From 9eea4ded41e5f33eb7f45f54454062a4b6c91229 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 15 Dec 2021 13:01:04 -0700 Subject: [PATCH 1/3] It's Raining Haags --- .../endpoint/linux_java_spawning_shell.yml | 0 tests/endpoint/linux_java_spawning_shell.test.yml | 12 ++++++++++++ 2 files changed, 12 insertions(+) rename detections/{experimental => }/endpoint/linux_java_spawning_shell.yml (100%) create mode 100644 tests/endpoint/linux_java_spawning_shell.test.yml diff --git a/detections/experimental/endpoint/linux_java_spawning_shell.yml b/detections/endpoint/linux_java_spawning_shell.yml similarity index 100% rename from detections/experimental/endpoint/linux_java_spawning_shell.yml rename to detections/endpoint/linux_java_spawning_shell.yml diff --git a/tests/endpoint/linux_java_spawning_shell.test.yml b/tests/endpoint/linux_java_spawning_shell.test.yml new file mode 100644 index 0000000000..2f07c098b2 --- /dev/null +++ b/tests/endpoint/linux_java_spawning_shell.test.yml @@ -0,0 +1,12 @@ +name: Linux Java Spawning Shell Unit Test +tests: +- name: Linux Java Spawning Shell + file: endpoint/linux_java_spawning_shell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: java_spawn_shell_nix.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/java/java_spawn_shell_nix.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux \ No newline at end of file From 2ebb9f8c40ec2356027cc435f7d5dcb0297b1b51 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 17 Dec 2021 11:43:40 -0700 Subject: [PATCH 2/3] Updated Log4shell hunt --- detections/endpoint/hunting_for_log4shell.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/endpoint/hunting_for_log4shell.yml b/detections/endpoint/hunting_for_log4shell.yml index 1804251922..6b88693f08 100644 --- a/detections/endpoint/hunting_for_log4shell.yml +++ b/detections/endpoint/hunting_for_log4shell.yml @@ -51,8 +51,7 @@ search: '| from datamodel Web.Web | eval jndi=if(match(_raw, "(\{|%7B)[jJnNdDiI] "(?i)Basic\/Command\/Base64|Basic\/ReverseShell|Basic\/TomcatMemshell|Basic\/JBossMemshell|Basic\/WebsphereMemshell|Basic\/SpringMemshell|Basic\/Command|Deserialization\/CommonsCollectionsK|Deserialization\/CommonsBeanutils|Deserialization\/Jre8u20\/TomcatMemshell|Deserialization\/CVE_2020_2555\/WeblogicMemshell|TomcatBypass|GroovyBypass|WebsphereBypass"),4,0) | eval keywords = if(match(_raw,"(?i)\$\{ctx\:loginId\}|\$\{map\:type\}|\$\{filename\}|\$\{date\:MM-dd-yyyy\}|\$\{docker\:containerId\}|\$\{docker\:containerName\}|\$\{docker\:imageName\}|\$\{env\:USER\}|\$\{event\:Marker\}|\$\{mdc\:UserId\}|\$\{java\:runtime\}|\$\{java\:vm\}|\$\{java\:os\}|\$\{jndi\:logging/context-name\}|\$\{hostName\}|\$\{docker\:containerId\}|\$\{k8s\:accountName\}|\$\{k8s\:clusterName\}|\$\{k8s\:containerId\}|\$\{k8s\:containerName\}|\$\{k8s\:host\}|\$\{k8s\:labels.app\}|\$\{k8s\:labels.podTemplateHash\}|\$\{k8s\:masterUrl\}|\$\{k8s\:namespaceId\}|\$\{k8s\:namespaceName\}|\$\{k8s\:podId\}|\$\{k8s\:podIp\}|\$\{k8s\:podName\}|\$\{k8s\:imageId\}|\$\{k8s\:imageName\}|\$\{log4j\:configLocation\}|\$\{log4j\:configParentLocation\}|\$\{spring\:spring.application.name\}|\$\{main\:myString\}|\$\{main\:0\}|\$\{main\:1\}|\$\{main\:2\}|\$\{main\:3\}|\$\{main\:4\}|\$\{main\:bar\}|\$\{name\}|\$\{marker\}|\$\{marker\:name\}|\$\{spring\:profiles.active[0]|\$\{sys\:logPath\}|\$\{web\:rootDir\}|\$\{sys\:user.name\}"),4,0) | eval obf = if(match(_raw, "(\$|%24)[^ /]*({|%7b)[^ /]*(j|%6a)[^ /]*(n|%6e)[^ /]*(d|%64)[^ - /]*(i|%69)[^ /]*(:|%3a)[^ /]*(:|%3a)[^ /]*(/|%2f)"),5,0) | eval lookups = if(match(_raw, - "date:") OR match(_raw, "upper:") OR match(_raw, "lower:"),4,0) | addtotals fieldname=Score, + /]*(i|%69)[^ /]*(:|%3a)[^ /]*(:|%3a)[^ /]*(/|%2f)"),5,0) | eval lookups = if(match(_raw, "(?i)({|%7b)(main|sys|k8s|spring|lower|upper|env|date|sd)"),4,0) | addtotals fieldname=Score, jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, obf, lookups | where Score > 2 | stats values(Score) by jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, lookups, obf, _raw | `hunting_for_log4shell_filter`' From 2cc4a4b1daa83890e4f25b62be327fffc7b5f240 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 13 Jan 2022 10:40:31 -0700 Subject: [PATCH 3/3] Update linux_java_spawning_shell.yml --- detections/endpoint/linux_java_spawning_shell.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_java_spawning_shell.yml b/detections/endpoint/linux_java_spawning_shell.yml index b8df23e21e..e3287580d3 100644 --- a/detections/endpoint/linux_java_spawning_shell.yml +++ b/detections/endpoint/linux_java_spawning_shell.yml @@ -24,7 +24,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin occurring correctly. Ensure EDR product is mapping OS Linux to the datamodel properly. Add any additional java process names for your environment to the analytic as needed. known_false_positives: Filtering may be required on internal developer build systems - or classify assets as web facing and restrict the analytic based on that. + or classify assets as web facing and restrict the analytic based on asset type. references: - https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/ - https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72