From 667396b4ced467e0e0cc326e55f506cbb35bfdb9 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 15 Jun 2021 17:04:51 -0700 Subject: [PATCH 01/13] updated rba spec --- .../access_lsass_memory_for_dump_creation.yml | 28 +++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index eadbd405d5..288d94ffdd 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -50,3 +50,31 @@ tags: - SourceImage - SourceProcessId security_domain: endpoint + impact: 3 + confidence: 8 + context: + - Scope:Network + - Local + - Signature + - RareDomain + message: the $src$ is infected by $client$ + risk_score: 50 + risk_observable: + - name: dest + type: User + role: + - Target + - Victim + - name: user + type: Endpoint + role: + - Target + - Victim + + threat_observable: + - name: TargetImage + type: TargetImage + role: + - Known Bad + + From 66c4215805315b127584d2b77dfd4f2af736269d Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 16 Jun 2021 13:46:22 -0400 Subject: [PATCH 02/13] first test --- .../access_lsass_memory_for_dump_creation.yml | 34 +++++++------------ 1 file changed, 12 insertions(+), 22 deletions(-) diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index 288d94ffdd..488cfe4c1d 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -50,31 +50,21 @@ tags: - SourceImage - SourceProcessId security_domain: endpoint - impact: 3 - confidence: 8 + impact: 7 + confidence: 90 context: - - Scope:Network - - Local - - Signature - - RareDomain - message: the $src$ is infected by $client$ - risk_score: 50 + - Source:Endpoint + - Stage:Credential Access + message: Process $SourceImage$ with id $TargetProcessId$ was detected trying to dump the memory of LSASS on $dest$. + Actor do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). risk_observable: - name: dest - type: User - role: - - Target - - Victim - - name: user type: Endpoint - role: - - Target + role: - Victim - threat_observable: - - name: TargetImage - type: TargetImage - role: - - Known Bad - - + - name: TargetProcessId + type: Process + role: + - Child Process + - Target From e0446a8ebf33c3c7533b86088a59d8271c37cec1 Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 16 Jun 2021 13:52:16 -0400 Subject: [PATCH 03/13] adding risk score --- .../endpoint/access_lsass_memory_for_dump_creation.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index 488cfe4c1d..c3462464e9 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -50,13 +50,15 @@ tags: - SourceImage - SourceProcessId security_domain: endpoint - impact: 7 + impact: 70 confidence: 90 + # (impact * confidence)/100 + risk_score: 63 context: - Source:Endpoint - Stage:Credential Access - message: Process $SourceImage$ with id $TargetProcessId$ was detected trying to dump the memory of LSASS on $dest$. - Actor do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). + message: process $SourceImage$ with id $TargetProcessId$ was detected trying to dump the memory of LSASS on $dest$. + Actor tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). risk_observable: - name: dest type: Endpoint From 1b076b9809b516d8b7e7fcbae32ce0d7359d42c6 Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 16 Jun 2021 18:02:29 -0400 Subject: [PATCH 04/13] observables --- .../access_lsass_memory_for_dump_creation.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index c3462464e9..6828dd59bc 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -59,14 +59,13 @@ tags: - Stage:Credential Access message: process $SourceImage$ with id $TargetProcessId$ was detected trying to dump the memory of LSASS on $dest$. Actor tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). - risk_observable: + observable: - name: dest type: Endpoint role: - - Victim - threat_observable: - - name: TargetProcessId - type: Process - role: + - Victim + - name: TargetProcessId + type: Process + role: - Child Process - Target From 8144275f349921ccb6200b9a50b6134173bc14a2 Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 16 Jun 2021 18:06:36 -0400 Subject: [PATCH 05/13] making it a correct yml --- .../access_lsass_memory_for_dump_creation.yml | 21 +++++++++---------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index 6828dd59bc..91e7d7962c 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -57,15 +57,14 @@ tags: context: - Source:Endpoint - Stage:Credential Access - message: process $SourceImage$ with id $TargetProcessId$ was detected trying to dump the memory of LSASS on $dest$. - Actor tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). + message: process $SourceImage$ with id $TargetProcessId$ was detected trying to dump the memory of LSASS on $dest$. Actor tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). observable: - - name: dest - type: Endpoint - role: - - Victim - - name: TargetProcessId - type: Process - role: - - Child Process - - Target + - name: dest + type: Endpoint + role: + - Victim + - name: TargetProcessId + type: Process + role: + - Child Process + - Target From c1f4cae5b6ae56e3fe65ff0a2898f9114eb57621 Mon Sep 17 00:00:00 2001 From: divious1 Date: Thu, 17 Jun 2021 21:43:50 -0400 Subject: [PATCH 06/13] working example of risk object as well as threat object with ses annotations --- bin/generate.py | 82 ++++++++++++++++++++------- bin/jinja2_templates/savedsearches.j2 | 10 ++-- 2 files changed, 67 insertions(+), 25 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index 81cb23e938..43467e78bf 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -297,6 +297,61 @@ def custom_jinja2_enrichment_filter(string, object): return customized_string +def add_annotations(detection): + # used for upstream processing of risk scoring annotations in ECSU + # this is not currently compatible with newer instances of ESCU (6.3.0+) + # we are duplicating the code block above for now and just changing variable names to make future + # changes to this data structure separate from the mappings generation + # @todo expose the JSON data structure for newer risk type + + annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 'analytic_story', 'observable'] + savedsearch_annotations = {} + for key in annotation_keys: + if key == 'mitre_attack': + if 'mitre_attack_id' in detection['tags']: + savedsearch_annotations[key] = detection['tags']['mitre_attack_id'] + else: + if key in detection['tags']: + savedsearch_annotations[key] = detection['tags'][key] + detection['savedsearch_annotations'] = savedsearch_annotations + + return detection + +def add_rba(detection): + if 'message' in detection['tags']: + detection['risk_message'] = detection['tags']['message'] + if 'risk_object' in detection['tags']: + detection['risk_object'] = detection['tags']['risk_object'] + if 'risk_object_type' in detection['tags']: + detection['risk_object_type'] = detection['tags']['risk_object_type'] + if 'risk_score' in detection['tags']: + detection['risk_score'] = detection['tags']['risk_score'] + + risk_objects = [] + risk_object_user_types = {'user', 'username', 'email address'} + risk_object_system_types = {'device', 'endpoint', 'hostname', 'ip address'} + if 'observable' in detection['tags']: + # go through each obervable + for entity in detection['tags']['observable']: + risk_object = dict() + + # determine if is a system, or user + if entity['type'].lower() in risk_object_user_types: + risk_object['risk_object_type'] = 'user' + elif entity['type'].lower() in risk_object_system_types: + risk_object['risk_object_type'] = 'system' + else: + # if is not a system or user, it is a threat object + risk_object['threat_object_field'] = entity['name'] + risk_object['threat_object_type'] = entity['type'].lower() + risk_objects.append(risk_object) + continue + risk_object['risk_object_field'] = entity['name'] + risk_object['risk_score'] = detection['risk_score'] + risk_objects.append(risk_object) + + detection['risk'] = risk_objects + return detection def prepare_detections(detections, deployments, OUTPUT_PATH): for detection in detections: @@ -322,30 +377,15 @@ def prepare_detections(detections, deployments, OUTPUT_PATH): mappings[key] = detection['tags'][key] detection['mappings'] = mappings - # used for upstream processing of risk scoring annotations in ECSU - # this is not currently compatible with newer instances of ESCU (6.3.0+) - # we are duplicating the code block above for now and just changing variable names to make future - # changes to this data structure separate from the mappings generation - # @todo expose the JSON data structure for newer risk type - annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 'analytic_story'] - savedsearch_annotations = {} - for key in annotation_keys: - if key == 'mitre_attack': - if 'mitre_attack_id' in detection['tags']: - savedsearch_annotations[key] = detection['tags']['mitre_attack_id'] - else: - if key in detection['tags']: - savedsearch_annotations[key] = detection['tags'][key] - detection['savedsearch_annotations'] = savedsearch_annotations - if 'risk_object' in detection['tags']: - detection['risk_object'] = detection['tags']['risk_object'] - if 'risk_object_type' in detection['tags']: - detection['risk_object_type'] = detection['tags']['risk_object_type'] - if 'risk_score' in detection['tags']: - detection['risk_score'] = detection['tags']['risk_score'] + detection = add_annotations(detection) + detection = add_rba(detection) + + # add additional metadata if 'product' in detection['tags']: detection['product'] = detection['tags']['product'] + + # turn all SAAWS detections if (OUTPUT_PATH) == 'dist/saaws': detection['disabled'] = 'false' diff --git a/bin/jinja2_templates/savedsearches.j2 b/bin/jinja2_templates/savedsearches.j2 index ba0df448e9..ea7a091508 100644 --- a/bin/jinja2_templates/savedsearches.j2 +++ b/bin/jinja2_templates/savedsearches.j2 @@ -44,11 +44,13 @@ action.escu.providing_technologies = [] {% endif %} {% if detection.tags.analytic_story is defined %} action.escu.analytic_story = {{ detection.tags.analytic_story | tojson }} -{% if detection.tags.risk_object is defined %} +{% if detection.risk_score is defined %} action.risk = 1 -action.risk.param._risk_object = {{ detection.tags.risk_object }} -action.risk.param._risk_object_type = {{ detection.tags.risk_object_type }} -action.risk.param._risk_score = {{ detection.tags.risk_score }} +action.risk.param._risk_object = {{ detection.risk_object }} +action.risk.param._risk_object_type = {{ detection.risk_object_type }} +action.risk.param._risk_score = {{ detection.risk_score }} +action.risk.param._risk_message = {{ detection.risk_message }} +action.risk.param._risk = {{ detection.risk | tojson }} action.risk.param.verbose = 0 {% endif %} {% else %} From 6c518294ed6383d85010a808ac217232f8e22977 Mon Sep 17 00:00:00 2001 From: divious1 Date: Thu, 17 Jun 2021 21:44:20 -0400 Subject: [PATCH 07/13] minor update --- bin/generate.py | 1 + 1 file changed, 1 insertion(+) diff --git a/bin/generate.py b/bin/generate.py index 43467e78bf..d0cffe66f5 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -346,6 +346,7 @@ def add_rba(detection): risk_object['threat_object_type'] = entity['type'].lower() risk_objects.append(risk_object) continue + risk_object['risk_object_field'] = entity['name'] risk_object['risk_score'] = detection['risk_score'] risk_objects.append(risk_object) From ba2fa59b5eff253d4442a6f6adbccd2059e8917c Mon Sep 17 00:00:00 2001 From: divious1 Date: Sat, 19 Jun 2021 22:15:49 -0400 Subject: [PATCH 08/13] adding 3 rba examples --- bin/generate.py | 13 +- bin/jinja2_templates/detection.j2 | 13 + ...mber_of_cloud_infrastructure_api_calls.yml | 16 +- .../suspicious_mshta_child_process.yml | 21 + dist/escu/default/analytic_stories.conf | 8 +- dist/escu/default/collections.conf | 2 +- dist/escu/default/macros.conf | 6 +- dist/escu/default/savedsearches.conf | 209 ++++++- dist/escu/default/transforms.conf | 2 +- dist/escu/default/use_case_library.conf | 14 +- dist/escu/lookups/mitre_enrichment.csv | 540 +++++++++++------- 11 files changed, 607 insertions(+), 237 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index d0cffe66f5..62898056f7 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -304,7 +304,7 @@ def add_annotations(detection): # changes to this data structure separate from the mappings generation # @todo expose the JSON data structure for newer risk type - annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 'analytic_story', 'observable'] + annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 'analytic_story', 'observable', 'context', 'impact', 'confidence'] savedsearch_annotations = {} for key in annotation_keys: if key == 'mitre_attack': @@ -318,8 +318,8 @@ def add_annotations(detection): return detection def add_rba(detection): - if 'message' in detection['tags']: - detection['risk_message'] = detection['tags']['message'] + + # remove after refactor if RBA POC is automated_detection_testing if 'risk_object' in detection['tags']: detection['risk_object'] = detection['tags']['risk_object'] if 'risk_object_type' in detection['tags']: @@ -327,6 +327,10 @@ def add_rba(detection): if 'risk_score' in detection['tags']: detection['risk_score'] = detection['tags']['risk_score'] + # grab risk message + if 'message' in detection['tags']: + detection['risk_message'] = detection['tags']['message'] + risk_objects = [] risk_object_user_types = {'user', 'username', 'email address'} risk_object_system_types = {'device', 'endpoint', 'hostname', 'ip address'} @@ -338,6 +342,7 @@ def add_rba(detection): # determine if is a system, or user if entity['type'].lower() in risk_object_user_types: risk_object['risk_object_type'] = 'user' + detection['risk_object_type'] = 'user' elif entity['type'].lower() in risk_object_system_types: risk_object['risk_object_type'] = 'system' else: @@ -346,6 +351,7 @@ def add_rba(detection): risk_object['threat_object_type'] = entity['type'].lower() risk_objects.append(risk_object) continue + detection['risk_object'] = entity['name'] risk_object['risk_object_field'] = entity['name'] risk_object['risk_score'] = detection['risk_score'] @@ -378,7 +384,6 @@ def prepare_detections(detections, deployments, OUTPUT_PATH): mappings[key] = detection['tags'][key] detection['mappings'] = mappings - detection = add_annotations(detection) detection = add_rba(detection) diff --git a/bin/jinja2_templates/detection.j2 b/bin/jinja2_templates/detection.j2 index eb398c90d2..2d49429a83 100644 --- a/bin/jinja2_templates/detection.j2 +++ b/bin/jinja2_templates/detection.j2 @@ -36,3 +36,16 @@ tags: required_fields: - _time security_domain: {{security_domain}} + impact: {{impact}} + confidence: {{ confidence }} + # (impact * confidence)/100 + risk_score: {{risk_score}} + context: + {% for context in contexts -%} + - {{contexts}} + {% endfor -%} + message: {{risk_message}} + observable: + {% for observable in observables -%} + - {{observable}} + {% endfor -%} diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index 06fd6b105a..5e658d3da2 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -51,7 +51,17 @@ tags: - All_Changes.command - All_Changes.user - All_Changes.status - risk_object: user - risk_object_type: user - risk_score: 25 security_domain: network + impact: 30 + confidence: 50 + # (impact * confidence)/100 + risk_score: 15 + context: + - Source:Cloud Data + - Stage:Recon + message: user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. + observable: + - name: user + type: User + role: + - Attacker diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml index 9d75f7b3d7..ee2ca2b383 100644 --- a/detections/endpoint/suspicious_mshta_child_process.yml +++ b/detections/endpoint/suspicious_mshta_child_process.yml @@ -58,3 +58,24 @@ tags: - Processes.parent_process - Processes.user security_domain: endpoint + impact: 50 + confidence: 80 + # (impact * confidence)/100 + risk_score: 40 + context: + - Source:Endpoint + - Stage:Execution + message: suspicious mshta child process detected on host $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: parent_process + type: Process Name + role: + - Parent Process diff --git a/dist/escu/default/analytic_stories.conf b/dist/escu/default/analytic_stories.conf index a21d4b85bc..0bc5d0d77d 100644 --- a/dist/escu/default/analytic_stories.conf +++ b/dist/escu/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-10T18:24:24 UTC +# On Date: 2021-06-20T02:10:33 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -532,11 +532,11 @@ modification_date = 2020-10-21 id = 66b0fe0c-1351-11eb-adc1-0242ac120002 version = 1 reference = ["https://attack.mitre.org/tactics/TA0010/"] -detection_searches = ["ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule"] -mappings = {"cis20": ["CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Exploitation"], "mitre_attack": ["T1041", "T1114", "T1114.001", "T1114.003"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.DS"]} +detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule"] +mappings = {"cis20": ["CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Exfiltration", "Exploitation"], "mitre_attack": ["T1041", "T1048", "T1048.003", "T1114", "T1114.001", "T1114.003"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.DS"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] -data_models = [] +data_models = ["Endpoint"] providing_technologies = none description = The stealing of data by an adversary. narrative = Exfiltration comes in many flavors. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command and Control channels that are already in place to exfiltrate data. They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place. diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 9b04724183..ff36a97cc4 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-10T18:24:24 UTC +# On Date: 2021-06-20T02:10:33 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 23ff0d0431..6d7cfd1010 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-10T18:24:25 UTC +# On Date: 2021-06-20T02:10:33 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -1175,6 +1175,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [excessive_number_of_taskhost_processes_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 84184b0dc9..8007f4f32b 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-10T18:24:24 UTC +# On Date: 2021-06-20T02:10:33 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -29,6 +29,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 25 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -201,6 +203,8 @@ action.risk = 1 action.risk.param._risk_object = src action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -241,6 +245,8 @@ action.risk = 1 action.risk.param._risk_object = src action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -281,6 +287,8 @@ action.risk = 1 action.risk.param._risk_object = src_ip action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -321,6 +329,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 15 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -361,6 +371,8 @@ action.risk = 1 action.risk.param._risk_object = userIdentity.principalId action.risk.param._risk_object_type = user action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -401,6 +413,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 25 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -481,6 +495,8 @@ action.risk = 1 action.risk.param._risk_object = src action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -521,6 +537,8 @@ action.risk = 1 action.risk.param._risk_object = src_ip action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -561,6 +579,8 @@ action.risk = 1 action.risk.param._risk_object = src action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -601,6 +621,8 @@ action.risk = 1 action.risk.param._risk_object = src action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -641,6 +663,8 @@ action.risk = 1 action.risk.param._risk_object = src action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -681,6 +705,8 @@ action.risk = 1 action.risk.param._risk_object = src action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -721,6 +747,8 @@ action.risk = 1 action.risk.param._risk_object = userName action.risk.param._risk_object_type = user action.risk.param._risk_score = 10 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -761,6 +789,8 @@ action.risk = 1 action.risk.param._risk_object = userName action.risk.param._risk_object_type = user action.risk.param._risk_score = 5 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -801,6 +831,8 @@ action.risk = 1 action.risk.param._risk_object = recipientAccountId action.risk.param._risk_object_type = other action.risk.param._risk_score = 25 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -841,6 +873,8 @@ action.risk = 1 action.risk.param._risk_object = sourceIPAddress action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -881,6 +915,8 @@ action.risk = 1 action.risk.param._risk_object = src action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -921,6 +957,8 @@ action.risk = 1 action.risk.param._risk_object = src action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -961,6 +999,8 @@ action.risk = 1 action.risk.param._risk_object = userName action.risk.param._risk_object_type = user action.risk.param._risk_score = 40 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1006,6 +1046,8 @@ action.risk = 1 action.risk.param._risk_object = src_usr action.risk.param._risk_object_type = user action.risk.param._risk_score = 10 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1132,14 +1174,16 @@ action.escu.analytic_story = ["Suspicious Cloud User Activities"] action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user -action.risk.param._risk_score = 25 +action.risk.param._risk_score = 15 +action.risk.param._risk_message = user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1173,6 +1217,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 10 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1213,6 +1259,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 40 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1253,6 +1301,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 25 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1289,12 +1339,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = +action.risk.param._risk_score = 63 +action.risk.param._risk_message = process $SourceImage$ with id $TargetProcessId$ was detected trying to dump the memory of LSASS on $dest$. Actor tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "TargetProcessId", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Access LSASS Memory for Dump Creation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "TargetProcessId", "role": ["Child Process", "Target"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -2356,6 +2413,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 25 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2396,6 +2455,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2436,6 +2497,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2476,6 +2539,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2516,6 +2581,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2556,6 +2623,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 10 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2638,6 +2707,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 10 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2679,6 +2750,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 5 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2720,6 +2793,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 5 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -2761,6 +2836,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 5 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3377,13 +3454,13 @@ action.escu.full_search_name = ESCU - DNS Exfiltration Using Nslookup App - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"] +action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - DNS Exfiltration Using Nslookup App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3780,6 +3857,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 10 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3873,6 +3952,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 15 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3919,6 +4000,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 30 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3959,6 +4042,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 5 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -3999,6 +4084,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 5 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -4039,6 +4126,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 5 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -5186,6 +5275,8 @@ action.risk = 1 action.risk.param._risk_object = src action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -5226,6 +5317,8 @@ action.risk = 1 action.risk.param._risk_object = src action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6251,6 +6344,8 @@ action.risk = 1 action.risk.param._risk_object = src_ip action.risk.param._risk_object_type = system action.risk.param._risk_score = 10 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6506,6 +6601,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 10 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6552,6 +6649,8 @@ action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6633,6 +6732,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6679,6 +6780,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 10 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6725,6 +6828,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 5 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -6771,6 +6876,8 @@ action.risk = 1 action.risk.param._risk_object = src_ip action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -7308,6 +7415,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 5 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -8304,6 +8413,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 5 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -8350,6 +8461,8 @@ action.risk = 1 action.risk.param._risk_object = src action.risk.param._risk_object_type = system action.risk.param._risk_score = 10 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -9084,13 +9197,13 @@ action.escu.full_search_name = ESCU - Excessive Usage of NSLOOKUP App - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"] +action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excessive Usage of NSLOOKUP App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = this search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. @@ -9108,6 +9221,47 @@ realtime_schedule = 0 is_visible = false search = `sysmon` EventCode = 1 process_name = "nslookup.exe" | bucket _time span=15m | stats count as numNsLookup by Computer, _time | eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer | eval upperThreshold=(avgNsLookup + stdNsLookup *3) | eval isOutlier=if(avgNsLookup > 20 and avgNsLookup >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter` +[ESCU - Excessive number of distinct processes created in Windows Temp folder - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic will identify suspicious series of process executions. We have observed that post exploit framework tools like Koadic and Meterpreter will launch an excessive number of processes with distinct file paths from Windows\Temp to execute actions on objective. This behavior is extremely anomalous compared to typical application behaviors that use Windows\Temp. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic will identify suspicious series of process executions. We have observed that post exploit framework tools like Koadic and Meterpreter will launch an excessive number of processes with distinct file paths from Windows\Temp to execute actions on objective. This behavior is extremely anomalous compared to typical application behaviors that use Windows\Temp. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. +action.escu.known_false_positives = Many benign applications will create processes from executables in Windows\Temp, although unlikely to exceed the given threshold. Filter as needed. +action.escu.creation_date = 2021-06-03 +action.escu.modification_date = 2021-06-03 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Excessive number of distinct processes created in Windows Temp folder - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["meterpreter"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Excessive number of distinct processes created in Windows Temp folder - Rule +action.correlationsearch.annotations = {"analytic_story": ["meterpreter"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic will identify suspicious series of process executions. We have observed that post exploit framework tools like Koadic and Meterpreter will launch an excessive number of processes with distinct file paths from Windows\Temp to execute actions on objective. This behavior is extremely anomalous compared to typical application behaviors that use Windows\Temp. +action.notable.param.rule_title = Excessive number of distinct processes created in Windows Temp folder +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` values(Processes.process) as process distinct_count(Processes.process) as distinct_process_count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*\\Windows\\Temp\\*" by Processes.dest Processes.user _time span=20m | where distinct_process_count > 37 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter` + [ESCU - Excessive number of taskhost processes - Rule] action.escu = 0 action.escu.enabled = 1 @@ -11693,13 +11847,13 @@ action.escu.full_search_name = ESCU - Multiple Archive Files Http Post Traffic - action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Command and Control"] +action.escu.analytic_story = ["Command and Control", "Data Exfiltration"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Multiple Archive Files Http Post Traffic - Rule -action.correlationsearch.annotations = {"analytic_story": ["Command and Control"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003"]} +action.correlationsearch.annotations = {"analytic_story": ["Command and Control", "Data Exfiltration"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is designed to detect high frequency of archive files data exfiltration through HTTP POST method protocol. This are one of the common techniques used by APT or trojan spy after doing the data collection like screenshot, recording, sensitive data to the infected machines. The attacker may execute archiving command to the collected data, save it a temp folder with a hidden attribute then send it to its C2 through HTTP POST. Sometimes adversaries will rename the archive files or encode/encrypt to cover their tracks. This detection can detect a renamed archive files transfer to HTTP POST since it checks the request body header. Unfortunately this detection cannot support archive that was encrypted or encoded before doing the exfiltration. @@ -12381,6 +12535,8 @@ action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -12421,6 +12577,8 @@ action.risk = 1 action.risk.param._risk_object = ActorIpAddress action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -12461,6 +12619,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -12501,6 +12661,8 @@ action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -12541,6 +12703,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -12581,6 +12745,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -12621,6 +12787,8 @@ action.risk = 1 action.risk.param._risk_object = UserId action.risk.param._risk_object_type = user action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -12661,6 +12829,8 @@ action.risk = 1 action.risk.param._risk_object = Source action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -12701,6 +12871,8 @@ action.risk = 1 action.risk.param._risk_object = src_user action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -12741,6 +12913,8 @@ action.risk = 1 action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -12781,6 +12955,8 @@ action.risk = 1 action.risk.param._risk_object = ForwardingSmtpAddress action.risk.param._risk_object_type = system action.risk.param._risk_score = 20 +action.risk.param._risk_message = +action.risk.param._risk = [] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -13424,13 +13600,13 @@ action.escu.full_search_name = ESCU - Plain HTTP POST Exfiltrated Data - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Command and Control"] +action.escu.analytic_story = ["Command and Control", "Data Exfiltration"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Plain HTTP POST Exfiltrated Data - Rule -action.correlationsearch.annotations = {"analytic_story": ["Command and Control"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003"]} +action.correlationsearch.annotations = {"analytic_story": ["Command and Control", "Data Exfiltration"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect potential plain HTTP POST method data exfiltration. This network traffic is commonly used by trickbot, trojanspy, keylogger or APT adversary where arguments or commands are sent in plain text to the remote C2 server using HTTP POST method as part of data exfiltration. @@ -17026,12 +17202,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious MSHTA Activity"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 40 +action.risk.param._risk_message = suspicious mshta child process detected on host $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 40}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}, {"threat_object_field": "parent_process", "threat_object_type": "process name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious mshta child process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 561eca82d2..ddd907ed3d 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-10T18:24:24 UTC +# On Date: 2021-06-20T02:10:33 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/use_case_library.conf b/dist/escu/default/use_case_library.conf index 7b4d4f1655..41808a2f51 100644 --- a/dist/escu/default/use_case_library.conf +++ b/dist/escu/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-10T18:24:24 UTC +# On Date: 2021-06-20T02:10:33 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -370,7 +370,7 @@ version = 1 references = ["https://attack.mitre.org/tactics/TA0010/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"] description = The stealing of data by an adversary. narrative = Exfiltration comes in many flavors. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command and Control channels that are already in place to exfiltrate data. They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place. @@ -3641,6 +3641,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]} known_false_positives = unknown providing_technologies = [] +[savedsearch://ESCU - Excessive number of distinct processes created in Windows Temp folder - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic will identify suspicious series of process executions. We have observed that post exploit framework tools like Koadic and Meterpreter will launch an excessive number of processes with distinct file paths from Windows\Temp to execute actions on objective. This behavior is extremely anomalous compared to typical application behaviors that use Windows\Temp. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]} +known_false_positives = Many benign applications will create processes from executables in Windows\Temp, although unlikely to exceed the given threshold. Filter as needed. +providing_technologies = [] + [savedsearch://ESCU - Excessive number of taskhost processes - Rule] type = detection asset_type = diff --git a/dist/escu/lookups/mitre_enrichment.csv b/dist/escu/lookups/mitre_enrichment.csv index 0717cbc6ba..b7c4ecb5a6 100644 --- a/dist/escu/lookups/mitre_enrichment.csv +++ b/dist/escu/lookups/mitre_enrichment.csv @@ -1,59 +1,182 @@ mitre_id,technique,tactics,groups -T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,no +T1553.006,Code Signing Policy Modification,Defense Evasion,Turla|APT39 +T1614,System Location Discovery,Discovery,no +T1613,Container and Resource Discovery,Discovery,no +T1552.007,Container API,Credential Access,no +T1612,Build Image on Host,Defense Evasion,no +T1611,Escape to Host,Privilege Escalation,no +T1204.003,Malicious Image,Execution,no +T1053.007,Container Orchestration Job,Execution|Persistence|Privilege Escalation,no +T1610,Deploy Container,Defense Evasion|Execution,no +T1609,Container Administration Command,Execution,no +T1608.005,Link Target,Resource Development,Silent Librarian +T1608.004,Drive-by Target,Resource Development,APT32|Threat Group-3390 +T1608.003,Install Digital Certificate,Resource Development,no +T1608.002,Upload Tool,Resource Development,Threat Group-3390 +T1608.001,Upload Malware,Resource Development,APT32 +T1608,Stage Capabilities,Resource Development,no +T1016.001,Internet Connection Discovery,Discovery,APT29|UNC2452|Turla +T1553.005,Mark-of-the-Web Bypass,Defense Evasion,TA505 +T1555.005,Password Managers,Credential Access,Fox Kitten|Operation Wocao +T1484.002,Domain Trust Modification,Defense Evasion|Privilege Escalation,APT29|UNC2452 +T1484.001,Group Policy Modification,Defense Evasion|Privilege Escalation,Indrik Spider +T1547.014,Active Setup,Persistence|Privilege Escalation,no +T1606.002,SAML Tokens,Credential Access,APT29|UNC2452 +T1606.001,Web Cookies,Credential Access,APT29|UNC2452 +T1606,Forge Web Credentials,Credential Access,no +T1555.004,Windows Credential Manager,Credential Access,Stealth Falcon|OilRig|Turla +T1059.008,Network Device CLI,Execution,no +T1602.002,Network Device Configuration Dump,Collection,no +T1542.005,TFTP Boot,Defense Evasion|Persistence,no +T1542.004,ROMMONkit,Defense Evasion|Persistence,no +T1602.001,SNMP (MIB Dump),Collection,no +T1602,Data from Configuration Repository,Collection,no +T1601.002,Downgrade System Image,Defense Evasion,no +T1601.001,Patch System Image,Defense Evasion,no +T1601,Modify System Image,Defense Evasion,no +T1600.002,Disable Crypto Hardware,Defense Evasion,no +T1600.001,Reduce Key Space,Defense Evasion,no +T1600,Weaken Encryption,Defense Evasion,no +T1556.004,Network Device Authentication,Credential Access|Defense Evasion|Persistence,no +T1599.001,Network Address Translation Traversal,Defense Evasion,no +T1599,Network Boundary Bridging,Defense Evasion,no +T1020.001,Traffic Duplication,Exfiltration,no +T1557.002,ARP Cache Poisoning,Credential Access|Collection,Cleaver +T1588.006,Vulnerabilities,Resource Development,Sandworm Team +T1053.006,Systemd Timers,Execution|Persistence|Privilege Escalation,no +T1562.008,Disable Cloud Logs,Defense Evasion,no +T1547.012,Print Processors,Persistence|Privilege Escalation,no +T1598.003,Spearphishing Link,Reconnaissance,Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky +T1598.002,Spearphishing Attachment,Reconnaissance,Sidewinder +T1598.001,Spearphishing Service,Reconnaissance,no +T1598,Phishing for Information,Reconnaissance,ZIRCONIUM|APT28 +T1597.002,Purchase Technical Data,Reconnaissance,no +T1597.001,Threat Intel Vendors,Reconnaissance,no +T1597,Search Closed Sources,Reconnaissance,no +T1596.005,Scan Databases,Reconnaissance,no +T1596.004,CDNs,Reconnaissance,no +T1596.003,Digital Certificates,Reconnaissance,no +T1596.001,DNS/Passive DNS,Reconnaissance,no +T1596.002,WHOIS,Reconnaissance,no +T1596,Search Open Technical Databases,Reconnaissance,no +T1595.002,Vulnerability Scanning,Reconnaissance,Volatile Cedar|APT28|Sandworm Team +T1595.001,Scanning IP Blocks,Reconnaissance,no +T1595,Active Scanning,Reconnaissance,no +T1594,Search Victim-Owned Websites,Reconnaissance,Silent Librarian|Sandworm Team +T1593.002,Search Engines,Reconnaissance,no +T1593.001,Social Media,Reconnaissance,no +T1593,Search Open Websites/Domains,Reconnaissance,Sandworm Team +T1592.004,Client Configurations,Reconnaissance,HAFNIUM +T1592.003,Firmware,Reconnaissance,no +T1592.002,Software,Reconnaissance,Sandworm Team +T1592.001,Hardware,Reconnaissance,no +T1592,Gather Victim Host Information,Reconnaissance,no +T1591.004,Identify Roles,Reconnaissance,no +T1591.003,Identify Business Tempo,Reconnaissance,no +T1591.001,Determine Physical Locations,Reconnaissance,no +T1591.002,Business Relationships,Reconnaissance,Sandworm Team +T1591,Gather Victim Org Information,Reconnaissance,no +T1590.006,Network Security Appliances,Reconnaissance,no +T1590.005,IP Addresses,Reconnaissance,HAFNIUM +T1590.004,Network Topology,Reconnaissance,no +T1590.003,Network Trust Dependencies,Reconnaissance,no +T1590.002,DNS,Reconnaissance,no +T1590.001,Domain Properties,Reconnaissance,Sandworm Team +T1590,Gather Victim Network Information,Reconnaissance,HAFNIUM +T1589.003,Employee Names,Reconnaissance,Silent Librarian|Sandworm Team +T1589.002,Email Addresses,Reconnaissance,TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team +T1589.001,Credentials,Reconnaissance,APT28|Magic Hound|Chimera +T1589,Gather Victim Identity Information,Reconnaissance,APT32 +T1588.005,Exploits,Resource Development,no +T1588.004,Digital Certificates,Resource Development,Lazarus Group|Silent Librarian +T1588.003,Code Signing Certificates,Resource Development,Wizard Spider +T1588.002,Tool,Resource Development,MuddyWater|Silent Librarian|GALLIUM|Sandworm Team +T1588.001,Malware,Resource Development,Turla|APT1 +T1588,Obtain Capabilities,Resource Development,no +T1587.004,Exploits,Resource Development,no +T1587.003,Digital Certificates,Resource Development,APT29|PROMETHIUM +T1587.002,Code Signing Certificates,Resource Development,PROMETHIUM|Patchwork +T1587.001,Malware,Resource Development,APT29|Lazarus Group|UNC2452|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver +T1587,Develop Capabilities,Resource Development,Kimsuky +T1586.002,Email Accounts,Resource Development,Magic Hound|Kimsuky +T1586.001,Social Media Accounts,Resource Development,no +T1586,Compromise Accounts,Resource Development,no +T1585.002,Email Accounts,Resource Development,Magic Hound|Silent Librarian|Sandworm Team|APT1 +T1585.001,Social Media Accounts,Resource Development,Fox Kitten|Sandworm Team|APT32|Cleaver +T1585,Establish Accounts,Resource Development,Fox Kitten|APT17 +T1584.006,Web Services,Resource Development,Turla +T1584.005,Botnet,Resource Development,no +T1584.004,Server,Resource Development,Indrik Spider|Turla|APT16 +T1584.003,Virtual Private Server,Resource Development,Turla +T1584.002,DNS Server,Resource Development,no +T1584.001,Domains,Resource Development,APT29|UNC2452|APT1 +T1583.006,Web Services,Resource Development,ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29 +T1583.005,Botnet,Resource Development,no +T1583.004,Server,Resource Development,GALLIUM|Sandworm Team +T1583.003,Virtual Private Server,Resource Development,HAFNIUM|TEMP.Veles +T1583.002,DNS Server,Resource Development,no +T1584,Compromise Infrastructure,Resource Development,no +T1583.001,Domains,Resource Development,APT29|Mustang Panda|ZIRCONIUM|UNC2452|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28 +T1583,Acquire Infrastructure,Resource Development,no +T1564.007,VBA Stomping,Defense Evasion,no +T1558.004,AS-REP Roasting,Credential Access,no +T1580,Cloud Infrastructure Discovery,Discovery,no +T1218.012,Verclsid,Defense Evasion,no +T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,PROMETHIUM T1564.006,Run Virtual Instance,Defense Evasion,no T1564.005,Hidden File System,Defense Evasion,Strider|Equation -T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion,no +T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion|Persistence,no T1574.012,COR_PROFILER,Persistence|Privilege Escalation|Defense Evasion,Blue Mockingbird T1562.007,Disable or Modify Cloud Firewall,Defense Evasion,no T1098.004,SSH Authorized Keys,Persistence,no T1480.001,Environmental Keying,Defense Evasion,APT41|Equation -T1059.007,JavaScript/JScript,Execution,APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer +T1059.007,JavaScript,Execution,MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer T1578.004,Revert Cloud Instance,Defense Evasion,no T1578.003,Delete Cloud Instance,Defense Evasion,no T1578.001,Create Snapshot,Defense Evasion,no T1578.002,Create Cloud Instance,Defense Evasion,no T1127.001,MSBuild,Defense Evasion,Frankenstein -T1027.005,Indicator Removal from Tools,Defense Evasion,Soft Cell|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda +T1027.005,Indicator Removal from Tools,Defense Evasion,Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda T1562.006,Indicator Blocking,Defense Evasion,no -T1573.002,Asymmetric Cryptography,Command And Control,Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6 -T1573.001,Symmetric Cryptography,Command And Control,Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group +T1573.002,Asymmetric Cryptography,Command And Control,Operation Wocao|Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6 +T1573.001,Symmetric Cryptography,Command And Control,Mustang Panda|Darkhotel|ZIRCONIUM|Higaisa|Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group T1573,Encrypted Channel,Command And Control,Tropic Trooper T1027.004,Compile After Delivery,Defense Evasion,Gamaredon Group|Rocke|MuddyWater T1574.004,Dylib Hijacking,Persistence|Privilege Escalation|Defense Evasion,no T1546.015,Component Object Model Hijacking,Privilege Escalation|Persistence,APT28 -T1071.004,DNS,Command And Control,APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 -T1071.003,Mail Protocols,Command And Control,APT32|SilverTerrier|APT28 -T1071.002,File Transfer Protocols,Command And Control,APT41|SilverTerrier|Machete|Honeybee -T1071.001,Web Protocols,Command And Control,Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|Machete|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Cobalt Group|APT19|Threat Group-3390|Rancor|Orangeworm|APT37|Ke3chang|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|APT32|OilRig|Magic Hound|Gamaredon Group|Stealth Falcon -T1572,Protocol Tunneling,Command And Control,OilRig|Cobalt Group|FIN6 -T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group -T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,no +T1071.004,DNS,Command And Control,Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 +T1071.003,Mail Protocols,Command And Control,Turla|Kimsuky|APT32|SilverTerrier|APT28 +T1071.002,File Transfer Protocols,Command And Control,Kimsuky|APT41|SilverTerrier|Honeybee +T1071.001,Web Protocols,Command And Control,APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|UNC2452|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|APT19|Cobalt Group|Rancor|Orangeworm|Threat Group-3390|Ke3chang|Turla|APT37|Dark Caracal|Lazarus Group|BRONZE BUTLER|APT32|Magic Hound|OilRig|Gamaredon Group|Stealth Falcon +T1572,Protocol Tunneling,Command And Control,Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6 +T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group +T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,APT29|UNC2452 T1048.001,Exfiltration Over Symmetric Encrypted Non-C2 Protocol,Exfiltration,no -T1001.003,Protocol Impersonation,Command And Control,Lazarus Group -T1001.002,Steganography,Command And Control,Axiom +T1001.003,Protocol Impersonation,Command And Control,Higaisa|Lazarus Group +T1001.002,Steganography,Command And Control,APT29|Axiom T1001.001,Junk Data,Command And Control,APT28 T1132.002,Non-Standard Encoding,Command And Control,no -T1132.001,Standard Encoding,Command And Control,Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork +T1132.001,Standard Encoding,Command And Control,HAFNIUM|TA551|Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork T1090.004,Domain Fronting,Command And Control,APT29 -T1090.003,Multi-hop Proxy,Command And Control,Inception|FIN4|APT29 -T1090.002,External Proxy,Command And Control,APT39|Silence|Soft Cell|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28 -T1090.001,Internal Proxy,Command And Control,APT39|Strider +T1090.003,Multi-hop Proxy,Command And Control,APT28|Operation Wocao|Inception|FIN4|APT29 +T1090.002,External Proxy,Command And Control,APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28 +T1090.001,Internal Proxy,Command And Control,APT29|Higaisa|UNC2452|Operation Wocao|APT39|Strider T1102.003,One-Way Communication,Command And Control,Leviathan -T1102.002,Bidirectional Communication,Command And Control,Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak +T1102.002,Bidirectional Communication,Command And Control,ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|FIN7|Turla|APT37|Magic Hound|Carbanak T1102.001,Dead Drop Resolver,Command And Control,Rocke|APT41|BRONZE BUTLER|RTM|Patchwork T1571,Non-Standard Port,Command And Control,Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7 -T1074.002,Remote Data Staging,Collection,Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8 -T1074.001,Local Data Staging,Collection,Machete|Soft Cell|TEMP.Veles|Patchwork|Dragonfly 2.0|Honeybee|Leviathan|APT3|FIN5|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT28 +T1074.002,Remote Data Staging,Collection,APT29|Chimera|UNC2452|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8 +T1074.001,Local Data Staging,Collection,Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Honeybee|Patchwork|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28 T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT33 T1564.004,NTFS File Attributes,Defense Evasion,APT32 -T1564.003,Hidden Window,Defense Evasion,Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound -T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Tropic Trooper|FIN10|Stolen Pencil|APT32 -T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,TA505|APT3|Threat Group-1314 +T1564.003,Hidden Window,Defense Evasion,Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound +T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|Stolen Pencil|APT32 +T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314 T1078.001,Default Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,no T1564.002,Hidden Users,Defense Evasion,no -T1574.006,LD_PRELOAD,Persistence|Privilege Escalation|Defense Evasion,Rocke -T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,BRONZE BUTLER|Naikon|APT41|Soft Cell|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390 -T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Whitefly|RTM|Threat Group-3390|menuPass +T1574.006,Dynamic Linker Hijacking,Persistence|Privilege Escalation|Defense Evasion,APT41|Rocke +T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390 +T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass T1574.008,Path Interception by Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,no T1574.007,Path Interception by PATH Environment Variable,Persistence|Privilege Escalation|Defense Evasion,no T1574.009,Path Interception by Unquoted Path,Persistence|Privilege Escalation|Defense Evasion,no @@ -61,174 +184,174 @@ T1574.011,Services Registry Permissions Weakness,Persistence|Privilege Escalatio T1574.005,Executable Installer File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no T1574.010,Services File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no T1574,Hijack Execution Flow,Persistence|Privilege Escalation|Defense Evasion,no -T1069.001,Local Groups,Discovery,Turla|OilRig|admin@338 -T1570,Lateral Tool Transfer,Lateral Movement,APT32|Wizard Spider|Turla|FIN10 +T1069.001,Local Groups,Discovery,Chimera|Operation Wocao|Turla|OilRig|admin@338 +T1570,Lateral Tool Transfer,Lateral Movement,Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10 T1568.003,DNS Calculation,Command And Control,APT12 -T1204.002,Malicious File,Execution,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|APT19|Dragonfly 2.0|BRONZE BUTLER|Cobalt Group|DarkHydrus|Gorgon Group|Patchwork|OilRig|Dark Caracal|MuddyWater|Lazarus Group|FIN7|APT32|Rancor|APT37|FIN8|APT28|Elderwood|TA459|APT29|Leviathan|menuPass|PLATINUM -T1204.001,Malicious Link,Execution,Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla +T1204.002,Malicious File,Execution,Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|BRONZE BUTLER|FIN7|Dragonfly 2.0|APT19|Dark Caracal|Cobalt Group|Gorgon Group|Patchwork|MuddyWater|DarkHydrus|OilRig|APT32|Rancor|Lazarus Group|APT29|APT28|APT37|FIN8|Elderwood|menuPass|PLATINUM|TA459|Leviathan +T1204.001,Malicious Link,Execution,APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla T1195.003,Compromise Hardware Supply Chain,Initial Access,no -T1195.002,Compromise Software Supply Chain,Initial Access,Sandworm Team|APT41 +T1195.002,Compromise Software Supply Chain,Initial Access,APT29|UNC2452|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41 T1195.001,Compromise Software Dependencies and Development Tools,Initial Access,no -T1568.001,Fast Flux DNS,Command And Control,TA505 -T1052.001,Exfiltration over USB,Exfiltration,Tropic Trooper -T1569.002,Service Execution,Execution,Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang +T1568.001,Fast Flux DNS,Command And Control,menuPass|TA505 +T1052.001,Exfiltration over USB,Exfiltration,Mustang Panda|Tropic Trooper +T1569.002,Service Execution,Execution,Chimera|Operation Wocao|Wizard Spider|Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang T1569.001,Launchctl,Execution,no T1569,System Services,Execution,no -T1568.002,Domain Generation Algorithms,Command And Control,APT41 -T1568,Dynamic Resolution,Command And Control,no +T1568.002,Domain Generation Algorithms,Command And Control,TA551|APT41 +T1568,Dynamic Resolution,Command And Control,APT29|UNC2452 T1011.001,Exfiltration Over Bluetooth,Exfiltration,no -T1567.002,Exfiltration to Cloud Storage,Exfiltration,Leviathan|Turla +T1567.002,Exfiltration to Cloud Storage,Exfiltration,ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla T1567.001,Exfiltration to Code Repository,Exfiltration,no -T1059.006,Python,Execution,Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete -T1059.005,Visual Basic,Execution,APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound +T1059.006,Python,Execution,ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete +T1059.005,Visual Basic,Execution,Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|Lazarus Group|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound T1059.004,Unix Shell,Execution,Rocke|APT41 -T1059.003,Windows Command Shell,Execution,TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|Soft Cell|Turla|Silence|APT32|APT39|Darkhotel|MuddyWater|APT18|APT38|Dark Caracal|Gorgon Group|Dragonfly 2.0|Rancor|Ke3chang|APT37|Leviathan|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|Threat Group-3390|menuPass|Gamaredon Group|Suckfly|Patchwork|Threat Group-1314|APT3|admin@338|APT1 +T1059.003,Windows Command Shell,Execution,APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|UNC2452|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Rancor|Ke3chang|Dragonfly 2.0|Leviathan|APT37|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|menuPass|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1 T1059.002,AppleScript,Execution,no -T1059.001,PowerShell,Execution,Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|DarkHydrus|APT28|Thrip|Gorgon Group|Cobalt Group|Dragonfly 2.0|Leviathan|TA459|FIN8|MuddyWater|Magic Hound|OilRig|BRONZE BUTLER|CopyKittens|APT32|FIN7|FIN10|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda -T1567,Exfiltration Over Web Service,Exfiltration,no +T1059.001,PowerShell,Execution,Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Lazarus Group|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|Dragonfly 2.0|APT28|Thrip|Cobalt Group|DarkHydrus|Gorgon Group|Leviathan|TA459|MuddyWater|FIN8|Magic Hound|CopyKittens|OilRig|BRONZE BUTLER|FIN10|Threat Group-3390|APT32|FIN7|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda +T1567,Exfiltration Over Web Service,Exfiltration,APT28 T1497.003,Time Based Evasion,Defense Evasion|Discovery,no -T1497.002,User Activity Based Checks,Defense Evasion|Discovery,FIN7 -T1497.001,System Checks,Defense Evasion|Discovery,Frankenstein +T1497.002,User Activity Based Checks,Defense Evasion|Discovery,Darkhotel|FIN7 +T1497.001,System Checks,Defense Evasion|Discovery,Darkhotel|Evilnum|Frankenstein T1498.002,Reflection Amplification,Impact,no T1498.001,Direct Network Flood,Impact,no -T1566.003,Spearphishing via Service,Initial Access,Magic Hound|Windshift|FIN6|OilRig|Dark Caracal -T1566.002,Spearphishing Link,Initial Access,Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Turla|APT28|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|Leviathan|Magic Hound|Patchwork|APT29|FIN8 -T1566.001,Spearphishing Attachment,Initial Access,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|OilRig|Lazarus Group|APT19|Dragonfly 2.0|BRONZE BUTLER|APT32|FIN8|MuddyWater|APT28|TA459|Leviathan|Patchwork|PLATINUM|Elderwood|APT29|APT37|menuPass -T1566,Phishing,Initial Access,no +T1566.003,Spearphishing via Service,Initial Access,Ajax Security Team|Lazarus Group|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal +T1566.002,Spearphishing Link,Initial Access,Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Cobalt Group|Turla|APT28|Dragonfly 2.0|OilRig|APT33|APT29|Leviathan|Elderwood|FIN8|Patchwork|Magic Hound +T1566.001,Spearphishing Attachment,Initial Access,Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|APT19|Lazarus Group|OilRig|APT32|BRONZE BUTLER|Dragonfly 2.0|MuddyWater|APT28|FIN8|TA459|Elderwood|APT29|Leviathan|Patchwork|APT37|menuPass|PLATINUM +T1566,Phishing,Initial Access,GOLD SOUTHFIELD|Dragonfly T1565.003,Runtime Data Manipulation,Impact,APT38 T1565.002,Transmitted Data Manipulation,Impact,APT38 T1565.001,Stored Data Manipulation,Impact,FIN4|APT38 T1565,Data Manipulation,Impact,no -T1564.001,Hidden Files and Directories,Defense Evasion,Rocke|APT32|Tropic Trooper|APT28|Lazarus Group +T1564.001,Hidden Files and Directories,Defense Evasion,Mustang Panda|Rocke|APT32|Tropic Trooper|Lazarus Group|APT28 T1564,Hide Artifacts,Defense Evasion,no T1563.002,RDP Hijacking,Lateral Movement,no T1563.001,SSH Hijacking,Lateral Movement,no T1563,Remote Service Session Hijacking,Lateral Movement,no -T1518.001,Security Software Discovery,Discovery,Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon +T1518.001,Security Software Discovery,Discovery,Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon T1069.003,Cloud Groups,Discovery,no -T1069.002,Domain Groups,Discovery,Turla|Wizard Spider|Inception|OilRig|FIN6|Dragonfly 2.0|Ke3chang +T1069.002,Domain Groups,Discovery,Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang T1087.004,Cloud Account,Discovery,no T1087.003,Email Account,Discovery,Sandworm Team|TA505 -T1087.002,Domain Account,Discovery,Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang -T1087.001,Local Account,Discovery,Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338 +T1087.002,Domain Account,Discovery,MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|BRONZE BUTLER|OilRig|menuPass|FIN6|Poseidon Group|Ke3chang +T1087.001,Local Account,Discovery,Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338 T1553.004,Install Root Certificate,Defense Evasion,no -T1562.004,Disable or Modify System Firewall,Defense Evasion,Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak -T1562.003,HISTCONTROL,Defense Evasion,no -T1562.002,Disable Windows Event Logging,Defense Evasion,Threat Group-3390 -T1562.001,Disable or Modify Tools,Defense Evasion,Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda +T1562.004,Disable or Modify System Firewall,Defense Evasion,APT29|UNC2452|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak +T1562.003,Impair Command History Logging,Defense Evasion,no +T1562.002,Disable Windows Event Logging,Defense Evasion,APT29|UNC2452|Threat Group-3390 +T1562.001,Disable or Modify Tools,Defense Evasion,APT29|MuddyWater|UNC2452|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda T1562,Impair Defenses,Defense Evasion,no T1003.004,LSA Secrets,Credential Access,OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390 T1003.005,Cached Domain Credentials,Credential Access,OilRig|MuddyWater|Leafminer|APT33 T1561.002,Disk Structure Wipe,Impact,Sandworm Team|Lazarus Group|APT38|APT37 T1561.001,Disk Content Wipe,Impact,Lazarus Group T1561,Disk Wipe,Impact,no -T1560.003,Archive via Custom Method,Collection,Lazarus Group|Kimsuky|CopyKittens|FIN6 +T1560.003,Archive via Custom Method,Collection,Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6 T1560.002,Archive via Library,Collection,Lazarus Group|Threat Group-3390 -T1560.001,Archive via Utility,Collection,APT41|Soft Cell|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|APT3|Sowbug|menuPass|APT1|Ke3chang +T1560.001,Archive via Utility,Collection,APT29|Mustang Panda|HAFNIUM|UNC2452|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang T1560,Archive Collected Data,Collection,menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang T1499.004,Application or System Exploitation,Impact,no T1499.003,Application Exhaustion Flood,Impact,no T1499.002,Service Exhaustion Flood,Impact,no T1499.001,OS Exhaustion Flood,Impact,no -T1491.002,External Defacement,Impact,no +T1491.002,External Defacement,Impact,Sandworm Team T1491.001,Internal Defacement,Impact,Lazarus Group -T1114.003,Email Forwarding Rule,Collection,no -T1114.002,Remote Email Collection,Collection,APT1|FIN4|APT28|Dragonfly 2.0|Ke3chang|Leafminer -T1114.001,Local Email Collection,Collection,Magic Hound|APT1 +T1114.003,Email Forwarding Rule,Collection,Silent Librarian|Kimsuky +T1114.002,Remote Email Collection,Collection,APT29|HAFNIUM|Chimera|UNC2452|APT1|FIN4|Dragonfly 2.0|APT28|Leafminer|Ke3chang +T1114.001,Local Email Collection,Collection,Chimera|Magic Hound|APT1 T1134.005,SID-History Injection,Defense Evasion|Privilege Escalation,no T1134.004,Parent PID Spoofing,Defense Evasion|Privilege Escalation,no T1134.003,Make and Impersonate Token,Defense Evasion|Privilege Escalation,no T1134.002,Create Process with Token,Defense Evasion|Privilege Escalation,Turla|Lazarus Group T1134.001,Token Impersonation/Theft,Defense Evasion|Privilege Escalation,APT28 -T1213.002,Sharepoint,Collection,Ke3chang|APT28 +T1213.002,Sharepoint,Collection,Chimera|Ke3chang|APT28 T1213.001,Confluence,Collection,no -T1555.003,Credentials from Web Browsers,Credential Access,Magic Hound|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats +T1555.003,Credentials from Web Browsers,Credential Access,Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats T1555.002,Securityd Memory,Credential Access,no T1555.001,Keychain,Credential Access,no -T1559.002,Dynamic Data Exchange,Execution,Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7 +T1559.002,Dynamic Data Exchange,Execution,Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7 T1559.001,Component Object Model,Execution,Gamaredon Group|MuddyWater T1559,Inter-Process Communication,Execution,no T1558.002,Silver Ticket,Credential Access,no T1558.001,Golden Ticket,Credential Access,Ke3chang T1558,Steal or Forge Kerberos Tickets,Credential Access,no -T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,no -T1557,Man-in-the-Middle,Credential Access|Collection,no -T1556.002,Password Filter DLL,Credential Access|Defense Evasion,Strider -T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion,no -T1556,Modify Authentication Process,Credential Access|Defense Evasion,no +T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,Wizard Spider +T1557,Man-in-the-Middle,Credential Access|Collection,Kimsuky +T1556.002,Password Filter DLL,Credential Access|Defense Evasion|Persistence,Strider +T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion|Persistence,Chimera +T1556,Modify Authentication Process,Credential Access|Defense Evasion|Persistence,no T1056.004,Credential API Hooking,Collection|Credential Access,PLATINUM T1056.003,Web Portal Capture,Collection|Credential Access,no T1056.002,GUI Input Capture,Collection|Credential Access,FIN4 -T1056.001,Keylogging,Collection|Credential Access,APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|Ke3chang|OilRig|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28 -T1555,Credentials from Password Stores,Credential Access,APT39|OilRig|MuddyWater|Leafminer|APT33|Turla|Stealth Falcon +T1056.001,Keylogging,Collection|Credential Access,Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28 +T1555,Credentials from Password Stores,Credential Access,APT29|Evilnum|UNC2452|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon T1552.005,Cloud Instance Metadata API,Credential Access,no T1003.008,/etc/passwd and /etc/shadow,Credential Access,no T1003.007,Proc Filesystem,Credential Access,no -T1003.006,DCSync,Credential Access,no -T1558.003,Kerberoasting,Credential Access,no +T1003.006,DCSync,Credential Access,APT29|UNC2452|Operation Wocao +T1558.003,Kerberoasting,Credential Access,APT29|UNC2452|Operation Wocao|Wizard Spider T1552.006,Group Policy Preferences,Credential Access,APT33 -T1003.003,NTDS,Credential Access,FIN6|Dragonfly 2.0 -T1003.002,Security Account Manager,Credential Access,Threat Group-3390|Ke3chang|Soft Cell|Night Dragon|Dragonfly 2.0|menuPass -T1003.001,LSASS Memory,Credential Access,Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|Soft Cell|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Lazarus Group|Leafminer|Magic Hound|MuddyWater|PLATINUM|FIN8|BRONZE BUTLER|OilRig|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver -T1110.004,Credential Stuffing,Credential Access,no -T1110.003,Password Spraying,Credential Access,APT33|Leafminer|Lazarus Group -T1110.002,Password Cracking,Credential Access,APT41|Dragonfly 2.0|APT3 -T1110.001,Password Guessing,Credential Access,no -T1021.006,Windows Remote Management,Lateral Movement,Threat Group-3390 -T1021.005,VNC,Lateral Movement,GCMAN -T1021.004,SSH,Lateral Movement,Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN +T1003.003,NTDS,Credential Access,Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0 +T1003.002,Security Account Manager,Credential Access,Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass +T1003.001,LSASS Memory,Credential Access,HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Leafminer|Magic Hound|Lazarus Group|MuddyWater|PLATINUM|FIN8|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver +T1110.004,Credential Stuffing,Credential Access,Chimera +T1110.003,Password Spraying,Credential Access,Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group +T1110.002,Password Cracking,Credential Access,FIN6|APT41|Dragonfly 2.0|APT3 +T1110.001,Password Guessing,Credential Access,APT28 +T1021.006,Windows Remote Management,Lateral Movement,APT29|UNC2452|Chimera|Wizard Spider|Threat Group-3390 +T1021.005,VNC,Lateral Movement,Fox Kitten|GCMAN +T1021.004,SSH,Lateral Movement,Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN T1021.003,Distributed Component Object Model,Lateral Movement,no -T1021.002,SMB/Windows Admin Shares,Lateral Movement,Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang -T1021.001,Remote Desktop Protocol,Lateral Movement,Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|menuPass|FIN10|Patchwork|FIN6|Lazarus Group|APT1|Axiom +T1021.002,SMB/Windows Admin Shares,Lateral Movement,Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang +T1021.001,Remote Desktop Protocol,Lateral Movement,Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom T1554,Compromise Client Software Binary,Persistence,no T1036.006,Space after Filename,Defense Evasion,no -T1036.005,Match Legitimate Name or Location,Defense Evasion,Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 -T1036.004,Masquerade Task or Service,Defense Evasion,Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 -T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|Soft Cell|PLATINUM +T1036.005,Match Legitimate Name or Location,Defense Evasion,APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|UNC2452|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 +T1036.004,Masquerade Task or Service,Defense Evasion,ZIRCONIUM|APT29|Higaisa|UNC2452|Fox Kitten|Kimsuky|Lazarus Group|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 +T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|GALLIUM T1036.002,Right-to-Left Override,Defense Evasion,BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic -T1036.001,Invalid Code Signature,Defense Evasion,Windshift +T1036.001,Invalid Code Signature,Defense Evasion,Windshift|APT37 T1553.003,SIP and Trust Provider Hijacking,Defense Evasion,no -T1553.002,Code Signing,Defense Evasion,Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|APT37|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel +T1553.002,Code Signing,Defense Evasion,APT29|GALLIUM|UNC2452|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel T1553.001,Gatekeeper Bypass,Defense Evasion,no T1553,Subvert Trust Controls,Defense Evasion,no -T1027.003,Steganography,Defense Evasion,BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37 -T1027.002,Software Packing,Defense Evasion,TA505|Rocke|Soft Cell|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon -T1027.001,Binary Padding,Defense Evasion,Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee +T1027.003,Steganography,Defense Evasion,TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37 +T1027.002,Software Packing,Defense Evasion,ZIRCONIUM|Lazarus Group|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon +T1027.001,Binary Padding,Defense Evasion,Mustang Panda|Higaisa|Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee T1222.002,Linux and Mac File and Directory Permissions Modification,Defense Evasion,Rocke|APT32 -T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,no -T1552.004,Private Keys,Credential Access,Rocke +T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,Wizard Spider +T1552.004,Private Keys,Credential Access,APT29|UNC2452|Operation Wocao|Rocke T1552.003,Bash History,Credential Access,no T1552.002,Credentials in Registry,Credential Access,APT32 -T1552.001,Credentials In Files,Credential Access,Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3 +T1552.001,Credentials In Files,Credential Access,Fox Kitten|Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3 T1552,Unsecured Credentials,Credential Access,no T1216.001,PubPrn,Defense Evasion,APT32 -T1070.006,Timestomp,Defense Evasion,Rocke|TEMP.Veles|APT32|Lazarus Group|APT28 +T1070.006,Timestomp,Defense Evasion,APT29|UNC2452|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28 T1070.005,Network Share Connection Removal,Defense Evasion,Threat Group-3390 -T1070.004,File Deletion,Defense Evasion,Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|FIN10|APT28|Threat Group-3390|Group5|Lazarus Group|APT18|APT29 +T1070.004,File Deletion,Defense Evasion,APT39|Mustang Panda|Chimera|Evilnum|UNC2452|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|Threat Group-3390|FIN10|APT28|Group5|Lazarus Group|APT18|APT29 T1070.003,Clear Command History,Defense Evasion,APT41 -T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,no +T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,APT29|UNC2452 T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT28 T1550.003,Pass the Ticket,Defense Evasion|Lateral Movement,APT32|BRONZE BUTLER|APT29 -T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Soft Cell|APT32|Night Dragon|APT28|APT1 -T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,no +T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Chimera|Kimsuky|GALLIUM|APT32|Night Dragon|APT28|APT1 +T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,APT29|UNC2452 T1548.004,Elevated Execution with Prompt,Privilege Escalation|Defense Evasion,no T1548.003,Sudo and Sudo Caching,Privilege Escalation|Defense Evasion,no -T1548.002,Bypass User Access Control,Privilege Escalation|Defense Evasion,APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29 +T1548.002,Bypass User Account Control,Privilege Escalation|Defense Evasion,Evilnum|APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29 T1548.001,Setuid and Setgid,Privilege Escalation|Defense Evasion,no T1548,Abuse Elevation Control Mechanism,Privilege Escalation|Defense Evasion,no T1136.003,Cloud Account,Persistence,no T1070.002,Clear Linux or Mac System Logs,Defense Evasion,Rocke -T1070.001,Clear Windows Event Logs,Defense Evasion,APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 -T1136.002,Domain Account,Persistence,Soft Cell -T1136.001,Local Account,Persistence,APT39|APT41|Dragonfly 2.0|Leafminer|APT3 +T1070.001,Clear Windows Event Logs,Defense Evasion,Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 +T1136.002,Domain Account,Persistence,HAFNIUM|GALLIUM +T1136.001,Local Account,Persistence,Fox Kitten|APT39|APT41|Dragonfly 2.0|Leafminer|APT3 T1547.011,Plist Modification,Persistence|Privilege Escalation,no T1547.010,Port Monitors,Persistence|Privilege Escalation,no -T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Leviathan|Lazarus Group +T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan T1547.008,LSASS Driver,Persistence|Privilege Escalation,no T1547.007,Re-opened Applications,Persistence|Privilege Escalation,no T1547.006,Kernel Modules and Extensions,Persistence|Privilege Escalation,no -T1547.005,Security Support Provider,Persistence|Privilege Escalation,no -T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Tropic Trooper|Turla +T1547.005,Security Support Provider,Persistence|Privilege Escalation,Lazarus Group +T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Wizard Spider|Tropic Trooper|Turla T1547.003,Time Providers,Persistence|Privilege Escalation,no T1546.014,Emond,Privilege Escalation|Persistence,no T1546.013,PowerShell Profile,Privilege Escalation|Persistence,Turla @@ -236,38 +359,38 @@ T1546.012,Image File Execution Options Injection,Privilege Escalation|Persistenc T1218.008,Odbcconf,Defense Evasion,Cobalt Group T1546.011,Application Shimming,Privilege Escalation|Persistence,FIN7 T1547.002,Authentication Package,Persistence|Privilege Escalation,no -T1546.010,AppInit DLLs,Privilege Escalation|Persistence,no +T1546.010,AppInit DLLs,Privilege Escalation|Persistence,APT39 T1546.009,AppCert DLLs,Privilege Escalation|Persistence,Honeybee -T1218.007,Msiexec,Defense Evasion,TA505|Rancor -T1546.008,Accessibility Features,Privilege Escalation|Persistence,APT41|APT3|APT29|Deep Panda|Axiom +T1218.007,Msiexec,Defense Evasion,ZIRCONIUM|Molerats|Machete|TA505|Rancor +T1546.008,Accessibility Features,Privilege Escalation|Persistence,Fox Kitten|APT41|APT3|APT29|Deep Panda|Axiom T1546.007,Netsh Helper DLL,Privilege Escalation|Persistence,no T1546.006,LC_LOAD_DYLIB Addition,Privilege Escalation|Persistence,no T1546.005,Trap,Privilege Escalation|Persistence,no -T1546.004,.bash_profile and .bashrc,Privilege Escalation|Persistence,no -T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,APT33|Blue Mockingbird|Turla|Leviathan|APT29 +T1546.004,Unix Shell Configuration Modification,Privilege Escalation|Persistence,no +T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,Mustang Panda|UNC2452|APT33|Blue Mockingbird|Turla|Leviathan|APT29 T1546.002,Screensaver,Privilege Escalation|Persistence,no T1546.001,Change Default File Association,Privilege Escalation|Persistence,Kimsuky -T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|Dark Caracal|Cobalt Group|Honeybee|Threat Group-3390|Dragonfly 2.0|Gorgon Group|Ke3chang|APT19|Leviathan|MuddyWater|APT37|BRONZE BUTLER|Magic Hound|APT3|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel +T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Turla|APT19|Honeybee|Dark Caracal|Threat Group-3390|Cobalt Group|Ke3chang|Gorgon Group|Dragonfly 2.0|APT37|MuddyWater|Leviathan|APT3|BRONZE BUTLER|Magic Hound|FIN7|FIN10|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel T1218.002,Control Panel,Defense Evasion,no -T1218.010,Regsvr32,Defense Evasion,Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda +T1218.010,Regsvr32,Defense Evasion,TA551|Blue Mockingbird|Inception|WIRTE|APT19|Cobalt Group|Leviathan|APT32|Deep Panda T1218.009,Regsvcs/Regasm,Defense Evasion,no -T1218.005,Mshta,Defense Evasion,Inception|Kimsuky|APT32|MuddyWater|FIN7 -T1218.004,InstallUtil,Defense Evasion,no +T1218.005,Mshta,Defense Evasion,Mustang Panda|TA551|Sidewinder|Lazarus Group|Inception|Kimsuky|APT32|MuddyWater|FIN7 +T1218.004,InstallUtil,Defense Evasion,Mustang Panda|menuPass T1218.001,Compiled HTML File,Defense Evasion,APT41|Silence|Lazarus Group|Dark Caracal|OilRig T1218.003,CMSTP,Defense Evasion,Cobalt Group|MuddyWater -T1218.011,Rundll32,Defense Evasion,APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 +T1218.011,Rundll32,Defense Evasion,HAFNIUM|TA551|UNC2452|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 T1547,Boot or Logon Autostart Execution,Persistence|Privilege Escalation,no T1546,Event Triggered Execution,Privilege Escalation|Persistence,no T1098.003,Add Office 365 Global Administrator Role,Persistence,no -T1098.002,Exchange Email Delegate Permissions,Persistence,Magic Hound -T1098.001,Additional Azure Service Principal Credentials,Persistence,no +T1098.002,Exchange Email Delegate Permissions,Persistence,APT29|UNC2452|Magic Hound +T1098.001,Additional Cloud Credentials,Persistence,APT29|UNC2452 T1543.004,Launch Daemon,Persistence|Privilege Escalation,no -T1543.003,Windows Service,Persistence|Privilege Escalation,Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|Honeybee|FIN7|Threat Group-3390|APT19|APT3|Lazarus Group|Carbanak +T1543.003,Windows Service,Persistence|Privilege Escalation,PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Honeybee|Threat Group-3390|APT3|Lazarus Group|Carbanak T1543.002,Systemd Service,Persistence|Privilege Escalation,Rocke T1543.001,Launch Agent,Persistence|Privilege Escalation,no T1037.005,Startup Items,Persistence|Privilege Escalation,no -T1037.004,Rc.common,Persistence|Privilege Escalation,no -T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|menuPass|Gorgon Group|Patchwork +T1037.004,RC Scripts,Persistence|Privilege Escalation,no +T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|Gorgon Group|menuPass|Patchwork T1055.013,Process Doppelgänging,Defense Evasion|Privilege Escalation,Leafminer T1055.011,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no T1055.014,VDSO Hijacking,Defense Evasion|Privilege Escalation,no @@ -277,7 +400,7 @@ T1055.005,Thread Local Storage,Defense Evasion|Privilege Escalation,no T1055.004,Asynchronous Procedure Call,Defense Evasion|Privilege Escalation,no T1055.003,Thread Execution Hijacking,Defense Evasion|Privilege Escalation,no T1055.002,Portable Executable Injection,Defense Evasion|Privilege Escalation,Rocke|Gorgon Group -T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda +T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,Wizard Spider|TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda T1037.003,Network Logon Script,Persistence|Privilege Escalation,no T1543,Create or Modify System Process,Persistence|Privilege Escalation,no T1037.002,Logon Script (Mac),Persistence|Privilege Escalation,no @@ -285,13 +408,13 @@ T1037.001,Logon Script (Windows),Persistence|Privilege Escalation,Cobalt Group|A T1542.003,Bootkit,Persistence|Defense Evasion,APT41|Lazarus Group|APT28 T1542.002,Component Firmware,Persistence|Defense Evasion,Equation T1542.001,System Firmware,Persistence|Defense Evasion,no -T1505.003,Web Shell,Persistence,Tropic Trooper|Soft Cell|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda +T1505.003,Web Shell,Persistence,Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda T1505.002,Transport Agent,Persistence,no T1505.001,SQL Stored Procedures,Persistence,no T1053.003,Cron,Execution|Persistence|Privilege Escalation,Rocke T1053.004,Launchd,Execution|Persistence|Privilege Escalation,no T1053.001,At (Linux),Execution|Persistence|Privilege Escalation,no -T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Dragonfly 2.0|Patchwork|OilRig|Rancor|Cobalt Group|FIN8|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|APT3|APT29 +T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Mustang Panda|Higaisa|UNC2452|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Cobalt Group|Rancor|Dragonfly 2.0|OilRig|Patchwork|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29 T1053.002,At (Windows),Execution|Persistence|Privilege Escalation,BRONZE BUTLER|Threat Group-3390|APT18 T1542,Pre-OS Boot,Defense Evasion|Persistence,no T1137.001,Office Template Macros,Persistence,MuddyWater @@ -301,140 +424,141 @@ T1137.005,Outlook Rules,Persistence,no T1137.006,Add-ins,Persistence,Naikon T1137.002,Office Test,Persistence,APT28 T1531,Account Access Removal,Impact,no -T1539,Steal Web Session Cookie,Credential Access,no +T1539,Steal Web Session Cookie,Credential Access,Evilnum T1529,System Shutdown/Reboot,Impact,Lazarus Group|APT38|APT37 -T1518,Software Discovery,Discovery,BRONZE BUTLER|Tropic Trooper|Inception +T1518,Software Discovery,Discovery,Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception +T1547.013,XDG Autostart Entries,Persistence|Privilege Escalation,no T1534,Internal Spearphishing,Lateral Movement,Gamaredon Group T1528,Steal Application Access Token,Credential Access,APT28 T1535,Unused/Unsupported Cloud Regions,Defense Evasion,no -T1525,Implant Container Image,Persistence,no +T1525,Implant Internal Image,Persistence,no T1538,Cloud Service Dashboard,Discovery,no -T1530,Data from Cloud Storage Object,Collection,no +T1530,Data from Cloud Storage Object,Collection,Fox Kitten T1578,Modify Cloud Compute Infrastructure,Defense Evasion,no T1537,Transfer Data to Cloud Account,Exfiltration,no T1526,Cloud Service Discovery,Discovery,no T1505,Server Software Component,Persistence,no -T1499,Endpoint Denial of Service,Impact,no -T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,no -T1498,Network Denial of Service,Impact,no +T1499,Endpoint Denial of Service,Impact,Sandworm Team +T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,Darkhotel +T1498,Network Denial of Service,Impact,APT28 T1496,Resource Hijacking,Impact,Blue Mockingbird|Rocke|APT41|Lazarus Group T1495,Firmware Corruption,Impact,no T1491,Defacement,Impact,no T1490,Inhibit System Recovery,Impact,no -T1489,Service Stop,Impact,Lazarus Group -T1486,Data Encrypted for Impact,Impact,APT41|TA505|APT38 +T1489,Service Stop,Impact,Wizard Spider|Lazarus Group +T1486,Data Encrypted for Impact,Impact,Indrik Spider|APT41|TA505|APT38 T1485,Data Destruction,Impact,Sandworm Team|Lazarus Group|APT38 -T1484,Group Policy Modification,Defense Evasion|Privilege Escalation,no -T1482,Domain Trust Discovery,Discovery,Wizard Spider +T1484,Domain Policy Modification,Defense Evasion|Privilege Escalation,no +T1482,Domain Trust Discovery,Discovery,APT29|Chimera|UNC2452 T1480,Execution Guardrails,Defense Evasion,no T1222,File and Directory Permissions Modification,Defense Evasion,no +T1220,XSL Script Processing,Defense Evasion,Higaisa|Cobalt Group T1221,Template Injection,Defense Evasion,Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus -T1220,XSL Script Processing,Defense Evasion,Cobalt Group -T1197,BITS Jobs,Defense Evasion|Persistence,Patchwork|APT41|Leviathan -T1217,Browser Bookmark Discovery,Discovery,no -T1213,Data from Information Repositories,Collection,Turla -T1189,Drive-by Compromise,Initial Access,Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|BRONZE BUTLER|Leafminer|Dark Caracal|APT19|APT32|Lazarus Group|Threat Group-3390|Elderwood|APT37|Patchwork|PLATINUM -T1203,Exploitation for Client Execution,Execution,Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|Lazarus Group|BRONZE BUTLER|Cobalt Group|APT37|Patchwork|Leviathan|Elderwood|TA459|APT29 +T1189,Drive-by Compromise,Initial Access,Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|Leafminer|Lazarus Group|BRONZE BUTLER|APT19|APT32|Threat Group-3390|Dark Caracal|Elderwood|APT37|Patchwork|PLATINUM +T1190,Exploit Public-Facing Application,Initial Access,Volatile Cedar|UNC2452|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom +T1210,Exploitation of Remote Services,Lateral Movement,Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28 +T1217,Browser Bookmark Discovery,Discovery,Chimera|Fox Kitten +T1213,Data from Information Repositories,Collection,Fox Kitten|FIN6|Turla +T1197,BITS Jobs,Defense Evasion|Persistence,APT39|Patchwork|APT41|Leviathan +T1219,Remote Access Software,Command And Control,Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak +T1195,Supply Chain Compromise,Initial Access,no +T1204,User Execution,Execution,no T1212,Exploitation for Credential Access,Credential Access,no T1211,Exploitation for Defense Evasion,Defense Evasion,APT28 -T1190,Exploit Public-Facing Application,Initial Access,Blue Mockingbird|Rocke|APT39|BlackTech|APT41|Soft Cell|Night Dragon|Axiom -T1210,Exploitation of Remote Services,Lateral Movement,Threat Group-3390|APT28 -T1202,Indirect Command Execution,Defense Evasion,no T1200,Hardware Additions,Initial Access,DarkVishnya -T1201,Password Policy Discovery,Discovery,Turla|OilRig -T1219,Remote Access Software,Command And Control,Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak +T1202,Indirect Command Execution,Defense Evasion,no +T1201,Password Policy Discovery,Discovery,Chimera|Turla|OilRig T1207,Rogue Domain Controller,Defense Evasion,no -T1199,Trusted Relationship,Initial Access,APT28|menuPass -T1218,Signed Binary Proxy Execution,Defense Evasion,no -T1204,User Execution,Execution,no +T1203,Exploitation for Client Execution,Execution,Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Lazarus Group|Cobalt Group|APT37|Patchwork|APT29|TA459|Leviathan|Elderwood T1216,Signed Script Proxy Execution,Defense Evasion,no -T1195,Supply Chain Compromise,Initial Access,Elderwood +T1199,Trusted Relationship,Initial Access,Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass +T1218,Signed Binary Proxy Execution,Defense Evasion,no T1205,Traffic Signaling,Defense Evasion|Persistence|Command And Control,no T1176,Browser Extensions,Persistence,Kimsuky|Stolen Pencil T1175,Component Object Model and Distributed COM,Lateral Movement|Execution,no T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0 T1185,Man in the Browser,Collection,no -T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,Blue Mockingbird -T1136,Create Account,Persistence,no -T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|menuPass|Honeybee|Threat Group-3390|APT19|Gorgon Group|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER T1149,LC_MAIN Hijacking,Defense Evasion,no -T1135,Network Share Discovery,Discovery,APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug +T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,FIN6|Blue Mockingbird +T1136,Create Account,Persistence,no T1137,Office Application Startup,Persistence,Gamaredon Group|APT32 +T1140,Deobfuscate/Decode Files or Information,Defense Evasion,APT39|APT29|ZIRCONIUM|Higaisa|UNC2452|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Gorgon Group|menuPass|Honeybee|Threat Group-3390|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER +T1135,Network Share Discovery,Discovery,Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug T1153,Source,Execution,no -T1133,External Remote Services,Persistence|Initial Access,Sandworm Team|APT41|Soft Cell|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18 +T1133,External Remote Services,Persistence|Initial Access,APT29|UNC2452|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18 T1132,Data Encoding,Command And Control,no T1129,Shared Modules,Execution,no T1127,Trusted Developer Utilities Proxy Execution,Defense Evasion,no T1125,Video Capture,Collection,Silence|FIN7 -T1124,System Time Discovery,Discovery,The White Company|Lazarus Group|BRONZE BUTLER|Turla +T1124,System Time Discovery,Discovery,Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla T1123,Audio Capture,Collection,APT37 -T1120,Peripheral Device Discovery,Discovery,Turla|APT37|Gamaredon Group|Equation|APT28 -T1119,Automated Collection,Collection,Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 -T1115,Clipboard Data,Collection,APT39|APT38 -T1114,Email Collection,Collection,no -T1113,Screen Capture,Collection,Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 -T1112,Modify Registry,Defense Evasion,Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Honeybee|Patchwork|Gorgon Group|FIN8 -T1111,Two-Factor Authentication Interception,Credential Access,no -T1110,Brute Force,Credential Access,DarkVishnya|APT39|OilRig|FIN5|Turla +T1120,Peripheral Device Discovery,Discovery,Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28 +T1119,Automated Collection,Collection,Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 +T1115,Clipboard Data,Collection,Operation Wocao|APT39|APT38 +T1114,Email Collection,Collection,Silent Librarian +T1113,Screen Capture,Collection,GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|OilRig|Dragonfly 2.0|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 +T1112,Modify Registry,Defense Evasion,Operation Wocao|Kimsuky|Lazarus Group|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Patchwork|Gorgon Group|Honeybee|FIN8 +T1111,Two-Factor Authentication Interception,Credential Access,Chimera|Operation Wocao +T1110,Brute Force,Credential Access,APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla T1108,Redundant Access,Defense Evasion|Persistence,no -T1106,Native API,Execution,Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|Gorgon Group|APT37 -T1105,Ingress Tool Transfer,Command And Control,Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Turla|Gorgon Group|OilRig|Dragonfly 2.0|APT37|FIN8|PLATINUM|Leviathan|Elderwood|Magic Hound|APT3|APT32|BRONZE BUTLER|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 +T1106,Native API,Execution,Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group +T1105,Ingress Tool Transfer,Command And Control,HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|UNC2452|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Gorgon Group|Turla|OilRig|Dragonfly 2.0|APT37|Leviathan|FIN8|PLATINUM|Elderwood|APT3|Magic Hound|APT32|BRONZE BUTLER|FIN7|menuPass|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 T1104,Multi-Stage Channels,Command And Control,APT41|MuddyWater|APT3 -T1102,Web Service,Command And Control,Gamaredon Group|Rocke|Inception|FIN6 +T1102,Web Service,Command And Control,Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6 T1098,Account Manipulation,Persistence,APT3|Dragonfly 2.0|Lazarus Group -T1095,Non-Application Layer Protocol,Command And Control,APT29|PLATINUM|APT3 +T1095,Non-Application Layer Protocol,Command And Control,HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3 T1092,Communication Through Removable Media,Command And Control,APT28 -T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Tropic Trooper|Darkhotel|APT28 -T1090,Proxy,Command And Control,Sandworm Team|Blue Mockingbird|Wizard Spider|APT41|Turla -T1087,Account Discovery,Discovery,no -T1083,File and Directory Discovery,Discovery,Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|Magic Hound|Sowbug|BRONZE BUTLER|APT3|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang -T1082,System Information Discovery,Discovery,Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|Honeybee|APT19|APT37|APT32|Magic Hound|OilRig|APT3|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang -T1080,Taint Shared Content,Lateral Movement,BRONZE BUTLER|Darkhotel -T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Sandworm Team|Wizard Spider|Silence|APT41|Soft Cell|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|Leviathan|APT33|OilRig|FIN5|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak +T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Mustang Panda|Tropic Trooper|Darkhotel|APT28 +T1090,Proxy,Command And Control,Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla +T1087,Account Discovery,Discovery,APT29|UNC2452 +T1083,File and Directory Discovery,Discovery,APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|UNC2452|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Dragonfly 2.0|Leafminer|Honeybee|Dark Caracal|Magic Hound|APT3|BRONZE BUTLER|Sowbug|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang +T1082,System Information Discovery,Discovery,APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|UNC2452|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT37|APT19|Honeybee|APT32|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang +T1080,Taint Shared Content,Lateral Movement,Gamaredon Group|BRONZE BUTLER|Darkhotel +T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT29|Silent Librarian|UNC2452|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|Leviathan|OilRig|FIN5|menuPass|FIN10|APT28|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak T1074,Data Staged,Collection,Wizard Spider T1072,Software Deployment Tools,Execution|Lateral Movement,Silence|APT32|Threat Group-1314 T1071,Application Layer Protocol,Command And Control,Rocke|Magic Hound|Dragonfly 2.0 -T1070,Indicator Removal on Host,Defense Evasion,no -T1069,Permission Groups Discovery,Discovery,TA505|APT3 -T1068,Exploitation for Privilege Escalation,Privilege Escalation,Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 +T1070,Indicator Removal on Host,Defense Evasion,APT29|UNC2452 +T1069,Permission Groups Discovery,Discovery,APT29|UNC2452|TA505|APT3 +T1068,Exploitation for Privilege Escalation,Privilege Escalation,ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 T1064,Scripting,Defense Evasion|Execution,no T1062,Hypervisor,Persistence,no T1061,Graphical User Interface,Execution,no -T1059,Command and Scripting Interpreter,Execution,APT32|Molerats|Whitefly|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang -T1057,Process Discovery,Discovery,Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang -T1056,Input Capture,Collection|Credential Access,no -T1055,Process Injection,Defense Evasion|Privilege Escalation,APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM +T1059,Command and Scripting Interpreter,Execution,Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang +T1057,Process Discovery,Discovery,APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|UNC2452|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang +T1056,Input Capture,Collection|Credential Access,APT39 +T1055,Process Injection,Defense Evasion|Privilege Escalation,Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM T1053,Scheduled Task/Job,Execution|Persistence|Privilege Escalation,no T1052,Exfiltration Over Physical Medium,Exfiltration,no T1051,Shared Webroot,Lateral Movement,no -T1049,System Network Connections Discovery,Discovery,Tropic Trooper|APT41|APT38|Soft Cell|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang +T1049,System Network Connections Discovery,Discovery,Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|APT3|OilRig|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang T1048,Exfiltration Over Alternative Protocol,Exfiltration,no -T1047,Windows Management Instrumentation,Execution,Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|Soft Cell|APT32|MuddyWater|OilRig|Threat Group-3390|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda -T1046,Network Service Scanning,Discovery,Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Leafminer|OilRig|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390 -T1043,Commonly Used Port,Command And Control,Machete|OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|Dragonfly 2.0|FIN7|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390 -T1041,Exfiltration Over C2 Channel,Exfiltration,Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|Soft Cell|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang -T1040,Network Sniffing,Credential Access|Discovery,Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28 -T1039,Data from Network Shared Drive,Collection,Sowbug|BRONZE BUTLER|menuPass +T1047,Windows Management Instrumentation,Execution,Mustang Panda|Windshift|UNC2452|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|OilRig|Threat Group-3390|Leviathan|FIN8|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda +T1046,Network Service Scanning,Discovery,Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Leafminer|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390 +T1043,Commonly Used Port,Command And Control,OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|FIN7|Dragonfly 2.0|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390 +T1041,Exfiltration Over C2 Channel,Exfiltration,ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang +T1040,Network Sniffing,Credential Access|Discovery,Kimsuky|Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28 +T1039,Data from Network Shared Drive,Collection,Chimera|Fox Kitten|Gamaredon Group|Sowbug|BRONZE BUTLER|menuPass T1037,Boot or Logon Initialization Scripts,Persistence|Privilege Escalation,Rocke -T1036,Masquerading,Defense Evasion,Windshift|APT32|BRONZE BUTLER|menuPass|Dragonfly 2.0 +T1036,Masquerading,Defense Evasion,APT29|Mustang Panda|ZIRCONIUM|TA551|UNC2452|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0 T1034,Path Interception,Persistence|Privilege Escalation,no -T1033,System Owner/User Discovery,Discovery,Frankenstein|APT41|Soft Cell|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 +T1033,System Owner/User Discovery,Discovery,Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 T1030,Data Transfer Size Limits,Exfiltration,Threat Group-3390 -T1029,Scheduled Transfer,Exfiltration,no -T1027,Obfuscated Files or Information,Defense Evasion,Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Cobalt Group|Patchwork|Leafminer|APT37|Threat Group-3390|Honeybee|Dark Caracal|menuPass|APT19|BlackOasis|FIN8|Leviathan|Elderwood|MuddyWater|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 +T1029,Scheduled Transfer,Exfiltration,Higaisa +T1027,Obfuscated Files or Information,Defense Evasion,APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|APT37|Honeybee|menuPass|Leafminer|Cobalt Group|Threat Group-3390|Dark Caracal|APT19|FIN8|BlackOasis|MuddyWater|Elderwood|Leviathan|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 T1026,Multiband Communication,Command And Control,Lazarus Group -T1025,Data from Removable Media,Collection,Machete|Turla|Gamaredon Group|APT28 +T1025,Data from Removable Media,Collection,Turla|Gamaredon Group|APT28 T1021,Remote Services,Lateral Movement,no -T1020,Automated Exfiltration,Exfiltration,Tropic Trooper|Frankenstein|Honeybee -T1018,Remote System Discovery,Discovery,Sandworm Team|Rocke|Wizard Spider|Silence|Soft Cell|APT39|APT32|Deep Panda|Threat Group-3390|Dragonfly 2.0|Leafminer|Ke3chang|FIN8|APT3|FIN5|BRONZE BUTLER|menuPass|FIN6|Turla -T1016,System Network Configuration Discovery,Discovery,Sandworm Team|Tropic Trooper|Frankenstein|APT41|Soft Cell|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang +T1020,Automated Exfiltration,Exfiltration,Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee +T1018,Remote System Discovery,Discovery,APT29|UNC2452|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Dragonfly 2.0|Deep Panda|Threat Group-3390|Leafminer|Ke3chang|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla +T1016,System Network Configuration Discovery,Discovery,ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|OilRig|Magic Hound|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang T1014,Rootkit,Defense Evasion,Rocke|APT41|APT28|Winnti Group -T1012,Query Registry,Discovery,APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla +T1012,Query Registry,Discovery,ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla T1011,Exfiltration Over Other Network Medium,Exfiltration,no T1010,Application Window Discovery,Discovery,Lazarus Group -T1008,Fallback Channels,Command And Control,APT41|OilRig|Lazarus Group -T1007,System Service Discovery,Discovery,BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang +T1008,Fallback Channels,Command And Control,Carbanak|APT41|OilRig|Lazarus Group +T1007,System Service Discovery,Discovery,Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang T1006,Direct Volume Access,Defense Evasion,no -T1005,Data from Local System,Collection,Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang +T1005,Data from Local System,Collection,APT29|Windigo|UNC2452|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dragonfly 2.0|Dark Caracal|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang T1003,OS Credential Dumping,Credential Access,APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom -T1001,Data Obfuscation,Command And Control,Axiom +T1001,Data Obfuscation,Command And Control,Operation Wocao|Axiom From 400d591059a43ff203f8bfacb8623a11da9a16ea Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 21 Jun 2021 14:06:25 -0500 Subject: [PATCH 09/13] minor --- bin/generate.py | 1 + 1 file changed, 1 insertion(+) diff --git a/bin/generate.py b/bin/generate.py index 62898056f7..a582734128 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -345,6 +345,7 @@ def add_rba(detection): detection['risk_object_type'] = 'user' elif entity['type'].lower() in risk_object_system_types: risk_object['risk_object_type'] = 'system' + detection['risk_object_type'] = 'system' else: # if is not a system or user, it is a threat object risk_object['threat_object_field'] = entity['name'] From 6efe49882fd87091ece52aa3c594fa39ea5323b9 Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 22 Jun 2021 14:21:25 -0400 Subject: [PATCH 10/13] added attacker logic --- bin/generate.py | 32 +++++++++++++++++++++++--------- 1 file changed, 23 insertions(+), 9 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index a582734128..ebef03b7c4 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -319,11 +319,11 @@ def add_annotations(detection): def add_rba(detection): - # remove after refactor if RBA POC is automated_detection_testing - if 'risk_object' in detection['tags']: - detection['risk_object'] = detection['tags']['risk_object'] - if 'risk_object_type' in detection['tags']: - detection['risk_object_type'] = detection['tags']['risk_object_type'] + # removed since this is causing a duplicate bug in ES 6.4+ + # if 'risk_object' in detection['tags']: + # detection['risk_object'] = detection['tags']['risk_object'] + # if 'risk_object_type' in detection['tags']: + # detection['risk_object_type'] = detection['tags']['risk_object_type'] if 'risk_score' in detection['tags']: detection['risk_score'] = detection['tags']['risk_score'] @@ -339,25 +339,39 @@ def add_rba(detection): for entity in detection['tags']['observable']: risk_object = dict() - # determine if is a system, or user + # determine if is a user type if entity['type'].lower() in risk_object_user_types: risk_object['risk_object_type'] = 'user' detection['risk_object_type'] = 'user' + for r in entity['role']: + if 'attacker' == r.lower(): + # if the role is an attacker this entity is also a threat object + risk_object['threat_object_field'] = entity['name'] + risk_object['threat_object_type'] = entity['type'].lower() + risk_objects.append(risk_object) + + # determine if is a system type elif entity['type'].lower() in risk_object_system_types: risk_object['risk_object_type'] = 'system' detection['risk_object_type'] = 'system' + for r in entity['role']: + if 'attacker' == r.lower(): + # if the role is an attacker this entity is also a threat object + risk_object['threat_object_field'] = entity['name'] + risk_object['threat_object_type'] = entity['type'].lower() + risk_objects.append(risk_object) + + # if is not a system or user, it is a threat object else: - # if is not a system or user, it is a threat object risk_object['threat_object_field'] = entity['name'] risk_object['threat_object_type'] = entity['type'].lower() risk_objects.append(risk_object) continue - detection['risk_object'] = entity['name'] + detection['risk_object'] = entity['name'] risk_object['risk_object_field'] = entity['name'] risk_object['risk_score'] = detection['risk_score'] risk_objects.append(risk_object) - detection['risk'] = risk_objects return detection From e7b854b7e63026c7779b7e18c1929e7a0520f5af Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 29 Jun 2021 13:15:56 -0500 Subject: [PATCH 11/13] validate risk score --- bin/validate.py | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/bin/validate.py b/bin/validate.py index 19aa011677..404859e497 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -160,23 +160,23 @@ def validate_standard_fields(object, uuids): if 'product' not in object['tags']: errors.append("ERROR: a `product` tag is required for object: %s" % object['name']) - # check risk score values for k,v in object['tags'].items(): + if k == 'impact': + if not isinstance(v, int): + errors.append("ERROR: impact not integer value for object: %s" % v) + + if k == 'confidence': + if not isinstance(v, int): + errors.append("ERROR: confidence not integer value for object: %s" % v) if k == 'risk_score': if not isinstance(v, int): errors.append("ERROR: risk_score not integer value for object: %s" % v) - risk_object_type = ["user","system", "other"] - if k == 'risk_object_type': - if v not in risk_object_type: - errors.append("ERROR: risk_object_type can only contain user, system, other: %s" % v) - - if k == 'risk_object': - try: - v.encode('ascii') - except UnicodeEncodeError: - errors.append("ERROR: risk_object not ascii for object: %s" % v) + if 'impact' in object['tags'] and 'confidence' in object['tags']: + calculated_risk_score = int(((object['tags']['impact'])*(object['tags']['confidence']))/100) + if calculated_risk_score != object['tags']['risk_score']: + errors.append("ERROR: risk_score not calulated correctly and it should be set as: %s" % calculated_risk_score) return errors, uuids From 743ca45fbd7fd391a6f7b1a2e54f46dc8edfa1f4 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 30 Jun 2021 08:56:38 -0600 Subject: [PATCH 12/13] Update access_lsass_memory_for_dump_creation.yml --- .../endpoint/access_lsass_memory_for_dump_creation.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index 91e7d7962c..533c0df992 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -57,14 +57,13 @@ tags: context: - Source:Endpoint - Stage:Credential Access - message: process $SourceImage$ with id $TargetProcessId$ was detected trying to dump the memory of LSASS on $dest$. Actor tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). + message: process $SourceImage$ injected into $TargetImage$ and was attempted dump LSASS on $dest$. Adversaries tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). observable: - name: dest type: Endpoint role: - Victim - - name: TargetProcessId + - name: TargetImage type: Process role: - - Child Process - Target From 9d063ed669efcfaecd0d7bdce1e7096667a33b29 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 30 Jun 2021 12:22:48 -0500 Subject: [PATCH 13/13] conflicts --- dist/escu/default/analytic_stories.conf | 10 +- dist/escu/default/collections.conf | 2 +- dist/escu/default/macros.conf | 50 +- dist/escu/default/savedsearches.conf | 752 +++++++++++++++++++----- dist/escu/default/transforms.conf | 2 +- dist/escu/default/use_case_library.conf | 126 +++- 6 files changed, 798 insertions(+), 144 deletions(-) diff --git a/dist/escu/default/analytic_stories.conf b/dist/escu/default/analytic_stories.conf index 0bc5d0d77d..881105df28 100644 --- a/dist/escu/default/analytic_stories.conf +++ b/dist/escu/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-20T02:10:33 UTC +# On Date: 2021-06-30T17:22:24 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -882,8 +882,8 @@ modification_date = 2017-08-23 id = 2c8ff66e-0b57-42af-8ad7-912438a403fc version = 4 reference = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] -detection_searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule"] -mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation", "Installation"], "mitre_attack": ["T1027", "T1059.001"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} +detection_searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - WMI Recon Running Process Or Services - Rule"] +mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation", "Installation", "Reconnaissance"], "mitre_attack": ["T1027", "T1027.005", "T1059.001", "T1140", "T1592"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] data_models = ["Endpoint"] @@ -1133,8 +1133,8 @@ modification_date = 2020-02-04 id = cf309d0d-d4aa-4fbb-963d-1e79febd3756 version = 1 reference = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] -detection_searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule"] -mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exfiltration", "Exploitation", "Privilege Escalation", "Reconnaissance"], "mitre_attack": ["T1020", "T1021.002", "T1036.003", "T1047", "T1048", "T1053.005", "T1069.001", "T1069.002", "T1070", "T1070.001", "T1071.001", "T1087.001", "T1087.002", "T1112", "T1204", "T1218.003", "T1482", "T1485", "T1490", "T1491", "T1547.001"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} +detection_searches = ["ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule"] +mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exfiltration", "Exploitation", "Privilege Escalation", "Reconnaissance"], "mitre_attack": ["T1020", "T1021.002", "T1036.003", "T1047", "T1048", "T1053.005", "T1069.001", "T1069.002", "T1070", "T1070.001", "T1070.004", "T1071.001", "T1087.001", "T1087.002", "T1112", "T1204", "T1218.003", "T1222", "T1482", "T1485", "T1490", "T1491", "T1547.001", "T1548", "T1592"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK"] data_models = ["Endpoint", "Network_Traffic"] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index ff36a97cc4..b809bdf82c 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-20T02:10:33 UTC +# On Date: 2021-06-30T17:22:24 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 6d7cfd1010..062ccda784 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-20T02:10:33 UTC +# On Date: 2021-06-30T17:22:24 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -435,6 +435,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[allow_operation_with_consent_admin_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [amazon_eks_kubernetes_pod_scan_detection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -511,6 +515,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[clear_unallocated_sector_using_cipher_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [clients_connecting_to_multiple_dns_servers_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1023,6 +1031,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[disable_logs_using_wevtutil_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [disable_registry_tool_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1595,6 +1607,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[permission_modification_using_takeown_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [plain_http_post_exfiltrated_data_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1603,10 +1619,26 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[powershell_creating_thread_mutex_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_processing_stream_of_data_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [powershell_remote_thread_to_known_windows_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. +[powershell_using_memory_as_backing_store_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[prevent_automatic_repair_mode_using_bcdedit_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [process_creating_lnk_file_in_suspicious_location_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1655,6 +1687,14 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[recon_avproduct_through_pwh_or_wmi_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[recon_using__wmi_class_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [reg_exe_manipulating_windows_services_registry_keys_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1831,6 +1871,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[start_up_during_safe_mode_boot_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [sunburst_correlation_dll_and_network_event_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2031,6 +2075,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[wmi_recon_running_process_or_services_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [wmi_temporary_event_subscription_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 8007f4f32b..79c5db916e 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-20T02:10:33 UTC +# On Date: 2021-06-30T17:22:24 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -26,8 +26,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 25 action.risk.param._risk_message = action.risk.param._risk = [] @@ -200,8 +200,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -242,8 +242,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -284,8 +284,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = src_ip -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -326,8 +326,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 15 action.risk.param._risk_message = action.risk.param._risk = [] @@ -368,8 +368,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware Cloud"] action.risk = 1 -action.risk.param._risk_object = userIdentity.principalId -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -410,8 +410,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware Cloud"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 25 action.risk.param._risk_message = action.risk.param._risk = [] @@ -492,8 +492,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS User Monitoring"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -534,8 +534,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud User Activities"] action.risk = 1 -action.risk.param._risk_object = src_ip -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -576,8 +576,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -618,8 +618,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -660,8 +660,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -702,8 +702,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -744,8 +744,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Network ACL Activity"] action.risk = 1 -action.risk.param._risk_object = userName -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] @@ -786,8 +786,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Network ACL Activity"] action.risk = 1 -action.risk.param._risk_object = userName -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 5 action.risk.param._risk_message = action.risk.param._risk = [] @@ -828,8 +828,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = recipientAccountId -action.risk.param._risk_object_type = other +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 25 action.risk.param._risk_message = action.risk.param._risk = [] @@ -870,8 +870,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = sourceIPAddress -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -912,8 +912,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -954,8 +954,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS IAM Privilege Escalation"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -996,8 +996,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] action.risk = 1 -action.risk.param._risk_object = userName -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 40 action.risk.param._risk_message = action.risk.param._risk = [] @@ -1043,8 +1043,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] action.risk = 1 -action.risk.param._risk_object = src_usr -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] @@ -1176,7 +1176,7 @@ action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 15 action.risk.param._risk_message = user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}] +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "user", "threat_object_type": "user"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m @@ -1214,8 +1214,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] @@ -1256,8 +1256,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 40 action.risk.param._risk_message = action.risk.param._risk = [] @@ -1298,8 +1298,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud User Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 25 action.risk.param._risk_message = action.risk.param._risk = [] @@ -1341,17 +1341,17 @@ action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] action.risk = 1 action.risk.param._risk_object = dest -action.risk.param._risk_object_type = +action.risk.param._risk_object_type = system action.risk.param._risk_score = 63 -action.risk.param._risk_message = process $SourceImage$ with id $TargetProcessId$ was detected trying to dump the memory of LSASS on $dest$. Actor tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "TargetProcessId", "threat_object_type": "process"}] +action.risk.param._risk_message = process $SourceImage$ injected into $TargetImage$ and was attempted dump LSASS on $dest$. Adversaries tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "TargetImage", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Access LSASS Memory for Dump Creation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "TargetProcessId", "role": ["Child Process", "Target"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "TargetImage", "role": ["Target"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -1492,6 +1492,47 @@ realtime_schedule = 0 is_visible = false search = `powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message = "*Inbound*" Message = "*Allow*" Message = "*-LocalPort*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_inbound_traffic_in_firewall_rule_filter` +[ESCU - Allow Operation with Consent Admin - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = this search is to detect a potential privilege escalation attempt to do malicious task. This registry modification is designed to allows the Consent Admin to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"]} +action.escu.data_models = [] +action.escu.eli5 = this search is to detect a potential privilege escalation attempt to do malicious task. This registry modification is designed to allows the Consent Admin to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-06-10 +action.escu.modification_date = 2021-06-10 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Allow Operation with Consent Admin - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Allow Operation with Consent Admin - Rule +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = this search is to detect a potential privilege escalation attempt to do malicious task. This registry modification is designed to allows the Consent Admin to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. +action.notable.param.rule_title = Allow Operation with Consent Admin +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_key_name = ConsentPromptBehaviorAdmin Registry.registry_value_name = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `allow_operation_with_consent_admin_filter` + [ESCU - Amazon EKS Kubernetes Pod scan detection - Rule] action.escu = 0 action.escu.enabled = 1 @@ -2268,6 +2309,47 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe AND Processes.process_name!=regsvr32.exe by Processes.dest Processes.parent_process Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `child_processes_of_spoolsv_exe_filter` +[ESCU - Clear Unallocated Sector Using Cipher App - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = this search is to detect execution of cipher.exe to clear the unallocated sectors of a specific disk. This technique was seen in some ransomwareto make it impossible to forensically recover deleted files. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = this search is to detect execution of cipher.exe to clear the unallocated sectors of a specific disk. This technique was seen in some ransomwareto make it impossible to forensically recover deleted files. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = administrator may execute this app to manage disk +action.escu.creation_date = 2021-06-10 +action.escu.modification_date = 2021-06-10 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Clear Unallocated Sector Using Cipher App - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Clear Unallocated Sector Using Cipher App - Rule +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = this search is to detect execution of cipher.exe to clear the unallocated sectors of a specific disk. This technique was seen in some ransomwareto make it impossible to forensically recover deleted files. +action.notable.param.rule_title = Clear Unallocated Sector Using Cipher App +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cipher.exe" Processes.process = "*/w:*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clear_unallocated_sector_using_cipher_app_filter` + [ESCU - Clients Connecting to Multiple DNS Servers - Rule] action.escu = 0 action.escu.enabled = 1 @@ -2410,8 +2492,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud User Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 25 action.risk.param._risk_message = action.risk.param._risk = [] @@ -2452,8 +2534,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -2494,8 +2576,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -2536,8 +2618,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -2578,8 +2660,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -2620,8 +2702,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] @@ -2704,8 +2786,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] @@ -2747,8 +2829,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 5 action.risk.param._risk_message = action.risk.param._risk = [] @@ -2790,8 +2872,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 5 action.risk.param._risk_message = action.risk.param._risk = [] @@ -2833,8 +2915,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 5 action.risk.param._risk_message = action.risk.param._risk = [] @@ -3854,8 +3936,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS User Monitoring"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] @@ -3949,8 +4031,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS User Monitoring"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 15 action.risk.param._risk_message = action.risk.param._risk = [] @@ -3997,8 +4079,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 30 action.risk.param._risk_message = action.risk.param._risk = [] @@ -4039,8 +4121,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 5 action.risk.param._risk_message = action.risk.param._risk = [] @@ -4081,8 +4163,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 5 action.risk.param._risk_message = action.risk.param._risk = [] @@ -4123,8 +4205,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 5 action.risk.param._risk_message = action.risk.param._risk = [] @@ -5272,8 +5354,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS S3 Activities"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -5314,8 +5396,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS S3 Activities"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -6341,8 +6423,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS S3 Activities"] action.risk = 1 -action.risk.param._risk_object = src_ip -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] @@ -6598,8 +6680,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS User Monitoring"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] @@ -6646,8 +6728,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Security Hub Alerts"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -6729,8 +6811,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Network ACL Activity"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -6777,8 +6859,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS S3 Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] @@ -6825,8 +6907,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS User Monitoring"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 5 action.risk.param._risk_message = action.risk.param._risk = [] @@ -6873,8 +6955,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Network ACL Activity", "Suspicious AWS Traffic", "Command and Control"] action.risk = 1 -action.risk.param._risk_object = src_ip -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -7412,8 +7494,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS User Monitoring"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 5 action.risk.param._risk_message = action.risk.param._risk = [] @@ -7649,6 +7731,47 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="* /stext *" OR Processes.process="* /scomma *" ) by Processes.parent_process Processes.process_name Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `detection_of_tools_built_by_nirsoft_filter` +[ESCU - Disable Logs Using WevtUtil - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.001"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = network operator may disable audit event logs for debugging purposes. +action.escu.creation_date = 2021-06-10 +action.escu.modification_date = 2021-06-10 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Disable Logs Using WevtUtil - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Disable Logs Using WevtUtil - Rule +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.001"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections. +action.notable.param.rule_title = Disable Logs Using WevtUtil +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "wevtutil.exe" Processes.process = "*sl*" Processes.process = "*/e:false*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_logs_using_wevtutil_filter` + [ESCU - Disable Registry Tool - Rule] action.escu = 0 action.escu.enabled = 1 @@ -8410,8 +8533,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Unusual AWS EC2 Modifications"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 5 action.risk.param._risk_message = action.risk.param._risk = [] @@ -8458,8 +8581,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] action.risk = 1 -action.risk.param._risk_object = src -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] @@ -12532,8 +12655,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -12574,8 +12697,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = ActorIpAddress -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -12616,8 +12739,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -12658,8 +12781,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -12700,8 +12823,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -12742,8 +12865,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -12784,8 +12907,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = UserId -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -12826,8 +12949,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = Source -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -12868,8 +12991,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = src_user -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -12910,8 +13033,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -12952,8 +13075,8 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = ForwardingSmtpAddress -action.risk.param._risk_object_type = system +action.risk.param._risk_object = +action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] @@ -13584,6 +13707,47 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem where (Filesystem.file_path=*\\Windows\\System32\\sethc.exe* OR Filesystem.file_path=*\\Windows\\System32\\utilman.exe* OR Filesystem.file_path=*\\Windows\\System32\\osk.exe* OR Filesystem.file_path=*\\Windows\\System32\\Magnify.exe* OR Filesystem.file_path=*\\Windows\\System32\\Narrator.exe* OR Filesystem.file_path=*\\Windows\\System32\\DisplaySwitch.exe* OR Filesystem.file_path=*\\Windows\\System32\\AtBroker.exe*) by Filesystem.file_name Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `overwriting_accessibility_binaries_filter` +[ESCU - Permission Modification using Takeown App - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect a modification of file or directory permission using takeown.exe windows app. This technique was seen in some ransomware that take the ownership of a folder or files to encrypt or delete it. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This search is to detect a modification of file or directory permission using takeown.exe windows app. This technique was seen in some ransomware that take the ownership of a folder or files to encrypt or delete it. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = takeown.exe is a normal windows application that may used by network operator. +action.escu.creation_date = 2021-06-10 +action.escu.modification_date = 2021-06-10 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Permission Modification using Takeown App - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Permission Modification using Takeown App - Rule +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This search is to detect a modification of file or directory permission using takeown.exe windows app. This technique was seen in some ransomware that take the ownership of a folder or files to encrypt or delete it. +action.notable.param.rule_title = Permission Modification using Takeown App +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "takeown.exe" Processes.process = "*/f*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `permission_modification_using_takeown_app_filter` + [ESCU - Plain HTTP POST Exfiltrated Data - Rule] action.escu = 0 action.escu.enabled = 1 @@ -13665,6 +13829,86 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe Processes.process=*start-bitstransfer* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_start_bitstransfer_filter` +[ESCU - Powershell Creating Thread Mutex - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect suspicious powershell script that using mutex function. This function is commonly seen in some obfuscated powershell script to make sure that only one instance of there process is running to a compromise machine which is also a good indicator to check why powershell script is using it. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.005"]} +action.escu.data_models = [] +action.escu.eli5 = This search is to detect suspicious powershell script that using mutex function. This function is commonly seen in some obfuscated powershell script to make sure that only one instance of there process is running to a compromise machine which is also a good indicator to check why powershell script is using it. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +action.escu.known_false_positives = powershell developer may used this function in their script for instance checking too. +action.escu.creation_date = 2021-06-10 +action.escu.modification_date = 2021-06-10 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Powershell Creating Thread Mutex - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Malicious PowerShell"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Powershell Creating Thread Mutex - Rule +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.005"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search is to detect suspicious powershell script that using mutex function. This function is commonly seen in some obfuscated powershell script to make sure that only one instance of there process is running to a compromise machine which is also a good indicator to check why powershell script is using it. +action.notable.param.rule_title = Powershell Creating Thread Mutex +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 Message = "*Threading.Mutex*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter` + +[ESCU - Powershell Processing Stream Of Data - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = this search is to detect suspicious powershell that processing compressed stream data. This technique was seen in obfuscated powershell or powershell with embedded .net or binary files that are stream flated and will be deflated during execution. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} +action.escu.data_models = [] +action.escu.eli5 = this search is to detect suspicious powershell that processing compressed stream data. This technique was seen in obfuscated powershell or powershell with embedded .net or binary files that are stream flated and will be deflated during execution. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +action.escu.known_false_positives = powershell may used this function to process compressed data. +action.escu.creation_date = 2021-06-10 +action.escu.modification_date = 2021-06-10 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Powershell Processing Stream Of Data - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Malicious PowerShell"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Powershell Processing Stream Of Data - Rule +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = this search is to detect suspicious powershell that processing compressed stream data. This technique was seen in obfuscated powershell or powershell with embedded .net or binary files that are stream flated and will be deflated during execution. +action.notable.param.rule_title = Powershell Processing Stream Of Data +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*" OR Message = "*]::Decompress*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter` + [ESCU - Powershell Remote Thread To Known Windows Process - Rule] action.escu = 0 action.escu.enabled = 1 @@ -13705,6 +13949,87 @@ realtime_schedule = 0 is_visible = false search = `sysmon` EventCode = 8 process_name IN ("powershell_ise.exe", "powershell.exe") TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe") | stats min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remote_thread_to_known_windows_process_filter` +[ESCU - Powershell Using memory As Backing Store - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = this search is to detect suspicious powershell script that using memory stream as new object backstore. This technique is commonly seen in malicious powershell contain a stream flate data and will be decompressed in memory to run or drop the actual payload to the compromise machine. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"]} +action.escu.data_models = [] +action.escu.eli5 = this search is to detect suspicious powershell script that using memory stream as new object backstore. This technique is commonly seen in malicious powershell contain a stream flate data and will be decompressed in memory to run or drop the actual payload to the compromise machine. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +action.escu.known_false_positives = powershell may used this function to store out object into memory. +action.escu.creation_date = 2021-06-10 +action.escu.modification_date = 2021-06-10 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Powershell Using memory As Backing Store - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Malicious PowerShell"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Powershell Using memory As Backing Store - Rule +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = this search is to detect suspicious powershell script that using memory stream as new object backstore. This technique is commonly seen in malicious powershell contain a stream flate data and will be decompressed in memory to run or drop the actual payload to the compromise machine. +action.notable.param.rule_title = Powershell Using memory As Backing Store +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 Message = "*New-Object IO.MemoryStream*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_using_memory_as_backing_store_filter` + +[ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect a suspicious bcdedit.exe execution to ignore all failures. This technique was used by ransomware to prevent the compromise machine automatically boot in repair mode. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This search is to detect a suspicious bcdedit.exe execution to ignore all failures. This technique was used by ransomware to prevent the compromise machine automatically boot in repair mode. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed bcdedit.exe may be used. +action.escu.known_false_positives = Administrators may modify the boot configuration ignore failure during testing and debugging. +action.escu.creation_date = 2021-06-10 +action.escu.modification_date = 2021-06-10 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This search is to detect a suspicious bcdedit.exe execution to ignore all failures. This technique was used by ransomware to prevent the compromise machine automatically boot in repair mode. +action.notable.param.rule_title = Prevent Automatic Repair Mode using Bcdedit +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "bcdedit.exe" Processes.process = "*bootstatuspolicy*" Processes.process = "*ignoreallfailures*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `prevent_automatic_repair_mode_using_bcdedit_filter` + [ESCU - Process Creating LNK file in Suspicious Location - Rule] action.escu = 0 action.escu.enabled = 1 @@ -14193,6 +14518,86 @@ realtime_schedule = 0 is_visible = false search = `sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer Image file_name | where unique_readme_path_count >= 15 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ransomware_notes_bulk_creation_filter` +[ESCU - Recon AVProduct Through Pwh or WMI - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect a powershell script that do a recon or checking to the av product install on the machine. This technique is commonly seen in APT or malware like ransomware to list all security product and disable it. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]} +action.escu.data_models = [] +action.escu.eli5 = This search is to detect a powershell script that do a recon or checking to the av product install on the machine. This technique is commonly seen in APT or malware like ransomware to list all security product and disable it. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +action.escu.known_false_positives = network administrator may used this command for checking purposes +action.escu.creation_date = 2021-06-10 +action.escu.modification_date = 2021-06-10 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Recon AVProduct Through Pwh or WMI - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Ransomware", "Malicious PowerShell"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Recon AVProduct Through Pwh or WMI - Rule +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Malicious PowerShell"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search is to detect a powershell script that do a recon or checking to the av product install on the machine. This technique is commonly seen in APT or malware like ransomware to list all security product and disable it. +action.notable.param.rule_title = Recon AVProduct Through Pwh or WMI +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 Message = "*SELECT*" AND (Message = "*AntiVirusProduct*" OR Message = "*AntiSpywareProduct*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recon_avproduct_through_pwh_or_wmi_filter` + +[ESCU - Recon Using WMI Class - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect a powershell script that do a recon to the targetted or compromised machine. This technique is common nowadays to know the running process, services +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]} +action.escu.data_models = [] +action.escu.eli5 = This search is to detect a powershell script that do a recon to the targetted or compromised machine. This technique is common nowadays to know the running process, services +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +action.escu.known_false_positives = network administrator may used this command for checking purposes +action.escu.creation_date = 2021-06-10 +action.escu.modification_date = 2021-06-10 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Recon Using WMI Class - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Malicious PowerShell"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Recon Using WMI Class - Rule +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search is to detect a powershell script that do a recon to the targetted or compromised machine. This technique is common nowadays to know the running process, services +action.notable.param.rule_title = Recon Using WMI Class +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 (Message= "*SELECT*" OR Message= "*Get-WmiObject*") AND (Message= "*Win32_Bios*" OR Message= "*Win32_OperatingSystem*" OR Message= "*Win32_Processor*" OR Message= "*Win32_ComputerSystem*" OR Message= "*Win32_ComputerSystemProduct*" OR Message= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recon_using__wmi_class_filter` + [ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule] action.escu = 0 action.escu.enabled = 1 @@ -15996,6 +16401,47 @@ realtime_schedule = 0 is_visible = false search = index=_internal sourcetype=splunkd_ui_access server-info | search clientip!=127.0.0.1 uri_path="*raw/services/server/info/server-info" | rename clientip as src_ip, splunk_server as dest | stats earliest(_time) as firstTime, latest(_time) as lastTime, values(uri) as uri, values(useragent) as http_user_agent, values(user) as user by src_ip, dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_enterprise_information_disclosure_filter` +[ESCU - Start Up During Safe Mode Boot - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001"]} +action.escu.data_models = [] +action.escu.eli5 = This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +action.escu.known_false_positives = updated windows application needed in safe boot may used this registry +action.escu.creation_date = 2021-06-10 +action.escu.modification_date = 2021-06-10 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Start Up During Safe Mode Boot - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Start Up During Safe Mode Boot - Rule +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot. +action.notable.param.rule_title = Start Up During Safe Mode Boot +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SafeBoot\\Minimal\*" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `start_up_during_safe_mode_boot_filter` + [ESCU - Sunburst Correlation DLL and Network Event - Rule] action.escu = 0 action.escu.enabled = 1 @@ -17204,7 +17650,7 @@ action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious MSHTA Activity"] action.risk = 1 action.risk.param._risk_object = dest -action.risk.param._risk_object_type = user +action.risk.param._risk_object_type = system action.risk.param._risk_score = 40 action.risk.param._risk_message = suspicious mshta child process detected on host $dest$ by user $user$. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 40}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}, {"threat_object_field": "parent_process", "threat_object_type": "process name"}] @@ -18095,6 +18541,46 @@ realtime_schedule = 0 is_visible = false search = `sysmon` EventCode=21 | rename host as dest | table _time, dest, user, Operation, EventType, Query, Consumer, Filter | `wmi_permanent_event_subscription___sysmon_filter` +[ESCU - WMI Recon Running Process Or Services - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This seearch is to detect a suspicious powershell/wmi query to recon running process and running services. This technique is commonly seen in malware and apt attack to mapped all running security application or services on the compromised machine. +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]} +action.escu.data_models = [] +action.escu.eli5 = This seearch is to detect a suspicious powershell/wmi query to recon running process and running services. This technique is commonly seen in malware and apt attack to mapped all running security application or services on the compromised machine. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +action.escu.known_false_positives = network administrator may used this command for checking purposes +action.escu.creation_date = 2021-06-14 +action.escu.modification_date = 2021-06-14 +action.escu.confidence = high +action.escu.full_search_name = ESCU - WMI Recon Running Process Or Services - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Malicious PowerShell"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - WMI Recon Running Process Or Services - Rule +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This seearch is to detect a suspicious powershell/wmi query to recon running process and running services. This technique is commonly seen in malware and apt attack to mapped all running security application or services on the compromised machine. +action.notable.param.rule_title = WMI Recon Running Process Or Services +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 Message= "*SELECT*" AND (Message="*Win32_Process*" OR Message="*Win32_Service*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmi_recon_running_process_or_services_filter` + [ESCU - WMI Temporary Event Subscription - Rule] action.escu = 0 action.escu.enabled = 1 diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index ddd907ed3d..9069e80151 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-20T02:10:33 UTC +# On Date: 2021-06-30T17:22:24 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/use_case_library.conf b/dist/escu/default/use_case_library.conf index 41808a2f51..6aa3aa5a49 100644 --- a/dist/escu/default/use_case_library.conf +++ b/dist/escu/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-06-20T02:10:33 UTC +# On Date: 2021-06-30T17:22:24 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -606,7 +606,7 @@ version = 4 references = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - WMI Recon Running Process Or Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent. narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope.\ The following factors may assist you in determining whether the event is malicious: \ @@ -785,7 +785,7 @@ version = 1 references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] +searches = ["ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. @@ -1726,6 +1726,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.00 known_false_positives = administrator may allow inbound traffic in certain network or machine. providing_technologies = [] +[savedsearch://ESCU - Allow Operation with Consent Admin - Rule] +type = detection +asset_type = +confidence = medium +explanation = this search is to detect a potential privilege escalation attempt to do malicious task. This registry modification is designed to allows the Consent Admin to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Amazon EKS Kubernetes Pod scan detection - Rule] type = detection asset_type = Amazon EKS Kubernetes cluster Pod @@ -1916,6 +1926,16 @@ annotations = {"cis20": ["CIS 5", "CIS 8"], "kill_chain_phases": ["Exploitation" known_false_positives = Some legitimate printer-related processes may show up as children of spoolsv.exe. You should confirm that any activity as legitimate and may be added as exclusions in the search. providing_technologies = [] +[savedsearch://ESCU - Clear Unallocated Sector Using Cipher App - Rule] +type = detection +asset_type = +confidence = medium +explanation = this search is to detect execution of cipher.exe to clear the unallocated sectors of a specific disk. This technique was seen in some ransomwareto make it impossible to forensically recover deleted files. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"]} +known_false_positives = administrator may execute this app to manage disk +providing_technologies = [] + [savedsearch://ESCU - Clients Connecting to Multiple DNS Servers - Rule] type = detection asset_type = Endpoint @@ -3257,6 +3277,16 @@ annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Installation", "Action known_false_positives = While legitimate, these NirSoft tools are prone to abuse. You should verfiy that the tool was used for a legitimate purpose. providing_technologies = [] +[savedsearch://ESCU - Disable Logs Using WevtUtil - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.001"]} +known_false_positives = network operator may disable audit event logs for debugging purposes. +providing_technologies = [] + [savedsearch://ESCU - Disable Registry Tool - Rule] type = detection asset_type = @@ -4721,6 +4751,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives" known_false_positives = Microsoft may provide updates to these binaries. Verify that these changes do not correspond with your normal software update cycle. providing_technologies = [] +[savedsearch://ESCU - Permission Modification using Takeown App - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect a modification of file or directory permission using takeown.exe windows app. This technique was seen in some ransomware that take the ownership of a folder or files to encrypt or delete it. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]} +known_false_positives = takeown.exe is a normal windows application that may used by network operator. +providing_technologies = [] + [savedsearch://ESCU - Plain HTTP POST Exfiltrated Data - Rule] type = detection asset_type = @@ -4741,6 +4781,26 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197"]} known_false_positives = Limited false positives. It is possible administrators will utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent process or command-line arguments. providing_technologies = [] +[savedsearch://ESCU - Powershell Creating Thread Mutex - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect suspicious powershell script that using mutex function. This function is commonly seen in some obfuscated powershell script to make sure that only one instance of there process is running to a compromise machine which is also a good indicator to check why powershell script is using it. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.005"]} +known_false_positives = powershell developer may used this function in their script for instance checking too. +providing_technologies = [] + +[savedsearch://ESCU - Powershell Processing Stream Of Data - Rule] +type = detection +asset_type = +confidence = medium +explanation = this search is to detect suspicious powershell that processing compressed stream data. This technique was seen in obfuscated powershell or powershell with embedded .net or binary files that are stream flated and will be deflated during execution. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} +known_false_positives = powershell may used this function to process compressed data. +providing_technologies = [] + [savedsearch://ESCU - Powershell Remote Thread To Known Windows Process - Rule] type = detection asset_type = @@ -4751,6 +4811,26 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} known_false_positives = unknown providing_technologies = [] +[savedsearch://ESCU - Powershell Using memory As Backing Store - Rule] +type = detection +asset_type = +confidence = medium +explanation = this search is to detect suspicious powershell script that using memory stream as new object backstore. This technique is commonly seen in malicious powershell contain a stream flate data and will be decompressed in memory to run or drop the actual payload to the compromise machine. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"]} +known_false_positives = powershell may used this function to store out object into memory. +providing_technologies = [] + +[savedsearch://ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect a suspicious bcdedit.exe execution to ignore all failures. This technique was used by ransomware to prevent the compromise machine automatically boot in repair mode. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed bcdedit.exe may be used. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} +known_false_positives = Administrators may modify the boot configuration ignore failure during testing and debugging. +providing_technologies = [] + [savedsearch://ESCU - Process Creating LNK file in Suspicious Location - Rule] type = detection asset_type = Endpoint @@ -4871,6 +4951,26 @@ annotations = {"kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1486"]} known_false_positives = unknown providing_technologies = [] +[savedsearch://ESCU - Recon AVProduct Through Pwh or WMI - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect a powershell script that do a recon or checking to the av product install on the machine. This technique is commonly seen in APT or malware like ransomware to list all security product and disable it. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]} +known_false_positives = network administrator may used this command for checking purposes +providing_technologies = [] + +[savedsearch://ESCU - Recon Using WMI Class - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect a powershell script that do a recon to the targetted or compromised machine. This technique is common nowadays to know the running process, services +how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]} +known_false_positives = network administrator may used this command for checking purposes +providing_technologies = [] + [savedsearch://ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule] type = detection asset_type = Endpoint @@ -5314,6 +5414,16 @@ annotations = {"cis20": ["CIS 3", "CIS 4", "CIS 18"], "kill_chain_phases": ["Del known_false_positives = Retrieving server information may be a legitimate API request. Verify that the attempt is a valid request for information. providing_technologies = [] +[savedsearch://ESCU - Start Up During Safe Mode Boot - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001"]} +known_false_positives = updated windows application needed in safe boot may used this registry +providing_technologies = [] + [savedsearch://ESCU - Sunburst Correlation DLL and Network Event - Rule] type = detection asset_type = Windows @@ -5832,6 +5942,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Ob known_false_positives = Although unlikely, administrators may use event subscriptions for legitimate purposes. providing_technologies = [] +[savedsearch://ESCU - WMI Recon Running Process Or Services - Rule] +type = detection +asset_type = +confidence = medium +explanation = This seearch is to detect a suspicious powershell/wmi query to recon running process and running services. This technique is commonly seen in malware and apt attack to mapped all running security application or services on the compromised machine. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]} +known_false_positives = network administrator may used this command for checking purposes +providing_technologies = [] + [savedsearch://ESCU - WMI Temporary Event Subscription - Rule] type = detection asset_type = Endpoint