remote_services_rdp_enable.yml b/detections/endpoint/windows_remote_services_rdp_enable.yml index 9588145949..bda36548db 100644 --- a/detections/endpoint/windows_remote_services_rdp_enable.yml +++ b/detections/endpoint/windows_remote_services_rdp_enable.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: The following analytic is to identify a modification in the Windows registry - to enable remoted desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer + to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry From 95c7bea61c8218fce719ec13ee18c1cb8ed6b81f Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 19 Jul 2022 10:35:10 -0700 Subject: [PATCH 18/19] Update windows_service_stop_by_deletion.yml --- .../windows_service_stop_by_deletion.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/windows_service_stop_by_deletion.yml b/detections/endpoint/windows_service_stop_by_deletion.yml index b9630d6300..f63fa31cd7 100644 --- a/detections/endpoint/windows_service_stop_by_deletion.yml +++ b/detections/endpoint/windows_service_stop_by_deletion.yml @@ -63,13 +63,13 @@ tags: - Splunk Cloud required_fields: - _time - - process_name - - process - - parent_process_name - - parent_process - - process_id - - parent_process_id - - dest - - user + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id + - Processes.dest + - Processes.user risk_score: 49 security_domain: endpoint From e8cf6d17f96f737f753dda0819dc3c6cae38c94c Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 19 Jul 2022 10:35:49 -0700 Subject: [PATCH 19/19] Update windows_remote_services_allow_rdp_in_firewall.yml --- ...ows_remote_services_allow_rdp_in_firewall.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml index 8f1397be06..d17c147471 100644 --- a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml +++ b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml @@ -62,13 +62,13 @@ tags: - Splunk Cloud required_fields: - _time - - process_name - - process - - parent_process_name - - parent_process - - process_id - - parent_process_id - - dest - - user + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_id + - Processes.parent_process_id + - Processes.dest + - Processes.user risk_score: 49 security_domain: endpoint