Merge pull request #1800 from splunk/TR-1085_LateralMovement

Lateral Movement Content Update #1

detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml

@@ -0,0 +1,68 @@
+name: Remote Process Instantiation via WinRM and Winrs
+id: 0dd296a2-4338-11ec-ba02-3e22fbd008af
+version: 1
+date: '2021-11-11'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `winrs.exe` with command-line
+  arguments utilized to start a process on a remote endpoint. Red Teams and adversaries
+  alike may abuse the WinRM protocol and this binary for lateral movement and remote
+  code execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=winrs.exe
+  OR Processes.original_file_name=winrs.exe) (Processes.process="*-r:*" OR Processes.process="*-remote:*")
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_winrm_and_winrs_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Administrators may leverage WinRM and WinRs to start a process
+  on remote systems, but this activity is usually limited to a small set of hosts
+  or users.
+references:
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/winrs
+- https://attack.mitre.org/techniques/T1021/006/
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement/windows-sysmon.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1021
+  - T1021.006
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 60
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A process was started on a remote endpoint from $dest
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/remote_process_instantiation_via_wmi.yml

@@ -1,19 +1,20 @@
 name: Remote Process Instantiation via WMI
 id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da
-version: 6
-date: '2020-11-30'
-author: Rico Valdez, Splunk
+version: 7
+date: '2021-11-12'
+author: Rico Valdez, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: This analytic identifies wmic.exe being launched with parameters to spawn
-  a process on a remote system.
-search: '| tstats `security_content_summariesonly` values(Processes.process) as process
-  min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where `process_wmic` Processes.process="*/node*" Processes.process="*process*" Processes.process="*call*"
-  Processes.process="*create*"   by Processes.process_name Processes.original_file_name
-  Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_filter`'
+  a process on a remote system. Red Teams and adversaries alike may abuse WMI and
+  this binary for lateral movement and remote code execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_wmic` (Processes.process="*/node:*"
+  AND Processes.process="*process*" AND Processes.process="*call*" AND  Processes.process="*create*")
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -22,11 +23,14 @@ how_to_implement: To successfully implement this search you need to be ingesting
 known_false_positives: The wmic.exe utility is a benign Windows application. It may
   be used legitimately by Administrators with these parameters for remote system administration,
   but it's relatively uncommon.
-references: []
+references:
+- https://attack.mitre.org/techniques/T1047/
+- https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/create-method-in-class-win32-process
 tags:
   analytic_story:
   - Ransomware
   - Suspicious WMI Use
+  - Lateral Movement
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml

@@ -0,0 +1,70 @@
+name: Scheduled Task Creation on Remote Endpoint using At
+id: 4be54858-432f-11ec-8209-3e22fbd008af
+version: 1
+date: '2021-11-11'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `at.exe` with command-line arguments
+  utilized to create a Scheduled Task on a remote endpoint. Red Teams and adversaries
+  alike may abuse the Task Scheduler for lateral movement and remote code execution.
+  The `at.exe` binary internally leverages the AT protocol which was deprecated starting
+  with Windows 8 and Windows Server 2012 but may still work on previous versions of
+  Windows. Furthermore, attackers may enable this protocol on demand by changing a
+  sytem registry key.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=at.exe
+  OR Processes.original_file_name=at.exe) (Processes.process=*\\\\*) by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_creation_on_remote_endpoint_using_at_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Administrators may create scheduled tasks on remote systems,
+  but this activity is usually limited to a small set of hosts or users.
+references:
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/at
+- https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob?redirectedfrom=MSDN
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/lateral_movement/windows-sysmon.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1053
+  - T1053.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 60
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A Windows Scheduled Task was created on a remote endpoint from $dest
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml

@@ -0,0 +1,67 @@
+name: Scheduled Task Initiation on Remote Endpoint
+id: 95cf4608-4302-11ec-8194-3e22fbd008af
+version: 1
+date: '2021-11-11'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `schtasks.exe` with command-line
+  arguments utilized to start a Scheduled Task on a remote endpoint. Red Teams and
+  adversaries alike may abuse the Task Scheduler for lateral movement and remote code
+  execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=schtasks.exe
+  OR Processes.original_file_name=schtasks.exe) (Processes.process=*/s* AND Processes.process=*/run*)
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_initiation_on_remote_endpoint_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Administrators may start scheduled tasks on remote systems,
+  but this activity is usually limited to a small set of hosts or users.
+references:
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks
+- https://attack.mitre.org/techniques/T1053/005/
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-sysmon.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1053
+  - T1053.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 60
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A Windows Scheduled Task was ran on a remote endpoint from $dest
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/schtasks_scheduling_job_on_remote_system.yml

@@ -1,17 +1,19 @@
 name: Schtasks scheduling job on remote system
 id: 1297fb80-f42a-4b4a-9c8a-88c066237cf6
-version: 4
-date: '2020-07-21'
-author: David Dorsey, Splunk
+version: 5
+date: '2021-11-11'
+author: David Dorsey, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search looks for flags passed to schtasks.exe on the command-line
-  that indicate a job is being scheduled on a remote system.
+description: This analytic looks for the execution of `schtasks.exe` with command-line
+  arguments utilized to create a Scheduled Task on a remote endpoint. Red Teams and
+  adversaries alike may abuse the Task Scheduler for lateral movement and remote code
+  execution.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = schtasks.exe
-  Processes.process="*/create*" (Processes.process="* /s *" OR Processes.process="*
-  /S *") by Processes.process_name Processes.process Processes.parent_process_name
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = schtasks.exe
+  OR Processes.original_file_name=schtasks.exe) (Processes.process="*/create*" AND
+  Processes.process="*/s*") by Processes.process_name Processes.process Processes.parent_process_name
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `schtasks_scheduling_job_on_remote_system_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
@@ -19,9 +21,9 @@ how_to_implement: You must be ingesting data that records process activity from
   ingesting logs with both the process name and command line from your endpoints.
   The command-line arguments are mapped to the "process" field in the Endpoint data
   model.
-known_false_positives: Administrators may create jobs on remote systems, but this
-  activity is usually limited to a small set of hosts or users. It is important to
-  validate and investigate as appropriate.
+known_false_positives: Administrators may create scheduled tasks on remote systems,
+  but this activity is usually limited to a small set of hosts or users. It is important
+  to validate and investigate as appropriate.
 references: []
 tags:
   analytic_story:

detections/endpoint/windows_service_creation_on_remote_endpoint.yml

@@ -0,0 +1,69 @@
+name: Windows Service Creation on Remote Endpoint
+id: e0eea4fa-4274-11ec-882b-3e22fbd008af
+version: 1
+date: '2021-11-10'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `sc.exe` with command-line arguments
+  utilized to create a Windows Service on a remote endpoint. Red Teams and adversaries
+  alike may abuse the Service Control Manager for lateral movement and remote code
+  execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe
+  OR Processes.original_file_name=sc.exe) (Processes.process=*\\\\* AND Processes.process=*create*
+  AND Processes.process=*binpath*) by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `windows_service_creation_on_remote_endpoint_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Administrators may create Windows Services on remote systems,
+  but this activity is usually limited to a small set of hosts or users.
+references:
+- https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager
+- https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc
+- https://attack.mitre.org/techniques/T1543/003/
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1543
+  - T1543.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 60
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A Windows Service was created on a remote endpoint from $dest
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/windows_service_initiation_on_remote_endpoint.yml

@@ -0,0 +1,67 @@
+name: Windows Service Initiation on Remote Endpoint
+id: 3f519894-4276-11ec-ab02-3e22fbd008af
+version: 1
+date: '2021-11-10'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `sc.exe` with command-line arguments
+  utilized to start a Windows Service on a remote endpoint. Red Teams and adversaries
+  alike may abuse the Service Control Manager for lateral movement and remote code
+  execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe
+  OR Processes.original_file_name=sc.exe) (Processes.process=*\\\\* AND Processes.process=*start*)
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_initiation_on_remote_endpoint_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Administrators may start Windows Services on remote systems,
+  but this activity is usually limited to a small set of hosts or users.
+references:
+- https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc
+- https://attack.mitre.org/techniques/T1543/003/
+tags:
+  analytic_story:
+  - Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1543
+  - T1543.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 60
+  risk_score: 54
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A Windows Service was started on a remote endpoint from $dest
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

tests/endpoint/remote_process_instantiation_via_winrm_and_winrs.test.yml

@@ -0,0 +1,12 @@
+name: Remote Process Instantiation via WinRM and Winrs Unit Test
+tests:
+- name: Remote Process Instantiation via WinRM and Winrs
+  file: endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.test.yml

@@ -0,0 +1,12 @@
+name: Scheduled Task Creation on Remote Endpoint using At Unit Test
+tests:
+- name: Scheduled Task Creation on Remote Endpoint using At
+  file: endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/lateral_movement/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/scheduled_task_initiation_on_remote_endpoint.test.yml

@@ -0,0 +1,12 @@
+name: Scheduled Task Initiation on Remote Endpoint Unit Test
+tests:
+- name: Scheduled Task Initiation on Remote Endpoint
+  file: endpoint/scheduled_task_initiation_on_remote_endpoint.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_service_creation_on_remote_endpoint.test.yml

@@ -0,0 +1,12 @@
+name: Windows Service Creation on Remote Endpoint Unit Test
+tests:
+- name: Windows Service Creation on Remote Endpoint
+  file: endpoint/windows_service_creation_on_remote_endpoint.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_service_initiation_on_remote_endpoint.test.yml

@@ -0,0 +1,12 @@
+name: Windows Service Initiation on Remote Endpoint Unit Test
+tests:
+- name: Windows Service Initiation on Remote Endpoint
+  file: endpoint/windows_service_initiation_on_remote_endpoint.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog