Branch was auto-updated.

detections/endpoint/detect_exchange_web_shell.yml

@@ -1,30 +1,27 @@
 name: Detect Exchange Web Shell
-id: 44465d80-810b-11eb-aa30-acde48001122
-version: 1
+id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a
+version: 2
 date: '2021-03-09'
-author: Michael Haag, Splunk
+author: Michael Haag, Shannon Davis, Splunk
 type: batch
 datamodel:
 - Endpoint
 description: 'The following query identifies suspicious .aspx created in 3 paths identified
   by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM
   group. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`,
-  and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will have a randomized
-  name of 8 characters long. Review the file for suspect commands. Identify additional
+  and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious
+  on the surface. inspect the contents for script code inside. Identify additional
   log sources, IIS included, to review source and other potential exploitation.'
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name=System  by _time span=1h Processes.process_id Processes.process_name
+  Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
+  tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*",
   "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx"
-  by _time span=1h Filesystem.process_id Filesystem.file_name Filesystem.file_path
-  Filesystem.file_hash Filesystem.user | `drop_dm_object_name(Filesystem)` | rename
-  process_id as aspx_pid | join aspx_pid, _time [| tstats `security_content_summariesonly`
-  count FROM datamodel=Endpoint.Processes where Processes.process_name=w3wp.exe  by
-  _time span=1h Processes.parent_process_id Processes.process_id Processes.process_name
-  Processes.dest Processes.process_path Processes.process | `drop_dm_object_name(Processes)`
-  | rename parent_process_id as aspx_pid | fields _time aspx_pid process_id dest process_name
-  process_path process] | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | table firstTime, lastTime, aspx_pid, process_id, user, dest, file_name, file_path,
-  process_name, process, process_path, file_hash | `detect_exchange_web_shell_filter`'
+  by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
+  Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time
+  file_name file_path process_name process_path process] | dedup file_create_time
+  | table dest file_create_time, file_name, file_path, process_name | `detect_exchange_web_shell_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem`
@@ -37,7 +34,8 @@ references:
 tags:
   analytic_story:
   - HAFNIUM Group
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -54,3 +52,4 @@ tags:
   - Filesystem.file_hash
   - Filesystem.user
   security_domain: endpoint
+  automated_detection_testing: passed

tests/endpoint/detect_exchange_web_shell.test.yml

@@ -0,0 +1,12 @@
+name: Detect Exchange Web Shell Unit Test
+tests:
+- name: Detect Exchange Web Shell, ProxyLogon
+  file: endpoint/detect_exchange_web_shell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog