From 47087cfc088a363b4b158764e2800a3e7b5ddc61 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 11 Nov 2021 17:23:13 -0500 Subject: [PATCH 01/13] initial 5 new detections and update on existing --- ...cess_instantiation_via_winrm_and_winrs.yml | 66 ++++++++++++++++++ .../remote_process_instantiation_via_wmi.yml | 1 + ...k_creation_on_remote_endpoint_using_at.yml | 69 +++++++++++++++++++ ...led_task_initiation_on_remote_endpoint.yml | 66 ++++++++++++++++++ ...htasks_scheduling_job_on_remote_system.yml | 19 ++--- ...ws_service_creation_on_remote_endpoint.yml | 67 ++++++++++++++++++ ..._service_initiation_on_remote_endpoint.yml | 66 ++++++++++++++++++ ...instantiation_via_winrm_and_winrs.test.yml | 12 ++++ ...ation_on_remote_endpoint_using_at.test.yml | 12 ++++ ...ask_initiation_on_remote_endpoint.test.yml | 12 ++++ ...rvice_creation_on_remote_endpoint.test.yml | 12 ++++ ...ice_initiation_on_remote_endpoint.test.yml | 12 ++++ 12 files changed, 405 insertions(+), 9 deletions(-) create mode 100644 detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml create mode 100644 detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml create mode 100644 detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml create mode 100644 detections/endpoint/windows_service_creation_on_remote_endpoint.yml create mode 100644 detections/endpoint/windows_service_initiation_on_remote_endpoint.yml create mode 100644 tests/endpoint/remote_process_instantiation_via_winrm_and_winrs.test.yml create mode 100644 tests/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.test.yml create mode 100644 tests/endpoint/scheduled_task_initiation_on_remote_endpoint.test.yml create mode 100644 tests/endpoint/windows_service_creation_on_remote_endpoint.test.yml create mode 100644 tests/endpoint/windows_service_initiation_on_remote_endpoint.test.yml diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml new file mode 100644 index 0000000000..2eb1aa4618 --- /dev/null +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml @@ -0,0 +1,66 @@ +name: Remote Process Instantiation via WinRM and Winrs +id: 0dd296a2-4338-11ec-ba02-3e22fbd008af +version: 1 +date: '2021-11-11' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic looks for the execution of `winrs.exe` with command-line + arguments utilized to start a process on a remote endpoint. Red Teams and adversaries + alike may abuse the WinRM protocol and this binary for lateral movement and remote code execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=winrs.exe + OR Processes.original_file_name=winrs.exe) (Processes.process="*-r:*" OR Processes.process="*-remote:*") + by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_winrm_and_winrs_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your endpoints. +known_false_positives: Administrators may leverage WinRM and WinRs to start a process on remote systems, but this + activity is usually limited to a small set of hosts or users. +references: +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/winrs +- https://attack.mitre.org/techniques/T1021/006/ +tags: + analytic_story: + - Lateral Movement + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1021 + - T1021.006 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 90 + confidence: 60 + risk_score: 54 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: A process was started on a remote endpoint from $dest + observable: + - name: dest + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 5d4cd583e0..b52f3ac89a 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -27,6 +27,7 @@ tags: analytic_story: - Ransomware - Suspicious WMI Use + - Lateral Movement asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml new file mode 100644 index 0000000000..c78f94a4ee --- /dev/null +++ b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml @@ -0,0 +1,69 @@ +name: Scheduled Task Creation on Remote Endpoint using At +id: 4be54858-432f-11ec-8209-3e22fbd008af +version: 1 +date: '2021-11-11' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic looks for the execution of `at.exe` with command-line + arguments utilized to create a Scheduled Task on a remote endpoint. Red Teams and adversaries + alike may abuse the Task Scheduler for lateral movement and remote code execution. The `at.exe` + binary internally leverages the AT protocol which was deprecated starting with Windows 8 and Windows Server 2012 + but may still work on previous versions of Windows. Furthermore, attackers may enable this protocol on demand by + changing a sytem registry key. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=at.exe + OR Processes.original_file_name=at.exe) (Processes.process=*\\\\*) + by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_creation_on_remote_endpoint_using_at_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your endpoints. +known_false_positives: Administrators may create scheduled tasks on remote systems, but this + activity is usually limited to a small set of hosts or users. +references: +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/at +- https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob?redirectedfrom=MSDN +tags: + analytic_story: + - Lateral Movement + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1053 + - T1053.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 90 + confidence: 60 + risk_score: 54 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: A Windows Scheduled Task was created on a remote endpoint from $dest + observable: + - name: dest + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml new file mode 100644 index 0000000000..0247b34036 --- /dev/null +++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml @@ -0,0 +1,66 @@ +name: Scheduled Task Initiation on Remote Endpoint +id: 95cf4608-4302-11ec-8194-3e22fbd008af +version: 1 +date: '2021-11-11' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic looks for the execution of `schtasks.exe` with command-line + arguments utilized to start a Scheduled Task on a remote endpoint. Red Teams and + adversaries alike may abuse the Task Scheduler for lateral movement and remote code execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=schtasks.exe + OR Processes.original_file_name=schtasks.exe) (Processes.process=*/s* AND Processes.process=*/run*) + by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_initiation_on_remote_endpoint_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your endpoints. +known_false_positives: Administrators may start scheduled tasks on remote systems, but this + activity is usually limited to a small set of hosts or users. +references: +- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks +- https://attack.mitre.org/techniques/T1053/005/ +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1053 + - T1053.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 90 + confidence: 60 + risk_score: 54 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: A Windows Scheduled Task was ran on a remote endpoint from $dest + observable: + - name: dest + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index 11496da387..75d1c0382b 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -1,17 +1,18 @@ name: Schtasks scheduling job on remote system id: 1297fb80-f42a-4b4a-9c8a-88c066237cf6 -version: 4 -date: '2020-07-21' -author: David Dorsey, Splunk +version: 5 +date: '2021-11-11' +author: David Dorsey, Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: This search looks for flags passed to schtasks.exe on the command-line - that indicate a job is being scheduled on a remote system. +description: This analytic looks for the execution of `schtasks.exe` with command-line + arguments utilized to create a Scheduled Task on a remote endpoint. Red Teams and + adversaries alike may abuse the Task Scheduler for lateral movement and remote code execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name = schtasks.exe - Processes.process="*/create*" (Processes.process="* /s *" OR Processes.process="* - /S *") by Processes.process_name Processes.process Processes.parent_process_name + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = schtasks.exe + OR Processes.original_file_name=schtasks.exe) (Processes.process="*/create*" AND Processes.process="*/s*") + by Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `schtasks_scheduling_job_on_remote_system_filter`' how_to_implement: You must be ingesting data that records process activity from your @@ -19,7 +20,7 @@ how_to_implement: You must be ingesting data that records process activity from ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -known_false_positives: Administrators may create jobs on remote systems, but this +known_false_positives: Administrators may create scheduled tasks on remote systems, but this activity is usually limited to a small set of hosts or users. It is important to validate and investigate as appropriate. references: [] diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml new file mode 100644 index 0000000000..7b5eda3227 --- /dev/null +++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml @@ -0,0 +1,67 @@ +name: Windows Service Creation on Remote Endpoint +id: e0eea4fa-4274-11ec-882b-3e22fbd008af +version: 1 +date: '2021-11-10' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic looks for the execution of `sc.exe` with command-line + arguments utilized to create a Windows Service on a remote endpoint. Red Teams and + adversaries alike may abuse the Service Control Manager for lateral movement and remote code execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe + OR Processes.original_file_name=“sc.exe”) (Processes.process=*\\\\* AND Processes.process=*create* + AND Processes.process=*binpath*) by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_creation_on_remote_endpoint_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your endpoints. +known_false_positives: Administrators may create Windows Services on remote systems, but this + activity is usually limited to a small set of hosts or users. +references: +- https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager +- https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc +- https://attack.mitre.org/techniques/T1543/003/ +tags: + analytic_story: + - Lateral Movement + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1543 + - T1543.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 90 + confidence: 60 + risk_score: 54 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: A Windows Service was created on a remote endpoint from $dest + observable: + - name: dest + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml new file mode 100644 index 0000000000..836d17453b --- /dev/null +++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml @@ -0,0 +1,66 @@ +name: Windows Service Initiation on Remote Endpoint +id: 3f519894-4276-11ec-ab02-3e22fbd008af +version: 1 +date: '2021-11-10' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic looks for the execution of `sc.exe` with command-line + arguments utilized to start a Windows Service on a remote endpoint. Red Teams and + adversaries alike may abuse the Service Control Manager for lateral movement and remote code execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe + OR Processes.original_file_name=“sc.exe”) (Processes.process=*\\\\* AND Processes.process=*start*) + by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_initiation_on_remote_endpoint_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your endpoints. +known_false_positives: Administrators may start Windows Services on remote systems, but this + activity is usually limited to a small set of hosts or users. +references: +- https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc +- https://attack.mitre.org/techniques/T1543/003/ +tags: + analytic_story: + - Lateral Movement + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1543 + - T1543.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 90 + confidence: 60 + risk_score: 54 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: A Windows Service was started on a remote endpoint from $dest + observable: + - name: dest + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/tests/endpoint/remote_process_instantiation_via_winrm_and_winrs.test.yml b/tests/endpoint/remote_process_instantiation_via_winrm_and_winrs.test.yml new file mode 100644 index 0000000000..d9562b8e56 --- /dev/null +++ b/tests/endpoint/remote_process_instantiation_via_winrm_and_winrs.test.yml @@ -0,0 +1,12 @@ +name: Remote Process Instantiation via WinRM and Winrs Unit Test +tests: +- name: Remote Process Instantiation via WinRM and Winrs + file: endpoint/remote_process_instantiation_via_winrm_and_winrs.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.test.yml b/tests/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.test.yml new file mode 100644 index 0000000000..4cd61fc0cd --- /dev/null +++ b/tests/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.test.yml @@ -0,0 +1,12 @@ +name: Scheduled Task Creation on Remote Endpoint using At Unit Test +tests: +- name: Scheduled Task Creation on Remote Endpoint using At + file: endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/scheduled_task_initiation_on_remote_endpoint.test.yml b/tests/endpoint/scheduled_task_initiation_on_remote_endpoint.test.yml new file mode 100644 index 0000000000..e7ccafb22e --- /dev/null +++ b/tests/endpoint/scheduled_task_initiation_on_remote_endpoint.test.yml @@ -0,0 +1,12 @@ +name: Scheduled Task Initiation on Remote Endpoint Unit Test +tests: +- name: Scheduled Task Initiation on Remote Endpoint + file: endpoint/scheduled_task_initiation_on_remote_endpoint.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/windows_service_creation_on_remote_endpoint.test.yml b/tests/endpoint/windows_service_creation_on_remote_endpoint.test.yml new file mode 100644 index 0000000000..4f1cbdcfd9 --- /dev/null +++ b/tests/endpoint/windows_service_creation_on_remote_endpoint.test.yml @@ -0,0 +1,12 @@ +name: Windows Service Creation on Remote Endpoint Unit Test +tests: +- name: Windows Service Creation on Remote Endpoint + file: endpoint/windows_service_creation_on_remote_endpoint.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: UPDATE_DATASET_URL + source: WinEventLog:Security + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/windows_service_initiation_on_remote_endpoint.test.yml b/tests/endpoint/windows_service_initiation_on_remote_endpoint.test.yml new file mode 100644 index 0000000000..8af1d57b6a --- /dev/null +++ b/tests/endpoint/windows_service_initiation_on_remote_endpoint.test.yml @@ -0,0 +1,12 @@ +name: Windows Service Initiation on Remote Endpoint Unit Test +tests: +- name: Windows Service Initiation on Remote Endpoint + file: endpoint/windows_service_initiation_on_remote_endpoint.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: UPDATE_DATASET_URL + source: WinEventLog:Security + sourcetype: WinEventLog \ No newline at end of file From b237b096bc834729da352f592c8c1ddc362b8ec6 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 12 Nov 2021 10:51:35 -0500 Subject: [PATCH 02/13] updating detection --- .../remote_process_instantiation_via_wmi.yml | 25 +++++++++++-------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index b52f3ac89a..0894e40d07 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -1,19 +1,20 @@ name: Remote Process Instantiation via WMI id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da -version: 6 -date: '2020-11-30' -author: Rico Valdez, Splunk +version: 7 +date: '2021-11-12' +author: Rico Valdez, Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint description: This analytic identifies wmic.exe being launched with parameters to spawn - a process on a remote system. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_wmic` Processes.process="*/node*" Processes.process="*process*" Processes.process="*call*" - Processes.process="*create*" by Processes.process_name Processes.original_file_name - Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_filter`' + a process on a remote system. Red Teams and adversaries alike may abuse WMI and this binary + for lateral movement and remote code execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_wmic` (Processes.process="*/node:*" AND + Processes.process="*process*" AND Processes.process="*call*" AND Processes.process="*create*") by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -22,7 +23,9 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: The wmic.exe utility is a benign Windows application. It may be used legitimately by Administrators with these parameters for remote system administration, but it's relatively uncommon. -references: [] +references: +- https://attack.mitre.org/techniques/T1047/ +- https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/create-method-in-class-win32-process tags: analytic_story: - Ransomware From a1a28600d0e25048dc37975f91b5a1071a11f4c7 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 12 Nov 2021 13:11:10 -0500 Subject: [PATCH 03/13] datasets ready --- .../remote_process_instantiation_via_winrm_and_winrs.yml | 2 +- ...cheduled_task_creation_on_remote_endpoint_using_at.yml | 2 +- .../scheduled_task_initiation_on_remote_endpoint.yml | 4 ++-- .../windows_service_creation_on_remote_endpoint.yml | 2 +- .../windows_service_initiation_on_remote_endpoint.yml | 2 +- ...led_task_creation_on_remote_endpoint_using_at.test.yml | 8 ++++---- .../scheduled_task_initiation_on_remote_endpoint.test.yml | 8 ++++---- .../windows_service_creation_on_remote_endpoint.test.yml | 6 +++--- ...windows_service_initiation_on_remote_endpoint.test.yml | 6 +++--- 9 files changed, 20 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml index 2eb1aa4618..e5ad345aaf 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml @@ -27,7 +27,7 @@ tags: analytic_story: - Lateral Movement dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement/windows-sysmon.log kill_chain_phases: - Lateral Movement mitre_attack_id: diff --git a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml index c78f94a4ee..6bbe83715a 100644 --- a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml +++ b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml @@ -30,7 +30,7 @@ tags: analytic_story: - Lateral Movement dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/lateral_movement/windows-sysmon.log kill_chain_phases: - Lateral Movement mitre_attack_id: diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml index 0247b34036..8bf3a65b38 100644 --- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml @@ -25,9 +25,9 @@ references: - https://attack.mitre.org/techniques/T1053/005/ tags: analytic_story: - - UPDATE_STORY_NAME + - Lateral Movement dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-sysmon.log kill_chain_phases: - Lateral Movement mitre_attack_id: diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml index 7b5eda3227..bf5c360767 100644 --- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml @@ -28,7 +28,7 @@ tags: analytic_story: - Lateral Movement dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log kill_chain_phases: - Lateral Movement mitre_attack_id: diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml index 836d17453b..1525fb234f 100644 --- a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml @@ -27,7 +27,7 @@ tags: analytic_story: - Lateral Movement dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log kill_chain_phases: - Lateral Movement mitre_attack_id: diff --git a/tests/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.test.yml b/tests/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.test.yml index 4cd61fc0cd..41121f824e 100644 --- a/tests/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.test.yml +++ b/tests/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/lateral_movement/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/scheduled_task_initiation_on_remote_endpoint.test.yml b/tests/endpoint/scheduled_task_initiation_on_remote_endpoint.test.yml index e7ccafb22e..fe3fb1004b 100644 --- a/tests/endpoint/scheduled_task_initiation_on_remote_endpoint.test.yml +++ b/tests/endpoint/scheduled_task_initiation_on_remote_endpoint.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/windows_service_creation_on_remote_endpoint.test.yml b/tests/endpoint/windows_service_creation_on_remote_endpoint.test.yml index 4f1cbdcfd9..671ac28632 100644 --- a/tests/endpoint/windows_service_creation_on_remote_endpoint.test.yml +++ b/tests/endpoint/windows_service_creation_on_remote_endpoint.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: UPDATE_DATASET_URL - source: WinEventLog:Security - sourcetype: WinEventLog \ No newline at end of file + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/windows_service_initiation_on_remote_endpoint.test.yml b/tests/endpoint/windows_service_initiation_on_remote_endpoint.test.yml index 8af1d57b6a..025b64d96c 100644 --- a/tests/endpoint/windows_service_initiation_on_remote_endpoint.test.yml +++ b/tests/endpoint/windows_service_initiation_on_remote_endpoint.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: UPDATE_DATASET_URL - source: WinEventLog:Security - sourcetype: WinEventLog \ No newline at end of file + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 44d590dc2b185d5b27dc1632aa163499afbaa345 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 12 Nov 2021 13:14:45 -0500 Subject: [PATCH 04/13] fixing test file --- ...ote_process_instantiation_via_winrm_and_winrs.test.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/endpoint/remote_process_instantiation_via_winrm_and_winrs.test.yml b/tests/endpoint/remote_process_instantiation_via_winrm_and_winrs.test.yml index d9562b8e56..8458cfc152 100644 --- a/tests/endpoint/remote_process_instantiation_via_winrm_and_winrs.test.yml +++ b/tests/endpoint/remote_process_instantiation_via_winrm_and_winrs.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From d5d2b60068a14e01cd3773b6cbe4b3a81a69e3ad Mon Sep 17 00:00:00 2001 From: root Date: Fri, 12 Nov 2021 19:22:34 +0000 Subject: [PATCH 05/13] Added detection testing service results inScheduled Task Initiation on Remote Endpoint --- ...led_task_initiation_on_remote_endpoint.yml | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml index 8bf3a65b38..74a2245062 100644 --- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml @@ -7,19 +7,20 @@ type: TTP datamodel: - Endpoint description: This analytic looks for the execution of `schtasks.exe` with command-line - arguments utilized to start a Scheduled Task on a remote endpoint. Red Teams and - adversaries alike may abuse the Task Scheduler for lateral movement and remote code execution. + arguments utilized to start a Scheduled Task on a remote endpoint. Red Teams and + adversaries alike may abuse the Task Scheduler for lateral movement and remote code + execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=schtasks.exe OR Processes.original_file_name=schtasks.exe) (Processes.process=*/s* AND Processes.process=*/run*) - by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_initiation_on_remote_endpoint_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your endpoints. -known_false_positives: Administrators may start scheduled tasks on remote systems, but this - activity is usually limited to a small set of hosts or users. + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Administrators may start scheduled tasks on remote systems, + but this activity is usually limited to a small set of hosts or users. references: - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks - https://attack.mitre.org/techniques/T1053/005/ @@ -52,7 +53,7 @@ tags: - Processes.parent_process_id security_domain: endpoint impact: 90 - confidence: 60 + confidence: 60 risk_score: 54 context: - Source:Endpoint @@ -63,4 +64,4 @@ tags: type: Endpoint role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 2f871fbe6f1e3410874dddac247751284f48f6f4 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 12 Nov 2021 19:22:53 +0000 Subject: [PATCH 06/13] Added detection testing service results inScheduled Task Creation on Remote Endpoint using At --- ...k_creation_on_remote_endpoint_using_at.yml | 27 ++++++++++--------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml index 6bbe83715a..886e19be11 100644 --- a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml +++ b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml @@ -6,23 +6,24 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: This analytic looks for the execution of `at.exe` with command-line - arguments utilized to create a Scheduled Task on a remote endpoint. Red Teams and adversaries - alike may abuse the Task Scheduler for lateral movement and remote code execution. The `at.exe` - binary internally leverages the AT protocol which was deprecated starting with Windows 8 and Windows Server 2012 - but may still work on previous versions of Windows. Furthermore, attackers may enable this protocol on demand by - changing a sytem registry key. +description: This analytic looks for the execution of `at.exe` with command-line arguments + utilized to create a Scheduled Task on a remote endpoint. Red Teams and adversaries + alike may abuse the Task Scheduler for lateral movement and remote code execution. + The `at.exe` binary internally leverages the AT protocol which was deprecated starting + with Windows 8 and Windows Server 2012 but may still work on previous versions of + Windows. Furthermore, attackers may enable this protocol on demand by changing a + sytem registry key. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=at.exe - OR Processes.original_file_name=at.exe) (Processes.process=*\\\\*) - by Processes.dest + OR Processes.original_file_name=at.exe) (Processes.process=*\\\\*) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_creation_on_remote_endpoint_using_at_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your endpoints. -known_false_positives: Administrators may create scheduled tasks on remote systems, but this - activity is usually limited to a small set of hosts or users. + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Administrators may create scheduled tasks on remote systems, + but this activity is usually limited to a small set of hosts or users. references: - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/at - https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob?redirectedfrom=MSDN @@ -55,7 +56,7 @@ tags: - Processes.parent_process_id security_domain: endpoint impact: 90 - confidence: 60 + confidence: 60 risk_score: 54 context: - Source:Endpoint @@ -66,4 +67,4 @@ tags: type: Endpoint role: - Victim - \ No newline at end of file + automated_detection_testing: passed From aebcc438f4e8f586944a7b40a39eb9c5232dc2ee Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 12 Nov 2021 14:45:56 -0500 Subject: [PATCH 07/13] fixing test yml --- .../remote_process_instantiation_via_winrm_and_winrs.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/remote_process_instantiation_via_winrm_and_winrs.test.yml b/tests/endpoint/remote_process_instantiation_via_winrm_and_winrs.test.yml index 8458cfc152..ae91c93058 100644 --- a/tests/endpoint/remote_process_instantiation_via_winrm_and_winrs.test.yml +++ b/tests/endpoint/remote_process_instantiation_via_winrm_and_winrs.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/atomic_red_team/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog From 1307c28bf1a9265688bac19bc96f668a41ee7fd5 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 12 Nov 2021 20:05:57 +0000 Subject: [PATCH 08/13] Added detection testing service results inRemote Process Instantiation via WinRM and Winrs --- ...cess_instantiation_via_winrm_and_winrs.yml | 20 ++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml index e5ad345aaf..9f9c31b4f9 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml @@ -8,18 +8,20 @@ datamodel: - Endpoint description: This analytic looks for the execution of `winrs.exe` with command-line arguments utilized to start a process on a remote endpoint. Red Teams and adversaries - alike may abuse the WinRM protocol and this binary for lateral movement and remote code execution. + alike may abuse the WinRM protocol and this binary for lateral movement and remote + code execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=winrs.exe OR Processes.original_file_name=winrs.exe) (Processes.process="*-r:*" OR Processes.process="*-remote:*") - by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_winrm_and_winrs_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your endpoints. -known_false_positives: Administrators may leverage WinRM and WinRs to start a process on remote systems, but this - activity is usually limited to a small set of hosts or users. + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Administrators may leverage WinRM and WinRs to start a process + on remote systems, but this activity is usually limited to a small set of hosts + or users. references: - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/winrs - https://attack.mitre.org/techniques/T1021/006/ @@ -52,7 +54,7 @@ tags: - Processes.parent_process_id security_domain: endpoint impact: 90 - confidence: 60 + confidence: 60 risk_score: 54 context: - Source:Endpoint @@ -63,4 +65,4 @@ tags: type: Endpoint role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 4c7108e0a3fa965136abf14927ef16a26a95c53b Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 12 Nov 2021 15:06:16 -0500 Subject: [PATCH 09/13] fixing unsupported character --- .../endpoint/windows_service_creation_on_remote_endpoint.yml | 2 +- .../endpoint/windows_service_initiation_on_remote_endpoint.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml index bf5c360767..236274d15b 100644 --- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml @@ -11,7 +11,7 @@ description: This analytic looks for the execution of `sc.exe` with command-line adversaries alike may abuse the Service Control Manager for lateral movement and remote code execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe - OR Processes.original_file_name=“sc.exe”) (Processes.process=*\\\\* AND Processes.process=*create* + OR Processes.original_file_name=sc.exe) (Processes.process=*\\\\* AND Processes.process=*create* AND Processes.process=*binpath*) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml index 1525fb234f..a43b05efb5 100644 --- a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml @@ -11,7 +11,7 @@ description: This analytic looks for the execution of `sc.exe` with command-line adversaries alike may abuse the Service Control Manager for lateral movement and remote code execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe - OR Processes.original_file_name=“sc.exe”) (Processes.process=*\\\\* AND Processes.process=*start*) + OR Processes.original_file_name=sc.exe) (Processes.process=*\\\\* AND Processes.process=*start*) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` From 8ff650ebe862434e4ea7610d3203e1109bd7e0ea Mon Sep 17 00:00:00 2001 From: root Date: Fri, 12 Nov 2021 20:56:33 +0000 Subject: [PATCH 10/13] Added detection testing service results inWindows Service Creation on Remote Endpoint --- ...ws_service_creation_on_remote_endpoint.yml | 24 ++++++++++--------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml index 236274d15b..ab55d5ce1e 100644 --- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml @@ -6,20 +6,22 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: This analytic looks for the execution of `sc.exe` with command-line - arguments utilized to create a Windows Service on a remote endpoint. Red Teams and - adversaries alike may abuse the Service Control Manager for lateral movement and remote code execution. +description: This analytic looks for the execution of `sc.exe` with command-line arguments + utilized to create a Windows Service on a remote endpoint. Red Teams and adversaries + alike may abuse the Service Control Manager for lateral movement and remote code + execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe OR Processes.original_file_name=sc.exe) (Processes.process=*\\\\* AND Processes.process=*create* - AND Processes.process=*binpath*) by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_creation_on_remote_endpoint_filter`' + AND Processes.process=*binpath*) by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `windows_service_creation_on_remote_endpoint_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your endpoints. -known_false_positives: Administrators may create Windows Services on remote systems, but this - activity is usually limited to a small set of hosts or users. + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Administrators may create Windows Services on remote systems, + but this activity is usually limited to a small set of hosts or users. references: - https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager - https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc @@ -64,4 +66,4 @@ tags: type: Endpoint role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 159faea4c626df617f9cc171a6e3618e5d8deace Mon Sep 17 00:00:00 2001 From: root Date: Fri, 12 Nov 2021 20:56:41 +0000 Subject: [PATCH 11/13] Added detection testing service results inWindows Service Initiation on Remote Endpoint --- ..._service_initiation_on_remote_endpoint.yml | 23 ++++++++++--------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml index a43b05efb5..66394e80ff 100644 --- a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml @@ -6,20 +6,21 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: This analytic looks for the execution of `sc.exe` with command-line - arguments utilized to start a Windows Service on a remote endpoint. Red Teams and - adversaries alike may abuse the Service Control Manager for lateral movement and remote code execution. +description: This analytic looks for the execution of `sc.exe` with command-line arguments + utilized to start a Windows Service on a remote endpoint. Red Teams and adversaries + alike may abuse the Service Control Manager for lateral movement and remote code + execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe OR Processes.original_file_name=sc.exe) (Processes.process=*\\\\* AND Processes.process=*start*) - by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_initiation_on_remote_endpoint_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your endpoints. -known_false_positives: Administrators may start Windows Services on remote systems, but this - activity is usually limited to a small set of hosts or users. + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Administrators may start Windows Services on remote systems, + but this activity is usually limited to a small set of hosts or users. references: - https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc - https://attack.mitre.org/techniques/T1543/003/ @@ -52,7 +53,7 @@ tags: - Processes.parent_process_id security_domain: endpoint impact: 90 - confidence: 60 + confidence: 60 risk_score: 54 context: - Source:Endpoint @@ -63,4 +64,4 @@ tags: type: Endpoint role: - Victim - \ No newline at end of file + automated_detection_testing: passed From dcad854d1b771ab0b7a2225323f64505268a0462 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 12 Nov 2021 21:17:29 +0000 Subject: [PATCH 12/13] Added detection testing service results inRemote Process Instantiation via WMI --- .../remote_process_instantiation_via_wmi.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 0894e40d07..4a29b6ae73 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -7,13 +7,13 @@ type: TTP datamodel: - Endpoint description: This analytic identifies wmic.exe being launched with parameters to spawn - a process on a remote system. Red Teams and adversaries alike may abuse WMI and this binary - for lateral movement and remote code execution. + a process on a remote system. Red Teams and adversaries alike may abuse WMI and + this binary for lateral movement and remote code execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_wmic` (Processes.process="*/node:*" AND - Processes.process="*process*" AND Processes.process="*call*" AND Processes.process="*create*") by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + as lastTime from datamodel=Endpoint.Processes where `process_wmic` (Processes.process="*/node:*" + AND Processes.process="*process*" AND Processes.process="*call*" AND Processes.process="*create*") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from From c2f0b8d0f62a08b818db4aa2d3e4820e55905da0 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 12 Nov 2021 21:38:18 +0000 Subject: [PATCH 13/13] Added detection testing service results inSchtasks scheduling job on remote system --- .../schtasks_scheduling_job_on_remote_system.yml | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index 75d1c0382b..06696828bb 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -7,12 +7,13 @@ type: TTP datamodel: - Endpoint description: This analytic looks for the execution of `schtasks.exe` with command-line - arguments utilized to create a Scheduled Task on a remote endpoint. Red Teams and - adversaries alike may abuse the Task Scheduler for lateral movement and remote code execution. + arguments utilized to create a Scheduled Task on a remote endpoint. Red Teams and + adversaries alike may abuse the Task Scheduler for lateral movement and remote code + execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = schtasks.exe - OR Processes.original_file_name=schtasks.exe) (Processes.process="*/create*" AND Processes.process="*/s*") - by Processes.process_name Processes.process Processes.parent_process_name + OR Processes.original_file_name=schtasks.exe) (Processes.process="*/create*" AND + Processes.process="*/s*") by Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `schtasks_scheduling_job_on_remote_system_filter`' how_to_implement: You must be ingesting data that records process activity from your @@ -20,9 +21,9 @@ how_to_implement: You must be ingesting data that records process activity from ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -known_false_positives: Administrators may create scheduled tasks on remote systems, but this - activity is usually limited to a small set of hosts or users. It is important to - validate and investigate as appropriate. +known_false_positives: Administrators may create scheduled tasks on remote systems, + but this activity is usually limited to a small set of hosts or users. It is important + to validate and investigate as appropriate. references: [] tags: analytic_story: