Branch was auto-updated.

detections/endpoint/check_elevated_cmd_using_whoami.yml

@@ -0,0 +1,69 @@
+name: Check Elevated CMD using whoami
+id: a9079b18-1633-11ec-859c-acde48001122
+version: 1
+date: '2021-09-15'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious whoami execution to check if the
+  cmd or shell instance process is with elevated privileges. This technique was seen
+  in FIN7 js implant where it execute this as part of its data collection to the infected
+  machine to check if the running shell cmd process is elevated or not. This TTP is
+  really a good alert for known attacker that recon on the targetted host. This command
+  is not so commonly executed by a normal user or even an admin to check if a process
+  is elevated.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where  Processes.process = "*whoami*"
+  Processes.process = "*/group*" Processes.process = "* find *" Processes.process
+  = "*12288*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `check_elevated_cmd_using_whoami_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: unknown
+eferences:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
+tags:
+  analytic_story:
+  - FIN7
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1033
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint
+  impact: 70
+  confidence: 80
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: Process name $process_name$ with commandline $process$ in $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml

@@ -0,0 +1,71 @@
+name: Cmdline Tool Not Executed In CMD Shell
+id: 6c3f7dd8-153c-11ec-ac2d-acde48001122
+version: 1
+date: '2021-09-14'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious parent process execution of commandline
+  tool not in shell commandline. This technique was seen in FIN7 JSSLoader .net compile
+  payload where it run ipconfig.exe and systeminfo.exe using .net application. This
+  event cause some good TTP since those tool are commonly run in commandline not by
+  another application. This TTP is a good indicator for application gather host information
+  either an attacker or an automated tool made by admin.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where  (Processes.process_name = "ipconfig.exe"
+  OR Processes.process_name = "systeminfo.exe") AND NOT (Processes.parent_process_name
+  = "cmd.exe" OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name
+  = "explorer.exe") by Processes.parent_process_name Processes.parent_process Processes.process_name
+  Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmdline_tool_not_executed_in_cmd_shell_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: network operator or admin may create this type of tool to gather
+  host information
+references:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
+tags:
+  analytic_story:
+  - FIN7
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.007
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint
+  impact: 70
+  confidence: 80
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: parent process name $parent_process_name$ with child process $process_name$
+    to execute commandline tool in $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/jscript_execution_using_cscript_app.yml

@@ -0,0 +1,69 @@
+name: Jscript Execution Using Cscript App
+id: 002f1e24-146e-11ec-a470-acde48001122
+version: 1
+date: '2021-09-13'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a execution of jscript using cscript process.
+  Commonly when a user run jscript file it was executed by wscript.exe application.
+  This technique was seen in FIN7 js implant to execute its malicious script using
+  cscript process. This behavior is uncommon and a good artifacts to check further
+  anomalies within the network
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
+  = "cscript.exe" AND Processes.parent_process = "*//e:jscript*") OR (Processes.process_name
+  = "cscript.exe" AND Processes.process = "*//e:jscript*") by Processes.parent_process_name
+  Processes.parent_process Processes.process_name Processes.process_id Processes.process
+  Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `jscript_execution_using_cscript_app_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: unknown
+references:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
+tags:
+  analytic_story:
+  - FIN7
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.007
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: Process name $process_name$ with commandline $process$ to execute jscript
+    in $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/ms_scripting_process_loading_ldap_module.yml

@@ -0,0 +1,65 @@
+name: MS Scripting Process Loading Ldap Module
+id: 0b0c40dc-14a6-11ec-b267-acde48001122
+version: 1
+date: '2021-09-13'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious MS scripting process such as wscript.exe
+  or cscript.exe that loading ldap module to process ldap query. This behavior was
+  seen in FIN7 implant where it uses javascript to execute ldap query to parse host
+  information that will send to its C2 server. this anomaly detections is a good initial
+  step to hunt further a suspicious ldap query or ldap related events to the host
+  that may give you good information regarding ldap or AD information processing or
+  might be a attacker.
+search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded
+  IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") | stats min(_time) as firstTime
+  max(_time) as lastTime count by Image EventCode process_name ProcessId ProcessGuid
+  Computer ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `ms_scripting_process_loading_ldap_module_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: automation scripting language may used by network operator
+  to do ldap query.
+references:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
+tags:
+  analytic_story:
+  - FIN7
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.007
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - EventCode
+  - process_name
+  - ProcessId
+  - ProcessGuid
+  - Computer
+  - ImageLoaded
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: $process_name$ loading ldap modules $ImageLoaded$ in $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/ms_scripting_process_loading_wmi_module.yml

@@ -0,0 +1,66 @@
+name: MS Scripting Process Loading WMI Module
+id: 2eba3d36-14a6-11ec-a682-acde48001122
+version: 1
+date: '2021-09-13'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious MS scripting process such as wscript.exe
+  or cscript.exe that loading wmi module to process wmi query. This behavior was seen
+  in FIN7 implant where it uses javascript to execute wmi query to parse host information
+  that will send to its C2 server. this anomaly detections is a good initial step
+  to hunt further a suspicious wmi query or wmi related events to the host that may
+  give you good information regarding process that are commonly using wmi query or
+  modules or might be an attacker using this technique.
+search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded
+  IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" ,
+  "*\\wmiutils.dll", "*\\wbemcomn.dll") | stats min(_time) as firstTime max(_time)
+  as lastTime count by Image EventCode process_name ProcessId ProcessGuid Computer
+  ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `ms_scripting_process_loading_wmi_module_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: automation scripting language may used by network operator
+  to do ldap query.
+references:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
+tags:
+  analytic_story:
+  - FIN7
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.007
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - EventCode
+  - process_name
+  - ProcessId
+  - ProcessGuid
+  - Computer
+  - ImageLoaded
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: $process_name$ loading wmi modules $ImageLoaded$ in $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml

@@ -0,0 +1,71 @@
+name: Non Chrome Process Accessing Chrome Default Dir
+id: 81263de4-160a-11ec-944f-acde48001122
+version: 1
+date: '2021-09-15'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This search is to detect an anomaly event of non-chrome process accessing
+  the files in chrome user default folder. This folder contains all the sqlite database
+  of the chrome browser related to users login, history, cookies and etc. Most of
+  the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database
+  to collect information on the compromised host. This SACL Event (4663) need to be
+  enabled to tthe firefox profile directory to be eable to use this. Since you monitoring
+  this access to the folder a noise coming from firefox need to be filter and also
+  sqlite db browser and explorer .exe to make this detection more stable.
+search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\chrome.exe",
+  "*\\explorer.exe", "*sql*")) Object_Name="*\\Google\\Chrome\\User Data\\Default*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by Object_Name Object_Type
+  process_name Access_Mask Accesses process_id EventCode dest user | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `non_chrome_process_accessing_chrome_default_dir_filter`'
+how_to_implement: To successfully implement this search, you must ingest Windows Security
+  Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
+  Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+known_false_positives: other browser not listed related to firefox may catch by this
+  rule.
+eferences:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
+tags:
+  analytic_story:
+  - FIN7
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_sacl/security2.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1555.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Object_Name
+  - Object_Type
+  - process_name
+  - Access_Mask
+  - Accesses
+  - process_id
+  - EventCode
+  - dest
+  - user
+  security_domain: endpoint
+  impact: 50
+  confidence: 70
+  risk_score: 35
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  message: a non firefox browser process $process_name$ accessing $Object_Name$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml

@@ -0,0 +1,71 @@
+name: Non Firefox Process Access Firefox Profile Dir
+id: e6fc13b0-1609-11ec-b533-acde48001122
+version: 1
+date: '2021-09-15'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This search is to detect an anomaly event of non-firefox process accessing
+  the files in  profile folder. This folder contains all the sqlite database of the
+  firefox browser related to users login, history, cookies and etc. Most of the RAT,
+  trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect
+  information on the compromised host. This SACL Event (4663) need to be enabled to
+  tthe firefox profile directory to be eable to use this. Since you monitoring this
+  access to the folder a noise coming from firefox need to be filter and also sqlite
+  db browser and explorer .exe to make this detection more stable.
+search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\firefox.exe",
+  "*\\explorer.exe", "*sql*")) Object_Name="*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by Object_Name Object_Type
+  process_name Access_Mask Accesses process_id EventCode dest user | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `non_firefox_process_access_firefox_profile_dir_filter`'
+how_to_implement: To successfully implement this search, you must ingest Windows Security
+  Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
+  Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+known_false_positives: other browser not listed related to firefox may catch by this
+  rule.
+eferences:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
+tags:
+  analytic_story:
+  - FIN7
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_sacl/security.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1555.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Object_Name
+  - Object_Type
+  - process_name
+  - Access_Mask
+  - Accesses
+  - process_id
+  - EventCode
+  - dest
+  - user
+  security_domain: endpoint
+  impact: 50
+  confidence: 70
+  risk_score: 35
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  message: a non firefox browser process $process_name$ accessing $Object_Name$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/office_application_drop_executable.yml

@@ -0,0 +1,70 @@
+name: Office Application Drop Executable
+id: 73ce70c4-146d-11ec-9184-acde48001122
+version: 1
+date: '2021-09-13'
+author: Teoderick Contreras, Michael Haag Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious MS office application that drop
+  or create executables or script in the host. This behavior is commonly seen in spear
+  phishing office attachment where it drop malicious files or script to compromised
+  the host. It might be some normal macro may drop script or tools as part of automation
+  but still this behavior is reallly suspicious and not commonly seen in normal office
+  application
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
+  | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly`
+  count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
+  where Filesystem.file_name IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1")
+  by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
+  Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time
+  file_name file_path process_name process_path process] | dedup file_create_time
+  | table dest, process_name, process, file_create_time, file_name, file_path | `office_application_drop_executable_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: office macro for automation may do this behavior
+references:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
+tags:
+  analytic_story:
+  - FIN7
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - TargetFilename
+  - ProcessGuid
+  - dest
+  - user_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 80
+  risk_score: 64
+  context:
+  - Source:Endpoint
+  - Stage:recon
+  message: process $process_name$ drops a file $TargetFilename$ in host $dest$
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: process name
+    role:
+    - Attacker
+  automated_detection_testing: passed

detections/endpoint/xsl_script_execution_with_wmic.yml

@@ -0,0 +1,68 @@
+name: XSL Script Execution With WMIC
+id: 004e32e2-146d-11ec-a83f-acde48001122
+version: 1
+date: '2021-09-13'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious wmic.exe process or renamed wmic
+  process to execute malicious xsl file. This technique was seen in FIN7 to execute
+  its malicous jscript using the .xsl as the loader with the help of wmic.exe process.
+  This TTP is really a good indicator for you to hunt further for FIN7 or other attacker
+  that known to used this technique.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process = "*os get*"
+  Processes.process="*/format:*" Processes.process = "*.xsl*" by Processes.parent_process_name
+  Processes.parent_process Processes.process_name Processes.process_id Processes.process
+  Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `xsl_script_execution_with_wmic_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: unknown
+references:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
+tags:
+  analytic_story:
+  - FIN7
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1220
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: Process name $process_name$ with commandline $process$ to execute jscript
+    in $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

