diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml new file mode 100644 index 0000000000..903c9a0963 --- /dev/null +++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml @@ -0,0 +1,69 @@ +name: Check Elevated CMD using whoami +id: a9079b18-1633-11ec-859c-acde48001122 +version: 1 +date: '2021-09-15' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious whoami execution to check if the + cmd or shell instance process is with elevated privileges. This technique was seen + in FIN7 js implant where it execute this as part of its data collection to the infected + machine to check if the running shell cmd process is elevated or not. This TTP is + really a good alert for known attacker that recon on the targetted host. This command + is not so commonly executed by a normal user or even an admin to check if a process + is elevated. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process = "*whoami*" + Processes.process = "*/group*" Processes.process = "* find *" Processes.process + = "*12288*" by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `check_elevated_cmd_using_whoami_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +eferences: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ +tags: + analytic_story: + - FIN7 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1033 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 70 + confidence: 80 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Execution + message: Process name $process_name$ with commandline $process$ in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml new file mode 100644 index 0000000000..525a611f80 --- /dev/null +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -0,0 +1,71 @@ +name: Cmdline Tool Not Executed In CMD Shell +id: 6c3f7dd8-153c-11ec-ac2d-acde48001122 +version: 1 +date: '2021-09-14' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious parent process execution of commandline + tool not in shell commandline. This technique was seen in FIN7 JSSLoader .net compile + payload where it run ipconfig.exe and systeminfo.exe using .net application. This + event cause some good TTP since those tool are commonly run in commandline not by + another application. This TTP is a good indicator for application gather host information + either an attacker or an automated tool made by admin. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "ipconfig.exe" + OR Processes.process_name = "systeminfo.exe") AND NOT (Processes.parent_process_name + = "cmd.exe" OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name + = "explorer.exe") by Processes.parent_process_name Processes.parent_process Processes.process_name + Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmdline_tool_not_executed_in_cmd_shell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network operator or admin may create this type of tool to gather + host information +references: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ +tags: + analytic_story: + - FIN7 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.007 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 70 + confidence: 80 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Execution + message: parent process name $parent_process_name$ with child process $process_name$ + to execute commandline tool in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml new file mode 100644 index 0000000000..8d7e4339a8 --- /dev/null +++ b/detections/endpoint/jscript_execution_using_cscript_app.yml @@ -0,0 +1,69 @@ +name: Jscript Execution Using Cscript App +id: 002f1e24-146e-11ec-a470-acde48001122 +version: 1 +date: '2021-09-13' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a execution of jscript using cscript process. + Commonly when a user run jscript file it was executed by wscript.exe application. + This technique was seen in FIN7 js implant to execute its malicious script using + cscript process. This behavior is uncommon and a good artifacts to check further + anomalies within the network +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name + = "cscript.exe" AND Processes.parent_process = "*//e:jscript*") OR (Processes.process_name + = "cscript.exe" AND Processes.process = "*//e:jscript*") by Processes.parent_process_name + Processes.parent_process Processes.process_name Processes.process_id Processes.process + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `jscript_execution_using_cscript_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ +tags: + analytic_story: + - FIN7 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.007 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Execution + message: Process name $process_name$ with commandline $process$ to execute jscript + in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml new file mode 100644 index 0000000000..09746b2012 --- /dev/null +++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml @@ -0,0 +1,65 @@ +name: MS Scripting Process Loading Ldap Module +id: 0b0c40dc-14a6-11ec-b267-acde48001122 +version: 1 +date: '2021-09-13' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This search is to detect a suspicious MS scripting process such as wscript.exe + or cscript.exe that loading ldap module to process ldap query. This behavior was + seen in FIN7 implant where it uses javascript to execute ldap query to parse host + information that will send to its C2 server. this anomaly detections is a good initial + step to hunt further a suspicious ldap query or ldap related events to the host + that may give you good information regarding ldap or AD information processing or + might be a attacker. +search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded + IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") | stats min(_time) as firstTime + max(_time) as lastTime count by Image EventCode process_name ProcessId ProcessGuid + Computer ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `ms_scripting_process_loading_ldap_module_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: automation scripting language may used by network operator + to do ldap query. +references: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ +tags: + analytic_story: + - FIN7 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.007 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - EventCode + - process_name + - ProcessId + - ProcessGuid + - Computer + - ImageLoaded + security_domain: endpoint + impact: 30 + confidence: 30 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Execution + message: $process_name$ loading ldap modules $ImageLoaded$ in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml new file mode 100644 index 0000000000..930a359778 --- /dev/null +++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml @@ -0,0 +1,66 @@ +name: MS Scripting Process Loading WMI Module +id: 2eba3d36-14a6-11ec-a682-acde48001122 +version: 1 +date: '2021-09-13' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This search is to detect a suspicious MS scripting process such as wscript.exe + or cscript.exe that loading wmi module to process wmi query. This behavior was seen + in FIN7 implant where it uses javascript to execute wmi query to parse host information + that will send to its C2 server. this anomaly detections is a good initial step + to hunt further a suspicious wmi query or wmi related events to the host that may + give you good information regarding process that are commonly using wmi query or + modules or might be an attacker using this technique. +search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded + IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" , + "*\\wmiutils.dll", "*\\wbemcomn.dll") | stats min(_time) as firstTime max(_time) + as lastTime count by Image EventCode process_name ProcessId ProcessGuid Computer + ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `ms_scripting_process_loading_wmi_module_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: automation scripting language may used by network operator + to do ldap query. +references: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ +tags: + analytic_story: + - FIN7 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.007 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - EventCode + - process_name + - ProcessId + - ProcessGuid + - Computer + - ImageLoaded + security_domain: endpoint + impact: 30 + confidence: 30 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Execution + message: $process_name$ loading wmi modules $ImageLoaded$ in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml new file mode 100644 index 0000000000..56d5285535 --- /dev/null +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -0,0 +1,71 @@ +name: Non Chrome Process Accessing Chrome Default Dir +id: 81263de4-160a-11ec-944f-acde48001122 +version: 1 +date: '2021-09-15' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This search is to detect an anomaly event of non-chrome process accessing + the files in chrome user default folder. This folder contains all the sqlite database + of the chrome browser related to users login, history, cookies and etc. Most of + the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database + to collect information on the compromised host. This SACL Event (4663) need to be + enabled to tthe firefox profile directory to be eable to use this. Since you monitoring + this access to the folder a noise coming from firefox need to be filter and also + sqlite db browser and explorer .exe to make this detection more stable. +search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\chrome.exe", + "*\\explorer.exe", "*sql*")) Object_Name="*\\Google\\Chrome\\User Data\\Default*" + | stats count min(_time) as firstTime max(_time) as lastTime by Object_Name Object_Type + process_name Access_Mask Accesses process_id EventCode dest user | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `non_chrome_process_accessing_chrome_default_dir_filter`' +how_to_implement: To successfully implement this search, you must ingest Windows Security + Event logs and track event code 4663. For 4663, enable "Audit Object Access" in + Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: other browser not listed related to firefox may catch by this + rule. +eferences: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ +tags: + analytic_story: + - FIN7 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_sacl/security2.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1555.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Object_Name + - Object_Type + - process_name + - Access_Mask + - Accesses + - process_id + - EventCode + - dest + - user + security_domain: endpoint + impact: 50 + confidence: 70 + risk_score: 35 + context: + - Source:Endpoint + - Stage:Discovery + message: a non firefox browser process $process_name$ accessing $Object_Name$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml new file mode 100644 index 0000000000..df8db302a7 --- /dev/null +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -0,0 +1,71 @@ +name: Non Firefox Process Access Firefox Profile Dir +id: e6fc13b0-1609-11ec-b533-acde48001122 +version: 1 +date: '2021-09-15' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This search is to detect an anomaly event of non-firefox process accessing + the files in profile folder. This folder contains all the sqlite database of the + firefox browser related to users login, history, cookies and etc. Most of the RAT, + trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect + information on the compromised host. This SACL Event (4663) need to be enabled to + tthe firefox profile directory to be eable to use this. Since you monitoring this + access to the folder a noise coming from firefox need to be filter and also sqlite + db browser and explorer .exe to make this detection more stable. +search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\firefox.exe", + "*\\explorer.exe", "*sql*")) Object_Name="*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles*" + | stats count min(_time) as firstTime max(_time) as lastTime by Object_Name Object_Type + process_name Access_Mask Accesses process_id EventCode dest user | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `non_firefox_process_access_firefox_profile_dir_filter`' +how_to_implement: To successfully implement this search, you must ingest Windows Security + Event logs and track event code 4663. For 4663, enable "Audit Object Access" in + Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: other browser not listed related to firefox may catch by this + rule. +eferences: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ +tags: + analytic_story: + - FIN7 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_sacl/security.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1555.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Object_Name + - Object_Type + - process_name + - Access_Mask + - Accesses + - process_id + - EventCode + - dest + - user + security_domain: endpoint + impact: 50 + confidence: 70 + risk_score: 35 + context: + - Source:Endpoint + - Stage:Discovery + message: a non firefox browser process $process_name$ accessing $Object_Name$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml new file mode 100644 index 0000000000..4433406cb0 --- /dev/null +++ b/detections/endpoint/office_application_drop_executable.yml @@ -0,0 +1,70 @@ +name: Office Application Drop Executable +id: 73ce70c4-146d-11ec-9184-acde48001122 +version: 1 +date: '2021-09-13' +author: Teoderick Contreras, Michael Haag Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious MS office application that drop + or create executables or script in the host. This behavior is commonly seen in spear + phishing office attachment where it drop malicious files or script to compromised + the host. It might be some normal macro may drop script or tools as part of automation + but still this behavior is reallly suspicious and not commonly seen in normal office + application +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest + | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1") + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time + file_name file_path process_name process_path process] | dedup file_create_time + | table dest, process_name, process, file_create_time, file_name, file_path | `office_application_drop_executable_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: office macro for automation may do this behavior +references: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ +tags: + analytic_story: + - FIN7 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - TargetFilename + - ProcessGuid + - dest + - user_id + security_domain: endpoint + impact: 80 + confidence: 80 + risk_score: 64 + context: + - Source:Endpoint + - Stage:recon + message: process $process_name$ drops a file $TargetFilename$ in host $dest$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker + automated_detection_testing: passed diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml new file mode 100644 index 0000000000..2937230942 --- /dev/null +++ b/detections/endpoint/xsl_script_execution_with_wmic.yml @@ -0,0 +1,68 @@ +name: XSL Script Execution With WMIC +id: 004e32e2-146d-11ec-a83f-acde48001122 +version: 1 +date: '2021-09-13' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious wmic.exe process or renamed wmic + process to execute malicious xsl file. This technique was seen in FIN7 to execute + its malicous jscript using the .xsl as the loader with the help of wmic.exe process. + This TTP is really a good indicator for you to hunt further for FIN7 or other attacker + that known to used this technique. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process = "*os get*" + Processes.process="*/format:*" Processes.process = "*.xsl*" by Processes.parent_process_name + Processes.parent_process Processes.process_name Processes.process_id Processes.process + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `xsl_script_execution_with_wmic_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ +tags: + analytic_story: + - FIN7 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1220 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Execution + message: Process name $process_name$ with commandline $process$ to execute jscript + in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/stories/fin7.yml b/stories/fin7.yml new file mode 100644 index 0000000000..fe38a63258 --- /dev/null +++ b/stories/fin7.yml @@ -0,0 +1,29 @@ +name: FIN7 +id: df2b00d3-06ba-49f1-b253-b19cef19b569 +version: 1 +date: '2021-09-14' +author: Teoderick Contreras, Splunk +type: batch +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the FIN7 JS Implant and JSSLoader, including looking for Image Loading of ldap and wmi modules, associated + with its payload, data collection and script execution. +narrative: FIN7 is a Russian criminal advanced persistent threat group that has primarily + targeted the U.S. retail, restaurant, and hospitality sectors since mid-2015. + A portion of FIN7 is run out of the front company Combi Security. + It has been called one of the most successful criminal hacking groups in the world. this passed few day FIN7 tools and implant are seen in the wild + where its code is updated. the FIN& is known to use the spear phishing attack as a entry to targetted network or host that will drop its staging payload like the JS and JSSloader. + Now this artifacts and implants seen downloading other malware like cobaltstrike and event ransomware to encrypt host. +references: +- https://en.wikipedia.org/wiki/FIN7 +- https://threatpost.com/fin7-windows-11-release/169206/ +- https://www.proofpoint.com/us/blog/threat-insight/jssloader-recoded-and-reloaded + +tags: + analytic_story: FIN7 + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/check_elevated_cmd_using_whoami.test.yml b/tests/endpoint/check_elevated_cmd_using_whoami.test.yml new file mode 100644 index 0000000000..c1b40a097d --- /dev/null +++ b/tests/endpoint/check_elevated_cmd_using_whoami.test.yml @@ -0,0 +1,12 @@ +name: Check Elevated CMD using whoami Unit Test +tests: +- name: Check Elevated CMD using whoami + file: endpoint/check_elevated_cmd_using_whoami.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/cmdline_tool_not_executed_in_cmd_shell.test.yml b/tests/endpoint/cmdline_tool_not_executed_in_cmd_shell.test.yml new file mode 100644 index 0000000000..2b12437eaa --- /dev/null +++ b/tests/endpoint/cmdline_tool_not_executed_in_cmd_shell.test.yml @@ -0,0 +1,12 @@ +name: Cmdline Tool Not Executed In CMD Shell Unit Test +tests: +- name: Cmdline Tool Not Executed In CMD Shell + file: endpoint/cmdline_tool_not_executed_in_cmd_shell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/jscript_execution_using_cscript_app.test.yml b/tests/endpoint/jscript_execution_using_cscript_app.test.yml new file mode 100644 index 0000000000..de8fe9be33 --- /dev/null +++ b/tests/endpoint/jscript_execution_using_cscript_app.test.yml @@ -0,0 +1,15 @@ +name: Jscript Execution Using Cscript App Unit Test +tests: +- name: Jscript Execution Using Cscript App + file: endpoint/jscript_execution_using_cscript_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + + \ No newline at end of file diff --git a/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml b/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml new file mode 100644 index 0000000000..3e60648541 --- /dev/null +++ b/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml @@ -0,0 +1,12 @@ +name: MS Scripting Process Loading Ldap Module Unit Test +tests: +- name: MS Scripting Process Loading Ldap Module + file: endpoint/ms_scripting_process_loading_ldap_module.yml + pass_condition: '| stats count | where count >= 2' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml b/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml new file mode 100644 index 0000000000..df5d0a537c --- /dev/null +++ b/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml @@ -0,0 +1,15 @@ +name: MS Scripting Process Loading WMI Module Unit Test +tests: +- name: MS Scripting Process Loading WMI Module + file: endpoint/ms_scripting_process_loading_wmi_module.yml + pass_condition: '| stats count | where count >=5' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + + \ No newline at end of file diff --git a/tests/endpoint/non_chrome_process_accessing_chrome_default_dir.test.yml b/tests/endpoint/non_chrome_process_accessing_chrome_default_dir.test.yml new file mode 100644 index 0000000000..3a582e9cb7 --- /dev/null +++ b/tests/endpoint/non_chrome_process_accessing_chrome_default_dir.test.yml @@ -0,0 +1,12 @@ +name: Non Chrome Process Accessing Chrome Default Dir Unit Test +tests: +- name: Non Chrome Process Accessing Chrome Default Dir + file: endpoint/non_chrome_process_accessing_chrome_default_dir.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: security2.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_sacl/security2.log + source: WinEventLog:Security + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/non_firefox_process_access_firefox_profile_dir.test.yml b/tests/endpoint/non_firefox_process_access_firefox_profile_dir.test.yml new file mode 100644 index 0000000000..a073e60157 --- /dev/null +++ b/tests/endpoint/non_firefox_process_access_firefox_profile_dir.test.yml @@ -0,0 +1,12 @@ +name: Non Firefox Process Access Firefox Profile Dir Unit Test +tests: +- name: Non Firefox Process Access Firefox Profile Dir + file: endpoint/non_firefox_process_access_firefox_profile_dir.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_sacl/security.log + source: WinEventLog:Security + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/office_application_drop_executable.test.yml b/tests/endpoint/office_application_drop_executable.test.yml new file mode 100644 index 0000000000..397acb8085 --- /dev/null +++ b/tests/endpoint/office_application_drop_executable.test.yml @@ -0,0 +1,12 @@ +name: Office Application Drop Executable Unit Test +tests: +- name: Office Application Drop Executable + file: endpoint/office_application_drop_executable.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/xsl_script_execution_with_wmic.test.yml b/tests/endpoint/xsl_script_execution_with_wmic.test.yml new file mode 100644 index 0000000000..98fa90d3a7 --- /dev/null +++ b/tests/endpoint/xsl_script_execution_with_wmic.test.yml @@ -0,0 +1,12 @@ +name: XSL Script Execution With WMIC Unit Test +tests: +- name: XSL Script Execution With WMIC + file: endpoint/xsl_script_execution_with_wmic.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file