Branch was auto-updated.

detections/endpoint/windows_gather_victim_identity_sam_info.yml

@@ -0,0 +1,67 @@
+name: Windows Gather Victim Identity SAM Info
+id: a18e85d7-8b98-4399-820c-d46a1ca3516f
+version: 1
+date: '2022-08-24'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic identifies a process that loads the samlib.dll module. 
+  This module is being abused by adversaries, threat actors and red teamers to access information of SAM objects or access credentials information in DC. 
+  This hunting query can be a good indicator that a process is capable of accessing the SAM object.
+search: '`sysmon` EventCode=7  (ImageLoaded = "*\\samlib.dll" AND OriginalFileName = "samlib.dll") OR (ImageLoaded = "*\\samcli.dll" AND OriginalFileName = "SAMCLI.DLL")
+AND NOT (Image IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*"))
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_gather_victim_identity_sam_info_filter`'
+how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will 
+  add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
+known_false_positives: this module can be loaded by a third party application. Filter is needed.
+references:
+- https://redcanary.com/blog/active-breach-evading-defenses/
+- https://strontic.github.io/xcyclopedia/library/samlib.dll-0BDF6351009F6EBA5BA7E886F23263B1.html
+tags:
+  analytic_story:
+  - Brute Ratel C4
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/loading_samlib/sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $Computer$ that loads $ImageLoaded$ that are related to accessing to SAM object information.
+  mitre_attack_id:
+  - T1589.001
+  - T1589
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image 
+  - ImageLoaded 
+  - Computer 
+  - EventCode 
+  - Signed 
+  - ProcessId 
+  risk_score: 9
+  security_domain: endpoint

detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml

@@ -0,0 +1,68 @@
+name: Windows Hijack Execution Flow Version Dll Side Load
+id: 8351340b-ac0e-41ec-8b07-dd01bf32d6ea
+version: 1
+date: '2022-08-24'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to detect a process loading version.dll that is not in %windir%\\system32 or %windir%\\syswow64 dir path. 
+  This event is seen in ransomware and APT malware that executes malicious version.dll placed in the same folder of onedrive application 
+  that will execute that module. This technique is known to be DLL side loading. This technique was used to execute an agent of 
+  Brute Ratel C4 red teaming tools to serve as remote admin tool to collect and compromise target host.
+search: '`sysmon` EventCode=7  
+  ImageLoaded = "*\\version.dll" AND (Signed = "false" OR NOT(ImageLoaded IN("*\\windows\\system32*",  "*\\windows\\syswow64\\*"))) 
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_hijack_execution_flow_version_dll_side_load_filter`'
+how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will 
+  add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
+known_false_positives: unknown
+references:
+- https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/
+tags:
+  analytic_story:
+  - Brute Ratel C4
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: a process $Image$ loading $ImageLoaded$ as a side load dll in $Computer$
+  mitre_attack_id:
+  - T1574.001
+  - T1574
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - ImageLoaded
+  - process_name
+  - Computer
+  - EventCode
+  - Signed
+  - ProcessId 
+  risk_score: 35
+  security_domain: endpoint

detections/endpoint/windows_input_capture_using_credential_ui_dll.yml

@@ -0,0 +1,70 @@
+name: Windows Input Capture Using Credential UI Dll
+id: 406c21d6-6c75-4e9f-9ca9-48049a1dd90e
+version: 1
+date: '2022-08-24'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic identifies a process that loads the credui.dll module. 
+  This legitimate module is typically abused by adversaries, threat actors and red teamers to create a credential UI prompt 
+  dialog box to lure users for possible credential theft or can be used to dump the credentials of a targeted host. 
+  This hunting query is a good pivot to check why the process loaded this dll and if it is a legitimate file. 
+  This hunting query may hit false positive for a third party application that uses a credential login UI for user login.
+search: '`sysmon` EventCode=7  (ImageLoaded = "*\\credui.dll" AND OriginalFileName = "credui.dll") OR (ImageLoaded = "*\\wincredui.dll" AND OriginalFileName = "wincredui.dll")
+  AND NOT(Image IN("*\\windows\\explorer.exe", "*\\windows\\system32\\*", "*\\windows\\sysWow64\\*", "*:\\program files*"))
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded OriginalFileName Computer EventCode Signed ProcessId ProcessGuid
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_input_capture_using_credential_ui_dll_filter`'
+how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will 
+  add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
+known_false_positives: this module can be loaded by a third party application. Filter is needed.
+references:
+- https://docs.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa
+- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password
+tags:
+  analytic_story:
+  - Brute Ratel C4
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: a process $Image$ loaded $ImageLoaded$ in $Computer$
+  mitre_attack_id:
+  - T1056.002
+  - T1056
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - ImageLoaded
+  - process_name
+  - Computer
+  - EventCode
+  - Signed
+  - ProcessId 
+  risk_score: 9
+  security_domain: endpoint

detections/endpoint/windows_phishing_recent_iso_exec_registry.yml

@@ -0,0 +1,68 @@
+name: Windows Phishing Recent ISO Exec Registry
+id: cb38ee66-8ae5-47de-bd66-231c7bbc0b2c
+version: 1
+date: '2022-08-24'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic identifies registry artifacts when an ISO container is opened, clicked or mounted on the Windows operating system.
+  As Microsoft makes changes to macro based document execution, adversaries have begun to utilize container based initial access based phishing campaigns to evade preventative controls. 
+  Once the ISO is clicked or mounted it will create a registry artifact related to this event as a recent application executed or opened.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_key_name= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.iso" 
+  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_phishing_recent_iso_exec_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process 
+  that include the name of the process responsible for the changes from your endpoints into the `Endpoint` 
+  datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed 
+  and the latest TA for the endpoint product.
+known_false_positives: False positives may be high depending on the environment and consistent use of ISOs. 
+  Restrict to servers, or filter out based on commonly used ISO names. Filter as needed.
+references:
+- https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
+- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/
+tags:
+  analytic_story:
+  - Brute Ratel C4
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Delivery
+  message: An ISO file was mounted on $dest$ and should be reviewed and filtered as needed.
+  mitre_attack_id:
+  - T1566.001
+  - T1566
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name 
+  - Registry.user 
+  - Registry.registry_path 
+  - Registry.registry_value_data 
+  - Registry.action 
+  - Registry.dest 
+  risk_score: 40
+  security_domain: endpoint

detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml

@@ -0,0 +1,79 @@
+name: Windows Remote Access Software BRC4 Loaded Dll
+id: 73cf5dcb-cf36-4167-8bbe-384fe5384d05
+version: 1
+date: '2022-08-24'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following anomaly detection identifies the behavior related to 4 native Windows DLLs being loaded by a non-standard process. 
+  Identified by MDSec during their research into Brute Ratel, MDSec identified a high signal analytic by calling out these 4 DLLs being loaded 
+  into a process. LogonCLI.dll is the Net Logon Client DLL and is related to users and other domain services to get authenticated. Credui.dll 
+  is Credential Manager User Interface. Credential managers receive notifications when authentication information changes. 
+  For example, credential managers are notified when a user logs on or an account password changes. 
+  Samcli.dll is the Security Accounts Manager Client DLL. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) 
+  database either through in-memory techniques or through the Windows Registry where the SAM database is stored. 
+  Dbghelp.dll is Windows Image Helper. Windows Image Helper is commonly seen in credential dumping due to native functions. 
+  All of these modules are important to monitor and track and combined may lead to credentail access or dumping.
+search: '`sysmon` EventCode=7 
+  |bin _time span=30s
+  | eval BRC4_AnomalyLoadedDll=case(OriginalFileName=="credui.dll", 1, OriginalFileName=="DBGHELP.DLL", 1, OriginalFileName=="SAMCLI.DLL", 1, OriginalFileName=="winhttp.dll", 1, 1=1, 0)
+  | eval BRC4_LoadedDllPath=case(match(ImageLoaded, "credui.dll"), 1, match(ImageLoaded, "dbghelp.dll"), 1, match(ImageLoaded, "samcli.dll"), 1, match(ImageLoaded, "winhttp.dll"), 1, 1=1, 0)
+  | stats count min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as ImageLoaded values(OriginalFileName) as OriginalFileName dc(ImageLoaded) as ImageLoadedCount by Image  BRC4_LoadedDllPath BRC4_AnomalyLoadedDll Computer EventCode Signed
+  | where  ImageLoadedCount == 4 AND (BRC4_LoadedDllPath == 1 OR BRC4_AnomalyLoadedDll == 1)
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_remote_access_software_brc4_loaded_dll_filter`'
+how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will 
+  add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
+known_false_positives: This module can be loaded by a third party application. Filter is needed.
+references:
+- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/
+- https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/
+- https://strontic.github.io/xcyclopedia/library/logoncli.dll-138871DBE68D0696D3D7FA91BC2873B1.html
+- https://strontic.github.io/xcyclopedia/library/credui.dll-A5BD797BBC2DD55231B9DE99837E5461.html
+- https://docs.microsoft.com/en-us/windows/win32/secauthn/credential-manager
+- https://strontic.github.io/xcyclopedia/library/samcli.dll-522D6D616EF142CDE965BD3A450A9E4C.html
+- https://strontic.github.io/xcyclopedia/library/dbghelp.dll-15A55EAB307EF8C190FE6135C0A86F7C.html
+tags:
+  analytic_story:
+  - Brute Ratel C4
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: a process $Image$ loaded several modules $ImageLoaded$ that might related to credential access on $Computer$.
+  mitre_attack_id:
+  - T1219
+  - T1003
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - ImageLoaded
+  - process_name
+  - Computer
+  - EventCode
+  - Signed
+  - ProcessId 
+  risk_score: 9
+  security_domain: endpoint

tests/endpoint/windows_gather_victim_identity_sam_info.test.yml

@@ -0,0 +1,13 @@
+name: Windows Gather Victim Identity SAM Info Unit Test
+tests:
+- name: Windows Gather Victim Identity SAM Info
+  file: endpoint/windows_gather_victim_identity_sam_info.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/loading_samlib/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_hijack_execution_flow_version_dll_side_load.test.yml

@@ -0,0 +1,13 @@
+name: Windows Hijack Execution Flow Version Dll Side Load Unit Test
+tests:
+- name: Windows Hijack Execution Flow Version Dll Side Load
+  file: endpoint/windows_hijack_execution_flow_version_dll_side_load.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_input_capture_using_credential_ui_dll.test.yml

@@ -0,0 +1,13 @@
+name: Windows Input Capture Using Credential UI Dll Unit Test
+tests:
+- name: Windows Input Capture Using Credential UI Dll
+  file: endpoint/windows_input_capture_using_credential_ui_dll.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_phishing_recent_iso_exec_registry.test.yml

@@ -0,0 +1,13 @@
+name: Windows Phishing Recent ISO Exec Registry Unit Test
+tests:
+- name: Windows Phishing Recent ISO Exec Registry
+  file: endpoint/windows_phishing_recent_iso_exec_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_remote_access_software_brc4_loaded_dll.test.yml

@@ -0,0 +1,13 @@
+name: Windows Remote Access Software BRC4 Loaded Dll Unit Test
+tests:
+- name: Windows Remote Access Software BRC4 Loaded Dll
+  file: endpoint/windows_remote_access_software_brc4_loaded_dll.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true