diff --git a/detections/endpoint/windows_gather_victim_identity_sam_info.yml b/detections/endpoint/windows_gather_victim_identity_sam_info.yml new file mode 100644 index 0000000000..cf54501c99 --- /dev/null +++ b/detections/endpoint/windows_gather_victim_identity_sam_info.yml @@ -0,0 +1,67 @@ +name: Windows Gather Victim Identity SAM Info +id: a18e85d7-8b98-4399-820c-d46a1ca3516f +version: 1 +date: '2022-08-24' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following analytic identifies a process that loads the samlib.dll module. + This module is being abused by adversaries, threat actors and red teamers to access information of SAM objects or access credentials information in DC. + This hunting query can be a good indicator that a process is capable of accessing the SAM object. +search: '`sysmon` EventCode=7 (ImageLoaded = "*\\samlib.dll" AND OriginalFileName = "samlib.dll") OR (ImageLoaded = "*\\samcli.dll" AND OriginalFileName = "SAMCLI.DLL") +AND NOT (Image IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) + | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_gather_victim_identity_sam_info_filter`' +how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will + add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products. +known_false_positives: this module can be loaded by a third party application. Filter is needed. +references: +- https://redcanary.com/blog/active-breach-evading-defenses/ +- https://strontic.github.io/xcyclopedia/library/samlib.dll-0BDF6351009F6EBA5BA7E886F23263B1.html +tags: + analytic_story: + - Brute Ratel C4 + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 30 + context: + - Source:Endpoint + - Stage:Persistence + - Stage:Privilege Escalation + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/loading_samlib/sysmon.log + impact: 30 + kill_chain_phases: + - Exploitation + message: An instance of $Computer$ that loads $ImageLoaded$ that are related to accessing to SAM object information. + mitre_attack_id: + - T1589.001 + - T1589 + nist: + - DE.CM + observable: + - name: Computer + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - ImageLoaded + - Computer + - EventCode + - Signed + - ProcessId + risk_score: 9 + security_domain: endpoint diff --git a/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml b/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml new file mode 100644 index 0000000000..e03c69afb4 --- /dev/null +++ b/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml @@ -0,0 +1,68 @@ +name: Windows Hijack Execution Flow Version Dll Side Load +id: 8351340b-ac0e-41ec-8b07-dd01bf32d6ea +version: 1 +date: '2022-08-24' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect a process loading version.dll that is not in %windir%\\system32 or %windir%\\syswow64 dir path. + This event is seen in ransomware and APT malware that executes malicious version.dll placed in the same folder of onedrive application + that will execute that module. This technique is known to be DLL side loading. This technique was used to execute an agent of + Brute Ratel C4 red teaming tools to serve as remote admin tool to collect and compromise target host. +search: '`sysmon` EventCode=7 + ImageLoaded = "*\\version.dll" AND (Signed = "false" OR NOT(ImageLoaded IN("*\\windows\\system32*", "*\\windows\\syswow64\\*"))) + | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_hijack_execution_flow_version_dll_side_load_filter`' +how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will + add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products. +known_false_positives: unknown +references: +- https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/ +tags: + analytic_story: + - Brute Ratel C4 + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Persistence + - Stage:Privilege Escalation + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log + impact: 50 + kill_chain_phases: + - Exploitation + message: a process $Image$ loading $ImageLoaded$ as a side load dll in $Computer$ + mitre_attack_id: + - T1574.001 + - T1574 + nist: + - DE.CM + observable: + - name: Computer + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - ImageLoaded + - process_name + - Computer + - EventCode + - Signed + - ProcessId + risk_score: 35 + security_domain: endpoint diff --git a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml new file mode 100644 index 0000000000..ea308ddca3 --- /dev/null +++ b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml @@ -0,0 +1,70 @@ +name: Windows Input Capture Using Credential UI Dll +id: 406c21d6-6c75-4e9f-9ca9-48049a1dd90e +version: 1 +date: '2022-08-24' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following analytic identifies a process that loads the credui.dll module. + This legitimate module is typically abused by adversaries, threat actors and red teamers to create a credential UI prompt + dialog box to lure users for possible credential theft or can be used to dump the credentials of a targeted host. + This hunting query is a good pivot to check why the process loaded this dll and if it is a legitimate file. + This hunting query may hit false positive for a third party application that uses a credential login UI for user login. +search: '`sysmon` EventCode=7 (ImageLoaded = "*\\credui.dll" AND OriginalFileName = "credui.dll") OR (ImageLoaded = "*\\wincredui.dll" AND OriginalFileName = "wincredui.dll") + AND NOT(Image IN("*\\windows\\explorer.exe", "*\\windows\\system32\\*", "*\\windows\\sysWow64\\*", "*:\\program files*")) + | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded OriginalFileName Computer EventCode Signed ProcessId ProcessGuid + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_input_capture_using_credential_ui_dll_filter`' +how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will + add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products. +known_false_positives: this module can be loaded by a third party application. Filter is needed. +references: +- https://docs.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa +- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password +tags: + analytic_story: + - Brute Ratel C4 + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 30 + context: + - Source:Endpoint + - Stage:Persistence + - Stage:Privilege Escalation + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log + impact: 30 + kill_chain_phases: + - Exploitation + message: a process $Image$ loaded $ImageLoaded$ in $Computer$ + mitre_attack_id: + - T1056.002 + - T1056 + nist: + - DE.CM + observable: + - name: Computer + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - ImageLoaded + - process_name + - Computer + - EventCode + - Signed + - ProcessId + risk_score: 9 + security_domain: endpoint diff --git a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml new file mode 100644 index 0000000000..b82b44feeb --- /dev/null +++ b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml @@ -0,0 +1,68 @@ +name: Windows Phishing Recent ISO Exec Registry +id: cb38ee66-8ae5-47de-bd66-231c7bbc0b2c +version: 1 +date: '2022-08-24' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following hunting analytic identifies registry artifacts when an ISO container is opened, clicked or mounted on the Windows operating system. + As Microsoft makes changes to macro based document execution, adversaries have begun to utilize container based initial access based phishing campaigns to evade preventative controls. + Once the ISO is clicked or mounted it will create a registry artifact related to this event as a recent application executed or opened. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_key_name= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.iso" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_phishing_recent_iso_exec_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process + that include the name of the process responsible for the changes from your endpoints into the `Endpoint` + datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed + and the latest TA for the endpoint product. +known_false_positives: False positives may be high depending on the environment and consistent use of ISOs. + Restrict to servers, or filter out based on commonly used ISO names. Filter as needed. +references: +- https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ +- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ +tags: + analytic_story: + - Brute Ratel C4 + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log + impact: 50 + kill_chain_phases: + - Delivery + message: An ISO file was mounted on $dest$ and should be reviewed and filtered as needed. + mitre_attack_id: + - T1566.001 + - T1566 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.user + - Registry.registry_path + - Registry.registry_value_data + - Registry.action + - Registry.dest + risk_score: 40 + security_domain: endpoint diff --git a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml new file mode 100644 index 0000000000..6801bc82b1 --- /dev/null +++ b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml @@ -0,0 +1,79 @@ +name: Windows Remote Access Software BRC4 Loaded Dll +id: 73cf5dcb-cf36-4167-8bbe-384fe5384d05 +version: 1 +date: '2022-08-24' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following anomaly detection identifies the behavior related to 4 native Windows DLLs being loaded by a non-standard process. + Identified by MDSec during their research into Brute Ratel, MDSec identified a high signal analytic by calling out these 4 DLLs being loaded + into a process. LogonCLI.dll is the Net Logon Client DLL and is related to users and other domain services to get authenticated. Credui.dll + is Credential Manager User Interface. Credential managers receive notifications when authentication information changes. + For example, credential managers are notified when a user logs on or an account password changes. + Samcli.dll is the Security Accounts Manager Client DLL. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) + database either through in-memory techniques or through the Windows Registry where the SAM database is stored. + Dbghelp.dll is Windows Image Helper. Windows Image Helper is commonly seen in credential dumping due to native functions. + All of these modules are important to monitor and track and combined may lead to credentail access or dumping. +search: '`sysmon` EventCode=7 + |bin _time span=30s + | eval BRC4_AnomalyLoadedDll=case(OriginalFileName=="credui.dll", 1, OriginalFileName=="DBGHELP.DLL", 1, OriginalFileName=="SAMCLI.DLL", 1, OriginalFileName=="winhttp.dll", 1, 1=1, 0) + | eval BRC4_LoadedDllPath=case(match(ImageLoaded, "credui.dll"), 1, match(ImageLoaded, "dbghelp.dll"), 1, match(ImageLoaded, "samcli.dll"), 1, match(ImageLoaded, "winhttp.dll"), 1, 1=1, 0) + | stats count min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as ImageLoaded values(OriginalFileName) as OriginalFileName dc(ImageLoaded) as ImageLoadedCount by Image BRC4_LoadedDllPath BRC4_AnomalyLoadedDll Computer EventCode Signed + | where ImageLoadedCount == 4 AND (BRC4_LoadedDllPath == 1 OR BRC4_AnomalyLoadedDll == 1) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_remote_access_software_brc4_loaded_dll_filter`' +how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will + add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products. +known_false_positives: This module can be loaded by a third party application. Filter is needed. +references: +- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ +- https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/ +- https://strontic.github.io/xcyclopedia/library/logoncli.dll-138871DBE68D0696D3D7FA91BC2873B1.html +- https://strontic.github.io/xcyclopedia/library/credui.dll-A5BD797BBC2DD55231B9DE99837E5461.html +- https://docs.microsoft.com/en-us/windows/win32/secauthn/credential-manager +- https://strontic.github.io/xcyclopedia/library/samcli.dll-522D6D616EF142CDE965BD3A450A9E4C.html +- https://strontic.github.io/xcyclopedia/library/dbghelp.dll-15A55EAB307EF8C190FE6135C0A86F7C.html +tags: + analytic_story: + - Brute Ratel C4 + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 30 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log + impact: 30 + kill_chain_phases: + - Exploitation + message: a process $Image$ loaded several modules $ImageLoaded$ that might related to credential access on $Computer$. + mitre_attack_id: + - T1219 + - T1003 + nist: + - DE.CM + observable: + - name: Computer + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - ImageLoaded + - process_name + - Computer + - EventCode + - Signed + - ProcessId + risk_score: 9 + security_domain: endpoint diff --git a/tests/endpoint/windows_gather_victim_identity_sam_info.test.yml b/tests/endpoint/windows_gather_victim_identity_sam_info.test.yml new file mode 100644 index 0000000000..d5d0ca38df --- /dev/null +++ b/tests/endpoint/windows_gather_victim_identity_sam_info.test.yml @@ -0,0 +1,13 @@ +name: Windows Gather Victim Identity SAM Info Unit Test +tests: +- name: Windows Gather Victim Identity SAM Info + file: endpoint/windows_gather_victim_identity_sam_info.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/loading_samlib/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_hijack_execution_flow_version_dll_side_load.test.yml b/tests/endpoint/windows_hijack_execution_flow_version_dll_side_load.test.yml new file mode 100644 index 0000000000..32e1ebee01 --- /dev/null +++ b/tests/endpoint/windows_hijack_execution_flow_version_dll_side_load.test.yml @@ -0,0 +1,13 @@ +name: Windows Hijack Execution Flow Version Dll Side Load Unit Test +tests: +- name: Windows Hijack Execution Flow Version Dll Side Load + file: endpoint/windows_hijack_execution_flow_version_dll_side_load.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_input_capture_using_credential_ui_dll.test.yml b/tests/endpoint/windows_input_capture_using_credential_ui_dll.test.yml new file mode 100644 index 0000000000..be9b725986 --- /dev/null +++ b/tests/endpoint/windows_input_capture_using_credential_ui_dll.test.yml @@ -0,0 +1,13 @@ +name: Windows Input Capture Using Credential UI Dll Unit Test +tests: +- name: Windows Input Capture Using Credential UI Dll + file: endpoint/windows_input_capture_using_credential_ui_dll.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_phishing_recent_iso_exec_registry.test.yml b/tests/endpoint/windows_phishing_recent_iso_exec_registry.test.yml new file mode 100644 index 0000000000..bd6c8924f9 --- /dev/null +++ b/tests/endpoint/windows_phishing_recent_iso_exec_registry.test.yml @@ -0,0 +1,13 @@ +name: Windows Phishing Recent ISO Exec Registry Unit Test +tests: +- name: Windows Phishing Recent ISO Exec Registry + file: endpoint/windows_phishing_recent_iso_exec_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_remote_access_software_brc4_loaded_dll.test.yml b/tests/endpoint/windows_remote_access_software_brc4_loaded_dll.test.yml new file mode 100644 index 0000000000..048de62597 --- /dev/null +++ b/tests/endpoint/windows_remote_access_software_brc4_loaded_dll.test.yml @@ -0,0 +1,13 @@ +name: Windows Remote Access Software BRC4 Loaded Dll Unit Test +tests: +- name: Windows Remote Access Software BRC4 Loaded Dll + file: endpoint/windows_remote_access_software_brc4_loaded_dll.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true