From 8abf77841129ee6836192b9b4959758ab6c73922 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 1 Sep 2022 15:38:42 +0200 Subject: [PATCH 1/5] Update windows_gather_victim_identity_sam_info.yml --- detections/endpoint/windows_gather_victim_identity_sam_info.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_gather_victim_identity_sam_info.yml b/detections/endpoint/windows_gather_victim_identity_sam_info.yml index 60243af3a9..842528a747 100644 --- a/detections/endpoint/windows_gather_victim_identity_sam_info.yml +++ b/detections/endpoint/windows_gather_victim_identity_sam_info.yml @@ -62,5 +62,5 @@ tags: - EventCode - Signed - ProcessId - risk_score: 6 + risk_score: 9 security_domain: endpoint From d764f48a295aab230fb7794eb8583608471ce8dd Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 1 Sep 2022 15:39:08 +0200 Subject: [PATCH 2/5] Update windows_input_capture_using_credential_ui_dll.yml --- .../endpoint/windows_input_capture_using_credential_ui_dll.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml index 1bcb2085d2..ea308ddca3 100644 --- a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml +++ b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml @@ -66,5 +66,5 @@ tags: - EventCode - Signed - ProcessId - risk_score: 6 + risk_score: 9 security_domain: endpoint From 2dc78584a0c286311651fd42bb1d041d00c154b3 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 5 Sep 2022 10:56:01 +0200 Subject: [PATCH 3/5] Update windows_phishing_recent_iso_exec_registry.yml --- .../endpoint/windows_phishing_recent_iso_exec_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml index b7644289c0..38efa868b9 100644 --- a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml +++ b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: The following hunting analytic identifies registry artifacts when a ISO container is openedm clicked or mounted on the Windows operating system. +description: The following hunting analytic identifies registry artifacts when a ISO container is opened, clicked or mounted on the Windows operating system. As Microsoft makes changes to macro based document execution, adversaries have begun to utilize container based initial access based phishing campaigns to evade preventative controls. Once the ISO is clicked or mounted it will create a registry artifact related to this event as a recent application executed or opened. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry From 385bc45c5d99a352bc5cd2e484dcd2abd91b2503 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 5 Sep 2022 10:56:24 +0200 Subject: [PATCH 4/5] Update windows_phishing_recent_iso_exec_registry.yml --- .../endpoint/windows_phishing_recent_iso_exec_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml index 38efa868b9..b82b44feeb 100644 --- a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml +++ b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: The following hunting analytic identifies registry artifacts when a ISO container is opened, clicked or mounted on the Windows operating system. +description: The following hunting analytic identifies registry artifacts when an ISO container is opened, clicked or mounted on the Windows operating system. As Microsoft makes changes to macro based document execution, adversaries have begun to utilize container based initial access based phishing campaigns to evade preventative controls. Once the ISO is clicked or mounted it will create a registry artifact related to this event as a recent application executed or opened. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry From 1d4f5c69210d2dc93bbe8d813390d48d2d3d3b65 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 14 Sep 2022 14:43:13 +0200 Subject: [PATCH 5/5] Update windows_gather_victim_identity_sam_info.yml --- .../endpoint/windows_gather_victim_identity_sam_info.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_gather_victim_identity_sam_info.yml b/detections/endpoint/windows_gather_victim_identity_sam_info.yml index 842528a747..cf54501c99 100644 --- a/detections/endpoint/windows_gather_victim_identity_sam_info.yml +++ b/detections/endpoint/windows_gather_victim_identity_sam_info.yml @@ -9,7 +9,8 @@ datamodel: description: The following analytic identifies a process that loads the samlib.dll module. This module is being abused by adversaries, threat actors and red teamers to access information of SAM objects or access credentials information in DC. This hunting query can be a good indicator that a process is capable of accessing the SAM object. -search: '`sysmon` EventCode=7 ImageLoaded = "*\\samlib.dll" AND OriginalFileName = "samlib.dll" AND NOT (Image IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) +search: '`sysmon` EventCode=7 (ImageLoaded = "*\\samlib.dll" AND OriginalFileName = "samlib.dll") OR (ImageLoaded = "*\\samcli.dll" AND OriginalFileName = "SAMCLI.DLL") +AND NOT (Image IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`