From f43bffd899dc8e3e725d6d456ce706253bdcc91a Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 16 Sep 2021 10:37:34 -0600 Subject: [PATCH 1/6] Update creation_of_shadow_copy_with_wmic_and_powershell.yml --- .../creation_of_shadow_copy_with_wmic_and_powershell.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index 299dd423fd..74c9311b06 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -1,7 +1,7 @@ name: Creation of Shadow Copy with wmic and powershell id: 2ed8b538-d284-449a-be1d-82ad1dbd186b -version: 2 -date: '2019-12-10' +version: 3 +date: '2021-09-16' author: Patrick Bareiss, Splunk type: TTP datamodel: From 6059b4e1353612fb9f35e434ab70474d784e5137 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 16 Sep 2021 16:41:29 +0000 Subject: [PATCH 2/6] Added detection testing service results inBITS Job Persistence --- detections/endpoint/bits_job_persistence.yml | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index 0568b0c451..44262d9858 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -14,13 +14,17 @@ description: The following query identifies Microsoft Background Intelligent Tra to be used to upload files and this may require further network data analysis to identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` - Processes.process IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, - *setminretrydelay*, *setcustomheaders*, *resume* ) by Processes.dest Processes.user Processes.original_file_name + as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process + IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, *setminretrydelay*, + *setcustomheaders*, *resume* ) by Processes.dest Processes.user Processes.original_file_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bits_job_persistence_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: Limited false positives will be present. Typically, applications will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments (legitimate applications) or parent process. @@ -71,11 +75,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path From ddae4670bbf0b8e96035075c70f0de81ccaa7676 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 16 Sep 2021 16:45:19 +0000 Subject: [PATCH 3/6] Added detection testing service results inBITSAdmin Download File --- .../endpoint/bitsadmin_download_file.yml | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index 5e67542f33..241dae1127 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -19,12 +19,16 @@ description: The following query identifies Microsoft Background Intelligent Tra malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` - Processes.process=*transfer* by Processes.dest Processes.user Processes.parent_process Processes.original_file_name + as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process=*transfer* + by Processes.dest Processes.user Processes.parent_process Processes.original_file_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bitsadmin_download_file_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: Limited false positives, however it may be required to filter based on parent process name or network connection. references: @@ -77,11 +81,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path From 261bdc42708d2974a1969a350731cb407a324b82 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 16 Sep 2021 10:50:21 -0600 Subject: [PATCH 4/6] Update credential_dumping_via_copy_command_from_shadow_copy.yml --- .../credential_dumping_via_copy_command_from_shadow_copy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index ffdf93a927..9d69a568ee 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -1,7 +1,7 @@ name: Credential Dumping via Copy Command from Shadow Copy id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b version: 2 -date: '2019-12-10' +date: '2021-09-16' author: Patrick Bareiss, Splunk type: TTP datamodel: From 7acb54087f0e2d876cdc0d0c5fcbdc1797297636 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 16 Sep 2021 16:51:07 +0000 Subject: [PATCH 5/6] Added detection testing service results inCreate local admin accounts using net exe --- .../endpoint/create_local_admin_accounts_using_net_exe.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index 31d142a537..f4fd68f261 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -10,9 +10,10 @@ description: This search looks for the creation of local administrator accounts net.exe . search: '| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime - max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process=*localgroup* OR Processes.process=*user*) AND Processes.process=*/add* by Processes.process Processes.process_name Processes.dest - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - |`create_local_admin_accounts_using_net_exe_filter` ' + max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND + (Processes.process=*localgroup* OR Processes.process=*user*) AND Processes.process=*/add* + by Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`create_local_admin_accounts_using_net_exe_filter` ' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. From 9e32a32bdd90c2a2ff44254bd8d22a5e324b8cf0 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 16 Sep 2021 10:52:50 -0600 Subject: [PATCH 6/6] Update credential_dumping_via_symlink_to_shadow_copy.yml --- ...dential_dumping_via_symlink_to_shadow_copy.yml | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index e7c7638b40..714c0353a6 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -1,22 +1,19 @@ name: Credential Dumping via Symlink to Shadow Copy id: c5eac648-fae0-4263-91a6-773df1f4c903 -version: 1 -date: '2019-12-10' +version: 2 +date: '2021-09-16' author: Patrick Bareiss, Splunk type: TTP datamodel: - Endpoint description: This search detects the creation of a symlink to a shadow copy. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe + as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*mklink* Processes.process=*HarddiskVolumeShadowCopy* by Processes.dest - Processes.user Processes.process_name Processes.process Processes.parent_process + Processes.user Processes.process_name Processes.process Processes.parent_process Processes.original_file_name Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter` ' -how_to_implement: You must be ingesting endpoint data that tracks process activity, - including parent-child relationships from your endpoints to populate the Endpoint - data model in the Processes node. The command-line arguments are mapped to the "process" - field in the Endpoint data model. + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: unknown references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf