From 34e69271f336160694c83d3011760bae600869c7 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 18 Mar 2021 21:00:09 -0600 Subject: [PATCH 1/7] Updated Detect Exchange Web Shell Updated Detect Exchange Web Shell based on data --- .../endpoint/detect_exchange_web_shell.yml | 54 +++++++++++++++++++ .../detect_exchange_web_shell.test.yml | 12 +++++ 2 files changed, 66 insertions(+) create mode 100644 detections/endpoint/detect_exchange_web_shell.yml create mode 100644 tests/endpoint/detect_exchange_web_shell.test.yml diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml new file mode 100644 index 0000000000..2fc9219582 --- /dev/null +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -0,0 +1,54 @@ +name: Detect Exchange Web Shell +id: 44465d80-810b-11eb-aa30-acde48001122 +version: 1 +date: '2021-03-09' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: 'The following query identifies suspicious .aspx created in 3 paths identified + by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM + group. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, + and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will have a randomized + name of 8 characters long. Review the file for suspect commands. Identify additional + log sources, IIS included, to review source and other potential exploitation.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", +"*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" +by _time span=1h Filesystem.file_create_time Filesystem.file_name Filesystem.file_path +| `drop_dm_object_name(Filesystem)` | join process_id, _time [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Processes where Processes.process_name=System by + _time span=1h Processes.process_id Processes.process_name + Processes.dest Processes.process_path Processes.process | `drop_dm_object_name(Processes)` + | fields _time process_guid dest process_name process_path process] +| table file_create_time, file_name, file_path, process_name +| `detect_exchange_web_shell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` + node. +known_false_positives: The query is structured in a way that `action` (read, create) + is not defined. Review the results of this query, filter, and tune as necessary. + It may be necessary to generate this query specific to your endpoint product. +references: +- https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv +tags: + analytic_story: + - HAFNIUM Group + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1505.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.file_path + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.file_hash + - Filesystem.user + security_domain: endpoint diff --git a/tests/endpoint/detect_exchange_web_shell.test.yml b/tests/endpoint/detect_exchange_web_shell.test.yml new file mode 100644 index 0000000000..220a75216b --- /dev/null +++ b/tests/endpoint/detect_exchange_web_shell.test.yml @@ -0,0 +1,12 @@ +name: Detect Exchange Web Shell Unit Test +tests: +- name: Detect Exchange Web Shell, ProxyLogon + file: endpoint/detect_exchange_web_shell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 1a15d623cf416c2557e171f7faace046ee2d394d Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 18 Mar 2021 21:06:38 -0600 Subject: [PATCH 2/7] Update detect_exchange_web_shell.yml UID --- detections/endpoint/detect_exchange_web_shell.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index 2fc9219582..73f1ac1bb2 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -1,6 +1,6 @@ name: Detect Exchange Web Shell -id: 44465d80-810b-11eb-aa30-acde48001122 -version: 1 +id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a +version: 2 date: '2021-03-09' author: Michael Haag, Splunk type: batch From a912985629e840f4e640859435fa7fe00bf2d49e Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 19 Mar 2021 06:27:24 -0600 Subject: [PATCH 3/7] Update detect_exchange_web_shell.yml --- .../endpoint/detect_exchange_web_shell.yml | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index 73f1ac1bb2..7f64e0eda0 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -13,16 +13,14 @@ description: 'The following query identifies suspicious .aspx created in 3 paths name of 8 characters long. Review the file for suspect commands. Identify additional log sources, IIS included, to review source and other potential exploitation.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) -as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", -"*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" -by _time span=1h Filesystem.file_create_time Filesystem.file_name Filesystem.file_path -| `drop_dm_object_name(Filesystem)` | join process_id, _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes where Processes.process_name=System by - _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process | `drop_dm_object_name(Processes)` + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", + "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" + by _time span=1h Filesystem.file_create_time Filesystem.file_name Filesystem.file_path + | `drop_dm_object_name(Filesystem)` | join process_id, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=System by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process + | `drop_dm_object_name(Processes)` | fields _time process_guid dest process_name process_path process] -| table file_create_time, file_name, file_path, process_name -| `detect_exchange_web_shell_filter`' + | table file_create_time, file_name, file_path, process_name + | `detect_exchange_web_shell_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` From 00965fbd34dc6e4493c55d1aed5aaccad6790bb7 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 19 Mar 2021 06:41:51 -0600 Subject: [PATCH 4/7] Delete detect_exchange_web_shell.yml --- .../endpoint/detect_exchange_web_shell.yml | 56 ------------------- 1 file changed, 56 deletions(-) delete mode 100644 detections/experimental/endpoint/detect_exchange_web_shell.yml diff --git a/detections/experimental/endpoint/detect_exchange_web_shell.yml b/detections/experimental/endpoint/detect_exchange_web_shell.yml deleted file mode 100644 index 1b0a5db71d..0000000000 --- a/detections/experimental/endpoint/detect_exchange_web_shell.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Detect Exchange Web Shell -id: 44465d80-810b-11eb-aa30-acde48001122 -version: 1 -date: '2021-03-09' -author: Michael Haag, Splunk -type: batch -datamodel: -- Endpoint -description: 'The following query identifies suspicious .aspx created in 3 paths identified - by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM - group. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, - and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will have a randomized - name of 8 characters long. Review the file for suspect commands. Identify additional - log sources, IIS included, to review source and other potential exploitation.' -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", - "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" - by _time span=1h Filesystem.process_id Filesystem.file_name Filesystem.file_path - Filesystem.file_hash Filesystem.user | `drop_dm_object_name(Filesystem)` | rename - process_id as aspx_pid | join aspx_pid, _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes where Processes.process_name=w3wp.exe by - _time span=1h Processes.parent_process_id Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process | `drop_dm_object_name(Processes)` - | rename parent_process_id as aspx_pid | fields _time aspx_pid process_id dest process_name - process_path process] | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | table firstTime, lastTime, aspx_pid, process_id, user, dest, file_name, file_path, - process_name, process, process_path, file_hash | `detect_exchange_web_shell_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` - node. -known_false_positives: The query is structured in a way that `action` (read, create) - is not defined. Review the results of this query, filter, and tune as necessary. - It may be necessary to generate this query specific to your endpoint product. -references: -- https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv -tags: - analytic_story: - - HAFNIUM Group - dataset: [] - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1505.003 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Filesystem.file_path - - Filesystem.process_id - - Filesystem.file_name - - Filesystem.file_hash - - Filesystem.user - security_domain: endpoint From 5f1b737acec86755ee52e29711cf4278d6e05d63 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 22 Mar 2021 06:27:06 -0600 Subject: [PATCH 5/7] Update detect_exchange_web_shell.yml --- .../endpoint/detect_exchange_web_shell.yml | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index 7f64e0eda0..e29b962dfd 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -9,17 +9,13 @@ datamodel: description: 'The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, - and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will have a randomized - name of 8 characters long. Review the file for suspect commands. Identify additional + and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation.' -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", - "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" - by _time span=1h Filesystem.file_create_time Filesystem.file_name Filesystem.file_path - | `drop_dm_object_name(Filesystem)` | join process_id, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=System by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process - | `drop_dm_object_name(Processes)` - | fields _time process_guid dest process_name process_path process] - | table file_create_time, file_name, file_path, process_name +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=System by _time span=1h Processes.process_id Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", + "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path + | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process] + | dedup file_create_time + | table dest file_create_time, file_name, file_path, process_name | `detect_exchange_web_shell_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from From 3657fc8ea76730b3afaf2e37ece3bce3490da70b Mon Sep 17 00:00:00 2001 From: root Date: Mon, 22 Mar 2021 12:54:27 +0000 Subject: [PATCH 6/7] Added detection testing service results inDetect Exchange Web Shell, ProxyLogon --- .../endpoint/detect_exchange_web_shell.yml | 23 ++++++++++++------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index e29b962dfd..82570624ef 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -9,14 +9,19 @@ datamodel: description: 'The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, - and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional + and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious + on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation.' -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=System by _time span=1h Processes.process_id Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", - "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path - | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process] - | dedup file_create_time - | table dest file_create_time, file_name, file_path, process_name - | `detect_exchange_web_shell_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=System by _time span=1h Processes.process_id Processes.process_name + Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| + tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", + "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time + file_name file_path process_name process_path process] | dedup file_create_time + | table dest file_create_time, file_name, file_path, process_name | `detect_exchange_web_shell_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` @@ -29,7 +34,8 @@ references: tags: analytic_story: - HAFNIUM Group - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -46,3 +52,4 @@ tags: - Filesystem.file_hash - Filesystem.user security_domain: endpoint + automated_detection_testing: passed From 17cbdf590cc9863f7f33e15582a4721c60a0375a Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 22 Mar 2021 09:27:09 -0600 Subject: [PATCH 7/7] Update detect_exchange_web_shell.yml --- detections/endpoint/detect_exchange_web_shell.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index 82570624ef..011bfc3c34 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -2,7 +2,7 @@ name: Detect Exchange Web Shell id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a version: 2 date: '2021-03-09' -author: Michael Haag, Splunk +author: Michael Haag, Shannon Davis, Splunk type: batch datamodel: - Endpoint