stories/fin7.yml

@@ -0,0 +1,29 @@
+name: FIN7
+id: df2b00d3-06ba-49f1-b253-b19cef19b569
+version: 1
+date: '2021-09-14'
+author: Teoderick Contreras, Splunk
+type: batch
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the FIN7 JS Implant and JSSLoader, including looking for Image Loading of ldap and wmi modules, associated
+  with its payload, data collection and script execution.
+narrative: FIN7 is a Russian criminal advanced persistent threat group that has primarily 
+  targeted the U.S. retail, restaurant, and hospitality sectors since mid-2015. 
+  A portion of FIN7 is run out of the front company Combi Security. 
+  It has been called one of the most successful criminal hacking groups in the world. this passed few day FIN7 tools and implant are seen in the wild 
+  where its code is updated. the FIN& is known to use the spear phishing attack as a entry to targetted network or host that will drop its staging payload like the JS and JSSloader. 
+  Now this artifacts and implants seen downloading other malware like cobaltstrike and event ransomware to encrypt host.
+references:
+- https://en.wikipedia.org/wiki/FIN7
+- https://threatpost.com/fin7-windows-11-release/169206/
+- https://www.proofpoint.com/us/blog/threat-insight/jssloader-recoded-and-reloaded
+
+tags:
+  analytic_story: FIN7
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/check_elevated_cmd_using_whoami.test.yml

@@ -0,0 +1,12 @@
+name: Check Elevated CMD using whoami Unit Test
+tests:
+- name: Check Elevated CMD using whoami
+  file: endpoint/check_elevated_cmd_using_whoami.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/cmdline_tool_not_executed_in_cmd_shell.test.yml

@@ -0,0 +1,12 @@
+name: Cmdline Tool Not Executed In CMD Shell Unit Test
+tests:
+- name: Cmdline Tool Not Executed In CMD Shell
+  file: endpoint/cmdline_tool_not_executed_in_cmd_shell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/jscript_execution_using_cscript_app.test.yml

@@ -0,0 +1,15 @@
+name: Jscript Execution Using Cscript App Unit Test
+tests:
+- name: Jscript Execution Using Cscript App
+  file: endpoint/jscript_execution_using_cscript_app.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+
+
+    

tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml

@@ -0,0 +1,12 @@
+name: MS Scripting Process Loading Ldap Module Unit Test
+tests:
+- name: MS Scripting Process Loading Ldap Module
+  file: endpoint/ms_scripting_process_loading_ldap_module.yml
+  pass_condition: '| stats count | where count >= 2'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml

@@ -0,0 +1,15 @@
+name: MS Scripting Process Loading WMI Module Unit Test
+tests:
+- name: MS Scripting Process Loading WMI Module
+  file: endpoint/ms_scripting_process_loading_wmi_module.yml
+  pass_condition: '| stats count | where count >=5'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log
+    source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+
+
+    

tests/endpoint/non_chrome_process_accessing_chrome_default_dir.test.yml

@@ -0,0 +1,12 @@
+name: Non Chrome Process Accessing Chrome Default Dir Unit Test
+tests:
+- name: Non Chrome Process Accessing Chrome Default Dir
+  file: endpoint/non_chrome_process_accessing_chrome_default_dir.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: security2.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_sacl/security2.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog

tests/endpoint/non_firefox_process_access_firefox_profile_dir.test.yml

@@ -0,0 +1,12 @@
+name: Non Firefox Process Access Firefox Profile Dir Unit Test
+tests:
+- name: Non Firefox Process Access Firefox Profile Dir
+  file: endpoint/non_firefox_process_access_firefox_profile_dir.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_sacl/security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog

tests/endpoint/office_application_drop_executable.test.yml

@@ -0,0 +1,12 @@
+name: Office Application Drop Executable Unit Test
+tests:
+- name: Office Application Drop Executable
+  file: endpoint/office_application_drop_executable.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/xsl_script_execution_with_wmic.test.yml

@@ -0,0 +1,12 @@
+name: XSL Script Execution With WMIC Unit Test
+tests:
+- name: XSL Script Execution With WMIC
+  file: endpoint/xsl_script_execution_with_wmic.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog