From d8d8c4e44c86832082127a36fe2873787642314e Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 14 Sep 2021 12:17:55 +0200 Subject: [PATCH 01/29] FIN7 --- .../jscript_execution_using_cscript_app.yml | 67 +++++++++++++++++++ .../office_application_drop_executable.yml | 65 ++++++++++++++++++ .../xsl_script_execution_with_wmic.yml | 67 +++++++++++++++++++ stories/fin7.yml | 29 ++++++++ ...cript_execution_using_cscript_app.test.yml | 15 +++++ ...ffice_application_drop_executable.test.yml | 12 ++++ .../xsl_script_execution_with_wmic.test.yml | 12 ++++ 7 files changed, 267 insertions(+) create mode 100644 detections/endpoint/jscript_execution_using_cscript_app.yml create mode 100644 detections/endpoint/office_application_drop_executable.yml create mode 100644 detections/endpoint/xsl_script_execution_with_wmic.yml create mode 100644 stories/fin7.yml create mode 100644 tests/endpoint/jscript_execution_using_cscript_app.test.yml create mode 100644 tests/endpoint/office_application_drop_executable.test.yml create mode 100644 tests/endpoint/xsl_script_execution_with_wmic.test.yml diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml new file mode 100644 index 0000000000..5e6d38a696 --- /dev/null +++ b/detections/endpoint/jscript_execution_using_cscript_app.yml @@ -0,0 +1,67 @@ +name: Jscript Execution Using Cscript App +id: 002f1e24-146e-11ec-a470-acde48001122 +version: 1 +date: '2021-09-13' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a execution of jscript using cscript process. + Commonly when a user run jscript file it was executed by wscript.exe application. This technique was seen in + FIN7 js implant to execute its malicious script using cscript process. This behavior is uncommon and a good artifacts + to check further anomalies within the network +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.parent_process_name = "cscript.exe" AND Processes.parent_process = "*//e:jscript*") OR (Processes.process_name = "cscript.exe" AND Processes.process = "*//e:jscript*") + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process_id Processes.process Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `jscript_execution_using_cscript_app_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ +tags: + analytic_story: + - FIN7 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.007 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Execution + message: Process name $process_name$ with commandline $process$ to execute jscript in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml new file mode 100644 index 0000000000..2c3fb9e542 --- /dev/null +++ b/detections/endpoint/office_application_drop_executable.yml @@ -0,0 +1,65 @@ +name: Office Application Drop Executable +id: 73ce70c4-146d-11ec-9184-acde48001122 +version: 1 +date: '2021-09-13' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious MS office application that drop or create executables or script in the host. + This behavior is commonly seen in spear phishing office attachment where it drop malicious files or script to compromised the host. + It might be some normal macro may drop script or tools as part of automation but still this behavior is reallly suspicious and not commonly seen + in normal office application +search: '`sysmon` EventCode=11 Image IN ("*\\winword.exe","*\\excel.exe","*\\powerpnt.exe","*\\mspub.exe","*\\visio.exe","*\\wordpad.exe","*\\wordview.exe") + TargetFilename IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1") AND NOT(TargetFilename IN ("*\\program files*","*\\windows\\*")) + | stats count min(_time) as firstTime max(_time) as lastTime by Image TargetFilename ProcessGuid dest user_id + | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` + | `office_application_drop_executable_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: office macro for automation may do this behavior +references: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ +tags: + analytic_story: + - FIN7 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - TargetFilename + - ProcessGuid + - dest + - user_id + security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:recon + message: process $process_name$ drops a file $TargetFilename$ in host $dest$ + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker + \ No newline at end of file diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml new file mode 100644 index 0000000000..aadfaa8152 --- /dev/null +++ b/detections/endpoint/xsl_script_execution_with_wmic.yml @@ -0,0 +1,67 @@ +name: XSL Script Execution With WMIC +id: 004e32e2-146d-11ec-a83f-acde48001122 +version: 1 +date: '2021-09-13' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious wmic.exe process or renamed wmic process to execute malicious xsl file. + This technique was seen in FIN7 to execute its malicous jscript using the .xsl as the loader with the help of wmic.exe process. + This TTP is really a good indicator for you to hunt further for FIN7 or other attacker that known to used this technique. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process = "*os get*" Processes.process="*/format:*" Processes.process = "*.xsl*" + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process_id Processes.process Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `xsl_script_execution_with_wmic_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ +tags: + analytic_story: + - FIN7 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1220 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Execution + message: Process name $process_name$ with commandline $process$ to execute jscript in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + \ No newline at end of file diff --git a/stories/fin7.yml b/stories/fin7.yml new file mode 100644 index 0000000000..951bcdc6b7 --- /dev/null +++ b/stories/fin7.yml @@ -0,0 +1,29 @@ +name: IcedID +id: df2b00d3-06ba-49f1-b253-b19cef19b569 +version: 1 +date: '2021-09-14' +author: Teoderick Contreras, Splunk +type: batch +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the FIN7 JS Implant and JSSLoader, including looking for Image Loading of ldap and wmi modules, associated + with its payload, data collection and script execution. +narrative: FIN7 is a Russian criminal advanced persistent threat group that has primarily + targeted the U.S. retail, restaurant, and hospitality sectors since mid-2015. + A portion of FIN7 is run out of the front company Combi Security. + It has been called one of the most successful criminal hacking groups in the world. this passed few day FIN7 tools and implant are seen in the wild + where its code is updated. the FIN& is known to use the spear phishing attack as a entry to targetted network or host that will drop its staging payload like the JS and JSSloader. + Now this artifacts and implants seen downloading other malware like cobaltstrike and event ransomware to encrypt host. +references: +- https://en.wikipedia.org/wiki/FIN7 +- https://threatpost.com/fin7-windows-11-release/169206/ +- https://www.proofpoint.com/us/blog/threat-insight/jssloader-recoded-and-reloaded + +tags: + analytic_story: FIN7 + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/jscript_execution_using_cscript_app.test.yml b/tests/endpoint/jscript_execution_using_cscript_app.test.yml new file mode 100644 index 0000000000..de8fe9be33 --- /dev/null +++ b/tests/endpoint/jscript_execution_using_cscript_app.test.yml @@ -0,0 +1,15 @@ +name: Jscript Execution Using Cscript App Unit Test +tests: +- name: Jscript Execution Using Cscript App + file: endpoint/jscript_execution_using_cscript_app.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + + \ No newline at end of file diff --git a/tests/endpoint/office_application_drop_executable.test.yml b/tests/endpoint/office_application_drop_executable.test.yml new file mode 100644 index 0000000000..397acb8085 --- /dev/null +++ b/tests/endpoint/office_application_drop_executable.test.yml @@ -0,0 +1,12 @@ +name: Office Application Drop Executable Unit Test +tests: +- name: Office Application Drop Executable + file: endpoint/office_application_drop_executable.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/xsl_script_execution_with_wmic.test.yml b/tests/endpoint/xsl_script_execution_with_wmic.test.yml new file mode 100644 index 0000000000..98fa90d3a7 --- /dev/null +++ b/tests/endpoint/xsl_script_execution_with_wmic.test.yml @@ -0,0 +1,12 @@ +name: XSL Script Execution With WMIC Unit Test +tests: +- name: XSL Script Execution With WMIC + file: endpoint/xsl_script_execution_with_wmic.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From d3c2aed6b0f11ea44319319bbef4054c881d4641 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 14 Sep 2021 12:20:02 +0200 Subject: [PATCH 02/29] fin7 --- stories/fin7.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stories/fin7.yml b/stories/fin7.yml index 951bcdc6b7..fe38a63258 100644 --- a/stories/fin7.yml +++ b/stories/fin7.yml @@ -1,4 +1,4 @@ -name: IcedID +name: FIN7 id: df2b00d3-06ba-49f1-b253-b19cef19b569 version: 1 date: '2021-09-14' From d96f70cf8eb11db0a602427a9d369071a52f1a49 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 15 Sep 2021 13:45:42 +0200 Subject: [PATCH 03/29] fin7 --- ...e_process_accessing_chrome_default_dir.yml | 68 ++++++++++++++++++ ...fox_process_access_firefox_profile_dir.yml | 70 +++++++++++++++++++ ...cess_accessing_chrome_default_dir.test.yml | 12 ++++ ...rocess_access_firefox_profile_dir.test.yml | 12 ++++ 4 files changed, 162 insertions(+) create mode 100644 detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml create mode 100644 detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml create mode 100644 tests/endpoint/non_chrome_process_accessing_chrome_default_dir.test.yml create mode 100644 tests/endpoint/non_firefox_process_access_firefox_profile_dir.test.yml diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml new file mode 100644 index 0000000000..ad05d308b9 --- /dev/null +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -0,0 +1,68 @@ +name: Non Chrome Process Accessing Chrome Default Dir +id: 81263de4-160a-11ec-944f-acde48001122 +version: 1 +date: '2021-09-15' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This search is to detect an anomaly event of non-chrome process accessing the files in chrome user default folder. + This folder contains all the sqlite database of the chrome browser related to users login, history, cookies and etc. + Most of the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect information on the compromised host. + This SACL Event (4663) need to be enabled to tthe firefox profile directory to be eable to use this. + Since you monitoring this access to the folder a noise coming from firefox need to be filter and also sqlite db browser and explorer .exe to make this + detection more stable. +search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\chrome.exe", "*\\explorer.exe", "*sql*")) Object_Name="*\\Google\\Chrome\\User Data\\Default*" +| stats count min(_time) as firstTime max(_time) as lastTime by Object_Name Object_Type process_name Access_Mask Accesses process_id EventCode dest user +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `non_chrome_process_accessing_chrome_default_dir_filter`' +how_to_implement: To successfully implement this search, you must ingest Windows Security + Event logs and track event code 4663. For 4663, enable "Audit Object Access" in + Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: other browser not listed related to firefox may catch by this rule. +eferences: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ +tags: + analytic_story: + - FIN7 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_sacl/security2.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1555.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Object_Name + - Object_Type + - process_name + - Access_Mask + - Accesses + - process_id + - EventCode + - dest + - user + security_domain: endpoint + impact: 50 + confidence: 70 + # (impact * confidence)/100 + risk_score: 35 + context: + - Source:Endpoint + - Stage:Discovery + message: a non firefox browser process $process_name$ accessing $Object_Name$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml new file mode 100644 index 0000000000..92797d8a67 --- /dev/null +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -0,0 +1,70 @@ +name: Non Firefox Process Access Firefox Profile Dir +id: e6fc13b0-1609-11ec-b533-acde48001122 +version: 1 +date: '2021-09-15' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This search is to detect an anomaly event of non-firefox process accessing the files in profile folder. + This folder contains all the sqlite database of the firefox browser related to users login, history, cookies and etc. + Most of the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect information on the compromised host. + This SACL Event (4663) need to be enabled to tthe firefox profile directory to be eable to use this. + Since you monitoring this access to the folder a noise coming from firefox need to be filter and also sqlite db browser and explorer .exe to make this + detection more stable. +search: 'eventtype=wineventlog_security EventCode=4663 + NOT (process_name IN ("*\\firefox.exe", "*\\explorer.exe", "*sql*")) Object_Name="*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles*" + | stats count min(_time) as firstTime max(_time) as lastTime + by Object_Name Object_Type process_name Access_Mask Accesses process_id EventCode dest user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `non_firefox_process_access_firefox_profile_dir_filter`' +how_to_implement: To successfully implement this search, you must ingest Windows Security + Event logs and track event code 4663. For 4663, enable "Audit Object Access" in + Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: other browser not listed related to firefox may catch by this rule. +eferences: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ +tags: + analytic_story: + - FIN7 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_sacl/security.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1555.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Object_Name + - Object_Type + - process_name + - Access_Mask + - Accesses + - process_id + - EventCode + - dest + - user + security_domain: endpoint + impact: 50 + confidence: 70 + # (impact * confidence)/100 + risk_score: 35 + context: + - Source:Endpoint + - Stage:Discovery + message: a non firefox browser process $process_name$ accessing $Object_Name$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/non_chrome_process_accessing_chrome_default_dir.test.yml b/tests/endpoint/non_chrome_process_accessing_chrome_default_dir.test.yml new file mode 100644 index 0000000000..3a582e9cb7 --- /dev/null +++ b/tests/endpoint/non_chrome_process_accessing_chrome_default_dir.test.yml @@ -0,0 +1,12 @@ +name: Non Chrome Process Accessing Chrome Default Dir Unit Test +tests: +- name: Non Chrome Process Accessing Chrome Default Dir + file: endpoint/non_chrome_process_accessing_chrome_default_dir.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: security2.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_sacl/security2.log + source: WinEventLog:Security + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/non_firefox_process_access_firefox_profile_dir.test.yml b/tests/endpoint/non_firefox_process_access_firefox_profile_dir.test.yml new file mode 100644 index 0000000000..a073e60157 --- /dev/null +++ b/tests/endpoint/non_firefox_process_access_firefox_profile_dir.test.yml @@ -0,0 +1,12 @@ +name: Non Firefox Process Access Firefox Profile Dir Unit Test +tests: +- name: Non Firefox Process Access Firefox Profile Dir + file: endpoint/non_firefox_process_access_firefox_profile_dir.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_sacl/security.log + source: WinEventLog:Security + sourcetype: WinEventLog \ No newline at end of file From d0eff26cde13ce6990680a55579ffeec52f84dca Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 15 Sep 2021 13:48:22 +0200 Subject: [PATCH 04/29] fin7 --- .../endpoint/non_firefox_process_access_firefox_profile_dir.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 92797d8a67..b43dcc6bb4 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -12,7 +12,7 @@ description: This search is to detect an anomaly event of non-firefox process ac This SACL Event (4663) need to be enabled to tthe firefox profile directory to be eable to use this. Since you monitoring this access to the folder a noise coming from firefox need to be filter and also sqlite db browser and explorer .exe to make this detection more stable. -search: 'eventtype=wineventlog_security EventCode=4663 +search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\firefox.exe", "*\\explorer.exe", "*sql*")) Object_Name="*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles*" | stats count min(_time) as firstTime max(_time) as lastTime by Object_Name Object_Type process_name Access_Mask Accesses process_id EventCode dest user From 8422a53a2060e083fa2821780f6f48ab93d9d88b Mon Sep 17 00:00:00 2001 From: root Date: Wed, 15 Sep 2021 12:43:04 +0000 Subject: [PATCH 05/29] Added detection testing service results inXSL Script Execution With WMIC --- .../xsl_script_execution_with_wmic.yml | 31 ++++++++++--------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml index aadfaa8152..2937230942 100644 --- a/detections/endpoint/xsl_script_execution_with_wmic.yml +++ b/detections/endpoint/xsl_script_execution_with_wmic.yml @@ -6,20 +6,21 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a suspicious wmic.exe process or renamed wmic process to execute malicious xsl file. - This technique was seen in FIN7 to execute its malicous jscript using the .xsl as the loader with the help of wmic.exe process. - This TTP is really a good indicator for you to hunt further for FIN7 or other attacker that known to used this technique. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process = "*os get*" Processes.process="*/format:*" Processes.process = "*.xsl*" - by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process_id Processes.process Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `xsl_script_execution_with_wmic_filter`' +description: This search is to detect a suspicious wmic.exe process or renamed wmic + process to execute malicious xsl file. This technique was seen in FIN7 to execute + its malicous jscript using the .xsl as the loader with the help of wmic.exe process. + This TTP is really a good indicator for you to hunt further for FIN7 or other attacker + that known to used this technique. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process = "*os get*" + Processes.process="*/format:*" Processes.process = "*.xsl*" by Processes.parent_process_name + Processes.parent_process Processes.process_name Processes.process_id Processes.process + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `xsl_script_execution_with_wmic_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown references: - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html @@ -45,16 +46,16 @@ tags: - Processes.process_id - Processes.process - Processes.dest - - Processes.user + - Processes.user security_domain: endpoint impact: 70 confidence: 70 - # (impact * confidence)/100 risk_score: 49 context: - Source:Endpoint - Stage:Execution - message: Process name $process_name$ with commandline $process$ to execute jscript in $dest$ + message: Process name $process_name$ with commandline $process$ to execute jscript + in $dest$ observable: - name: dest type: Endpoint @@ -64,4 +65,4 @@ tags: type: User role: - Victim - \ No newline at end of file + automated_detection_testing: passed From f42e2cd25582537eb0694e551e15e52d99d284d2 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 15 Sep 2021 13:03:19 +0000 Subject: [PATCH 06/29] Added detection testing service results inOffice Application Drop Executable --- .../office_application_drop_executable.yml | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml index 2c3fb9e542..a9a395238b 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/office_application_drop_executable.yml @@ -6,16 +6,17 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a suspicious MS office application that drop or create executables or script in the host. - This behavior is commonly seen in spear phishing office attachment where it drop malicious files or script to compromised the host. - It might be some normal macro may drop script or tools as part of automation but still this behavior is reallly suspicious and not commonly seen - in normal office application +description: This search is to detect a suspicious MS office application that drop + or create executables or script in the host. This behavior is commonly seen in spear + phishing office attachment where it drop malicious files or script to compromised + the host. It might be some normal macro may drop script or tools as part of automation + but still this behavior is reallly suspicious and not commonly seen in normal office + application search: '`sysmon` EventCode=11 Image IN ("*\\winword.exe","*\\excel.exe","*\\powerpnt.exe","*\\mspub.exe","*\\visio.exe","*\\wordpad.exe","*\\wordview.exe") - TargetFilename IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1") AND NOT(TargetFilename IN ("*\\program files*","*\\windows\\*")) - | stats count min(_time) as firstTime max(_time) as lastTime by Image TargetFilename ProcessGuid dest user_id - | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` - | `office_application_drop_executable_filter`' + TargetFilename IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1") + AND NOT(TargetFilename IN ("*\\program files*","*\\windows\\*")) | stats count min(_time) + as firstTime max(_time) as lastTime by Image TargetFilename ProcessGuid dest user_id + | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `office_application_drop_executable_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -39,17 +40,16 @@ tags: - Splunk Cloud required_fields: - _time - - Image + - Image - TargetFilename - - ProcessGuid + - ProcessGuid - dest - - user_id + - user_id security_domain: endpoint impact: 80 confidence: 80 - # (impact * confidence)/100 risk_score: 64 - context: + context: - Source:Endpoint - Stage:recon message: process $process_name$ drops a file $TargetFilename$ in host $dest$ @@ -62,4 +62,4 @@ tags: type: process name role: - Attacker - \ No newline at end of file + automated_detection_testing: passed From 50c9e383377d70770236aea73f42f8af3bced63c Mon Sep 17 00:00:00 2001 From: root Date: Wed, 15 Sep 2021 13:59:55 +0000 Subject: [PATCH 07/29] Added detection testing service results inJscript Execution Using Cscript App --- .../jscript_execution_using_cscript_app.yml | 32 ++++++++++--------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml index 5e6d38a696..8d7e4339a8 100644 --- a/detections/endpoint/jscript_execution_using_cscript_app.yml +++ b/detections/endpoint/jscript_execution_using_cscript_app.yml @@ -7,20 +7,21 @@ type: TTP datamodel: - Endpoint description: This search is to detect a execution of jscript using cscript process. - Commonly when a user run jscript file it was executed by wscript.exe application. This technique was seen in - FIN7 js implant to execute its malicious script using cscript process. This behavior is uncommon and a good artifacts - to check further anomalies within the network -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.parent_process_name = "cscript.exe" AND Processes.parent_process = "*//e:jscript*") OR (Processes.process_name = "cscript.exe" AND Processes.process = "*//e:jscript*") - by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process_id Processes.process Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `jscript_execution_using_cscript_app_filter`' + Commonly when a user run jscript file it was executed by wscript.exe application. + This technique was seen in FIN7 js implant to execute its malicious script using + cscript process. This behavior is uncommon and a good artifacts to check further + anomalies within the network +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name + = "cscript.exe" AND Processes.parent_process = "*//e:jscript*") OR (Processes.process_name + = "cscript.exe" AND Processes.process = "*//e:jscript*") by Processes.parent_process_name + Processes.parent_process Processes.process_name Processes.process_id Processes.process + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `jscript_execution_using_cscript_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown references: - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html @@ -46,16 +47,16 @@ tags: - Processes.process_id - Processes.process - Processes.dest - - Processes.user + - Processes.user security_domain: endpoint impact: 70 confidence: 70 - # (impact * confidence)/100 risk_score: 49 context: - Source:Endpoint - Stage:Execution - message: Process name $process_name$ with commandline $process$ to execute jscript in $dest$ + message: Process name $process_name$ with commandline $process$ to execute jscript + in $dest$ observable: - name: dest type: Endpoint @@ -64,4 +65,5 @@ tags: - name: user type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From b23dbeed086ac52150131ceedcc02fc8d330dd22 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 15 Sep 2021 16:00:56 +0000 Subject: [PATCH 08/29] Added detection testing service results inNon Firefox Process Access Firefox Profile Dir --- ...fox_process_access_firefox_profile_dir.yml | 33 ++++++++++--------- 1 file changed, 17 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index b43dcc6bb4..df8db302a7 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -6,23 +6,24 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This search is to detect an anomaly event of non-firefox process accessing the files in profile folder. - This folder contains all the sqlite database of the firefox browser related to users login, history, cookies and etc. - Most of the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect information on the compromised host. - This SACL Event (4663) need to be enabled to tthe firefox profile directory to be eable to use this. - Since you monitoring this access to the folder a noise coming from firefox need to be filter and also sqlite db browser and explorer .exe to make this - detection more stable. -search: '`wineventlog_security` EventCode=4663 - NOT (process_name IN ("*\\firefox.exe", "*\\explorer.exe", "*sql*")) Object_Name="*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles*" - | stats count min(_time) as firstTime max(_time) as lastTime - by Object_Name Object_Type process_name Access_Mask Accesses process_id EventCode dest user - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `non_firefox_process_access_firefox_profile_dir_filter`' +description: This search is to detect an anomaly event of non-firefox process accessing + the files in profile folder. This folder contains all the sqlite database of the + firefox browser related to users login, history, cookies and etc. Most of the RAT, + trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect + information on the compromised host. This SACL Event (4663) need to be enabled to + tthe firefox profile directory to be eable to use this. Since you monitoring this + access to the folder a noise coming from firefox need to be filter and also sqlite + db browser and explorer .exe to make this detection more stable. +search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\firefox.exe", + "*\\explorer.exe", "*sql*")) Object_Name="*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles*" + | stats count min(_time) as firstTime max(_time) as lastTime by Object_Name Object_Type + process_name Access_Mask Accesses process_id EventCode dest user | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `non_firefox_process_access_firefox_profile_dir_filter`' how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." -known_false_positives: other browser not listed related to firefox may catch by this rule. +known_false_positives: other browser not listed related to firefox may catch by this + rule. eferences: - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html - https://attack.mitre.org/groups/G0046/ @@ -53,7 +54,6 @@ tags: security_domain: endpoint impact: 50 confidence: 70 - # (impact * confidence)/100 risk_score: 35 context: - Source:Endpoint @@ -67,4 +67,5 @@ tags: - name: user type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From a30c746aebf2c8fd639dbf499a681c82790a5e78 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 16 Sep 2021 10:03:01 +0000 Subject: [PATCH 09/29] Added detection testing service results inNon Chrome Process Accessing Chrome Default Dir --- ...e_process_accessing_chrome_default_dir.yml | 31 ++++++++++--------- 1 file changed, 17 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index ad05d308b9..56d5285535 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -6,21 +6,24 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This search is to detect an anomaly event of non-chrome process accessing the files in chrome user default folder. - This folder contains all the sqlite database of the chrome browser related to users login, history, cookies and etc. - Most of the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect information on the compromised host. - This SACL Event (4663) need to be enabled to tthe firefox profile directory to be eable to use this. - Since you monitoring this access to the folder a noise coming from firefox need to be filter and also sqlite db browser and explorer .exe to make this - detection more stable. -search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\chrome.exe", "*\\explorer.exe", "*sql*")) Object_Name="*\\Google\\Chrome\\User Data\\Default*" -| stats count min(_time) as firstTime max(_time) as lastTime by Object_Name Object_Type process_name Access_Mask Accesses process_id EventCode dest user -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `non_chrome_process_accessing_chrome_default_dir_filter`' +description: This search is to detect an anomaly event of non-chrome process accessing + the files in chrome user default folder. This folder contains all the sqlite database + of the chrome browser related to users login, history, cookies and etc. Most of + the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database + to collect information on the compromised host. This SACL Event (4663) need to be + enabled to tthe firefox profile directory to be eable to use this. Since you monitoring + this access to the folder a noise coming from firefox need to be filter and also + sqlite db browser and explorer .exe to make this detection more stable. +search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\chrome.exe", + "*\\explorer.exe", "*sql*")) Object_Name="*\\Google\\Chrome\\User Data\\Default*" + | stats count min(_time) as firstTime max(_time) as lastTime by Object_Name Object_Type + process_name Access_Mask Accesses process_id EventCode dest user | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `non_chrome_process_accessing_chrome_default_dir_filter`' how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." -known_false_positives: other browser not listed related to firefox may catch by this rule. +known_false_positives: other browser not listed related to firefox may catch by this + rule. eferences: - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html - https://attack.mitre.org/groups/G0046/ @@ -51,7 +54,6 @@ tags: security_domain: endpoint impact: 50 confidence: 70 - # (impact * confidence)/100 risk_score: 35 context: - Source:Endpoint @@ -65,4 +67,5 @@ tags: - name: user type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From b869a0de99742449675b544d2bf91e9d27aa5fc8 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 16 Sep 2021 15:54:32 +0200 Subject: [PATCH 10/29] fin7 --- .../check_elevated_cmd_using_whoami.yml | 68 ++++++++++++++++++ ...cmdline_tool_not_executed_in_cmd_shell.yml | 69 +++++++++++++++++++ .../office_application_drop_executable.yml | 17 +++-- .../check_elevated_cmd_using_whoami.test.yml | 12 ++++ ...ne_tool_not_executed_in_cmd_shell.test.yml | 12 ++++ 5 files changed, 172 insertions(+), 6 deletions(-) create mode 100644 detections/endpoint/check_elevated_cmd_using_whoami.yml create mode 100644 detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml create mode 100644 tests/endpoint/check_elevated_cmd_using_whoami.test.yml create mode 100644 tests/endpoint/cmdline_tool_not_executed_in_cmd_shell.test.yml diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml new file mode 100644 index 0000000000..c76aa74ebd --- /dev/null +++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml @@ -0,0 +1,68 @@ +name: Check Elevated CMD using whoami +id: a9079b18-1633-11ec-859c-acde48001122 +version: 1 +date: '2021-09-15' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious whoami execution to check if the cmd or shell instance process is with elevated privileges. + This technique was seen in FIN7 js implant where it execute this as part of its data collection to the infected machine to check if the running shell + cmd process is elevated or not. This TTP is really a good alert for known attacker that recon on the targetted host. This command is not so commonly + executed by a normal user or even an admin to check if a process is elevated. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process = "*whoami*" Processes.process = "*/group*" Processes.process = "* find *" Processes.process = "*12288*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `check_elevated_cmd_using_whoami_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +eferences: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ +tags: + analytic_story: + - FIN7 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1033 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Execution + message: Process name $process_name$ with commandline $process$ in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml new file mode 100644 index 0000000000..79f3eacfac --- /dev/null +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -0,0 +1,69 @@ +name: Cmdline Tool Not Executed In CMD Shell +id: 6c3f7dd8-153c-11ec-ac2d-acde48001122 +version: 1 +date: '2021-09-14' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious parent process execution of commandline tool not in shell commandline. + This technique was seen in FIN7 JSSLoader .net compile payload where it run ipconfig.exe and systeminfo.exe using .net application. + This event cause some good TTP since those tool are commonly run in commandline not by another application. + This TTP is a good indicator for application gather host information either an attacker or an automated tool made by admin. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name = "ipconfig.exe" OR Processes.process_name = "systeminfo.exe") + AND NOT (Processes.parent_process_name = "cmd.exe" OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name = "explorer.exe") + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process_id Processes.process Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `cmdline_tool_not_executed_in_cmd_shell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network operator or admin may create this type of tool to gather host information +references: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ +tags: + analytic_story: + - FIN7 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.007 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Execution + message: parent rrocess name $parent_process_name$ with child process $process_name$ to execute commandline tool in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml index 2c3fb9e542..9fc9fed36f 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/office_application_drop_executable.yml @@ -2,7 +2,7 @@ name: Office Application Drop Executable id: 73ce70c4-146d-11ec-9184-acde48001122 version: 1 date: '2021-09-13' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Michael Haag Splunk type: TTP datamodel: - Endpoint @@ -10,11 +10,16 @@ description: This search is to detect a suspicious MS office application that dr This behavior is commonly seen in spear phishing office attachment where it drop malicious files or script to compromised the host. It might be some normal macro may drop script or tools as part of automation but still this behavior is reallly suspicious and not commonly seen in normal office application -search: '`sysmon` EventCode=11 Image IN ("*\\winword.exe","*\\excel.exe","*\\powerpnt.exe","*\\mspub.exe","*\\visio.exe","*\\wordpad.exe","*\\wordview.exe") - TargetFilename IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1") AND NOT(TargetFilename IN ("*\\program files*","*\\windows\\*")) - | stats count min(_time) as firstTime max(_time) as lastTime by Image TargetFilename ProcessGuid dest user_id - | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest + | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1") + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time + file_name file_path process_name process_path process] | dedup file_create_time + | table dest, process_name, process, file_create_time, file_name, file_path | `office_application_drop_executable_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/tests/endpoint/check_elevated_cmd_using_whoami.test.yml b/tests/endpoint/check_elevated_cmd_using_whoami.test.yml new file mode 100644 index 0000000000..c1b40a097d --- /dev/null +++ b/tests/endpoint/check_elevated_cmd_using_whoami.test.yml @@ -0,0 +1,12 @@ +name: Check Elevated CMD using whoami Unit Test +tests: +- name: Check Elevated CMD using whoami + file: endpoint/check_elevated_cmd_using_whoami.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/cmdline_tool_not_executed_in_cmd_shell.test.yml b/tests/endpoint/cmdline_tool_not_executed_in_cmd_shell.test.yml new file mode 100644 index 0000000000..3f05089116 --- /dev/null +++ b/tests/endpoint/cmdline_tool_not_executed_in_cmd_shell.test.yml @@ -0,0 +1,12 @@ +name: Cmdline Tool Not Executed In CMD Shell Unit Test +tests: +- name: Cmdline Tool Not Executed In CMD Shell + file: endpoint/cmdline_tool_not_executed_in_cmd_shell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From f764f730ecc0fadfc7a9a80ba51834dc835ec9e2 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 16 Sep 2021 16:04:40 +0200 Subject: [PATCH 11/29] fin7 --- detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml index 79f3eacfac..862998dc7e 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -56,7 +56,7 @@ tags: context: - Source:Endpoint - Stage:Execution - message: parent rrocess name $parent_process_name$ with child process $process_name$ to execute commandline tool in $dest$ + message: parent process name $parent_process_name$ with child process $process_name$ to execute commandline tool in $dest$ observable: - name: dest type: Endpoint From 2480f3c4b755b6d2e6958fe1d368512ff2a245e0 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 16 Sep 2021 16:45:49 +0200 Subject: [PATCH 12/29] fin7 --- detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml index 862998dc7e..db47262eaa 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -30,7 +30,7 @@ tags: analytic_story: - FIN7 dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: From cbb2198d658b33f253113953d3c783b98c283173 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 16 Sep 2021 14:48:10 +0000 Subject: [PATCH 13/29] Added detection testing service results inOffice Application Drop Executable --- .../endpoint/office_application_drop_executable.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml index d62610abd0..4433406cb0 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/office_application_drop_executable.yml @@ -6,10 +6,12 @@ author: Teoderick Contreras, Michael Haag Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a suspicious MS office application that drop or create executables or script in the host. - This behavior is commonly seen in spear phishing office attachment where it drop malicious files or script to compromised the host. - It might be some normal macro may drop script or tools as part of automation but still this behavior is reallly suspicious and not commonly seen - in normal office application +description: This search is to detect a suspicious MS office application that drop + or create executables or script in the host. This behavior is commonly seen in spear + phishing office attachment where it drop malicious files or script to compromised + the host. It might be some normal macro may drop script or tools as part of automation + but still this behavior is reallly suspicious and not commonly seen in normal office + application search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest @@ -19,8 +21,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process] | dedup file_create_time - | table dest, process_name, process, file_create_time, file_name, file_path - | `office_application_drop_executable_filter`' + | table dest, process_name, process, file_create_time, file_name, file_path | `office_application_drop_executable_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the From d03f534e68d1f93a393e2a4cb60f4af1e15c6f47 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 16 Sep 2021 16:56:51 +0200 Subject: [PATCH 14/29] fin7 --- tests/endpoint/cmdline_tool_not_executed_in_cmd_shell.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/cmdline_tool_not_executed_in_cmd_shell.test.yml b/tests/endpoint/cmdline_tool_not_executed_in_cmd_shell.test.yml index 3f05089116..2b12437eaa 100644 --- a/tests/endpoint/cmdline_tool_not_executed_in_cmd_shell.test.yml +++ b/tests/endpoint/cmdline_tool_not_executed_in_cmd_shell.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file From 1daee13b117a9d0b231ada1012d1ee245fee6c85 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 16 Sep 2021 15:17:07 +0000 Subject: [PATCH 15/29] Added detection testing service results inCheck Elevated CMD using whoami --- .../check_elevated_cmd_using_whoami.yml | 29 ++++++++++--------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml index c76aa74ebd..903c9a0963 100644 --- a/detections/endpoint/check_elevated_cmd_using_whoami.yml +++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml @@ -6,17 +6,19 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a suspicious whoami execution to check if the cmd or shell instance process is with elevated privileges. - This technique was seen in FIN7 js implant where it execute this as part of its data collection to the infected machine to check if the running shell - cmd process is elevated or not. This TTP is really a good alert for known attacker that recon on the targetted host. This command is not so commonly - executed by a normal user or even an admin to check if a process is elevated. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process = "*whoami*" Processes.process = "*/group*" Processes.process = "* find *" Processes.process = "*12288*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `check_elevated_cmd_using_whoami_filter`' +description: This search is to detect a suspicious whoami execution to check if the + cmd or shell instance process is with elevated privileges. This technique was seen + in FIN7 js implant where it execute this as part of its data collection to the infected + machine to check if the running shell cmd process is elevated or not. This TTP is + really a good alert for known attacker that recon on the targetted host. This command + is not so commonly executed by a normal user or even an admin to check if a process + is elevated. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process = "*whoami*" + Processes.process = "*/group*" Processes.process = "* find *" Processes.process + = "*12288*" by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `check_elevated_cmd_using_whoami_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -46,11 +48,10 @@ tags: - Processes.process_id - Processes.process - Processes.dest - - Processes.user + - Processes.user security_domain: endpoint impact: 70 confidence: 80 - # (impact * confidence)/100 risk_score: 56 context: - Source:Endpoint @@ -65,4 +66,4 @@ tags: type: User role: - Victim - \ No newline at end of file + automated_detection_testing: passed From dc9047367922c7a74bdc22b4604884e68f2252a6 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 16 Sep 2021 15:43:53 +0000 Subject: [PATCH 16/29] Added detection testing service results inCmdline Tool Not Executed In CMD Shell --- ...cmdline_tool_not_executed_in_cmd_shell.yml | 38 ++++++++++--------- 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml index db47262eaa..525a611f80 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -6,23 +6,25 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a suspicious parent process execution of commandline tool not in shell commandline. - This technique was seen in FIN7 JSSLoader .net compile payload where it run ipconfig.exe and systeminfo.exe using .net application. - This event cause some good TTP since those tool are commonly run in commandline not by another application. - This TTP is a good indicator for application gather host information either an attacker or an automated tool made by admin. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processes.process_name = "ipconfig.exe" OR Processes.process_name = "systeminfo.exe") - AND NOT (Processes.parent_process_name = "cmd.exe" OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name = "explorer.exe") - by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process_id Processes.process Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `cmdline_tool_not_executed_in_cmd_shell_filter`' +description: This search is to detect a suspicious parent process execution of commandline + tool not in shell commandline. This technique was seen in FIN7 JSSLoader .net compile + payload where it run ipconfig.exe and systeminfo.exe using .net application. This + event cause some good TTP since those tool are commonly run in commandline not by + another application. This TTP is a good indicator for application gather host information + either an attacker or an automated tool made by admin. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "ipconfig.exe" + OR Processes.process_name = "systeminfo.exe") AND NOT (Processes.parent_process_name + = "cmd.exe" OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name + = "explorer.exe") by Processes.parent_process_name Processes.parent_process Processes.process_name + Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmdline_tool_not_executed_in_cmd_shell_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: network operator or admin may create this type of tool to gather host information + Sysmon TA. +known_false_positives: network operator or admin may create this type of tool to gather + host information references: - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html - https://attack.mitre.org/groups/G0046/ @@ -47,16 +49,16 @@ tags: - Processes.process_id - Processes.process - Processes.dest - - Processes.user + - Processes.user security_domain: endpoint impact: 70 confidence: 80 - # (impact * confidence)/100 risk_score: 56 context: - Source:Endpoint - Stage:Execution - message: parent process name $parent_process_name$ with child process $process_name$ to execute commandline tool in $dest$ + message: parent process name $parent_process_name$ with child process $process_name$ + to execute commandline tool in $dest$ observable: - name: dest type: Endpoint @@ -66,4 +68,4 @@ tags: type: User role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 68c31b3c31c5ec3de912d76cce996767d1c35b3e Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 17 Sep 2021 09:39:45 +0200 Subject: [PATCH 17/29] fin7 --- ..._scripting_process_loading_ldap_module.yml | 61 +++++++++++++++++++ ...s_scripting_process_loading_wmi_module.yml | 61 +++++++++++++++++++ ...ripting_process_lading_wmi_module.test.yml | 15 +++++ ...pting_process_loading_ldap_module.test.yml | 12 ++++ 4 files changed, 149 insertions(+) create mode 100644 detections/endpoint/ms_scripting_process_loading_ldap_module.yml create mode 100644 detections/endpoint/ms_scripting_process_loading_wmi_module.yml create mode 100644 tests/endpoint/ms_scripting_process_lading_wmi_module.test.yml create mode 100644 tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml new file mode 100644 index 0000000000..72e12288e5 --- /dev/null +++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml @@ -0,0 +1,61 @@ +name: MS Scripting Process Loading Ldap Module +id: 0b0c40dc-14a6-11ec-b267-acde48001122 +version: 1 +date: '2021-09-13' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading ldap module to process + ldap query. This behavior was seen in FIN7 implant where it uses javascript to execute ldap query to parse host information that will send to its C2 + server. this anomaly detections is a good initial step to hunt further a suspicious ldap query or ldap related events to the host that may + give you good information regarding ldap or AD information processing or might be a attacker. +search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") +| stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count + by Image EventCode process_name ProcessId ProcessGuid Computer | where count >= 2 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `ms_scripting_process_loading_wmi_module_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: automation scripting language may used by network operator to do ldap query. +references: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ +tags: + analytic_story: + - FIN7 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.007 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - EventCode + - process_name + - ProcessId + - ProcessGuid + - Computer + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Execution + message: $process_name$ loading ldap modules $ImageLoaded$ in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml new file mode 100644 index 0000000000..52474819f9 --- /dev/null +++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml @@ -0,0 +1,61 @@ +name: MS Scripting Process Loading WMI Module +id: 2eba3d36-14a6-11ec-a682-acde48001122 +version: 1 +date: '2021-09-13' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading wmi module to process + wmi query. This behavior was seen in FIN7 implant where it uses javascript to execute wmi query to parse host information that will send to its C2 + server. this anomaly detections is a good initial step to hunt further a suspicious wmi query or wmi related events to the host that may + give you good information regarding process that are commonly using wmi query or modules or might be an attacker using this technique. +search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" , "*\\wmiutils.dll", "*\\wbemcomn.dll") +| stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count + by Image EventCode process_name ProcessId ProcessGuid Computer | where count >= 5 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `ms_scripting_process_loading_ldap_module_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: automation scripting language may used by network operator to do ldap query. +references: +- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html +- https://attack.mitre.org/groups/G0046/ +tags: + analytic_story: + - FIN7 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.007 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - EventCode + - process_name + - ProcessId + - ProcessGuid + - Computer + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Execution + message: $process_name$ loading wmi modules $ImageLoaded$ in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/ms_scripting_process_lading_wmi_module.test.yml b/tests/endpoint/ms_scripting_process_lading_wmi_module.test.yml new file mode 100644 index 0000000000..532ea0015c --- /dev/null +++ b/tests/endpoint/ms_scripting_process_lading_wmi_module.test.yml @@ -0,0 +1,15 @@ +name: MS Scripting Process Lading WMI Module Unit Test +tests: +- name: MS Scripting Process Lading WMI Module + file: endpoint/ms_scripting_process_lading_wmi_module.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + + \ No newline at end of file diff --git a/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml b/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml new file mode 100644 index 0000000000..848f6c5d1d --- /dev/null +++ b/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml @@ -0,0 +1,12 @@ +name: MS Scripting Process Loading Ldap Module Unit Test +tests: +- name: MS Scripting Process Loading Ldap Module + file: endpoint/ms_scripting_process_loading_ldap_module.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 12d15d17e35f859e22315a9a13f53f2bbb982bd5 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 17 Sep 2021 09:49:27 +0200 Subject: [PATCH 18/29] fin7 --- ...yml => ms_scripting_process_loading_wmi_module.test.yml} | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) rename tests/endpoint/{ms_scripting_process_lading_wmi_module.test.yml => ms_scripting_process_loading_wmi_module.test.yml} (69%) diff --git a/tests/endpoint/ms_scripting_process_lading_wmi_module.test.yml b/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml similarity index 69% rename from tests/endpoint/ms_scripting_process_lading_wmi_module.test.yml rename to tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml index 532ea0015c..1119b78e24 100644 --- a/tests/endpoint/ms_scripting_process_lading_wmi_module.test.yml +++ b/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml @@ -1,7 +1,7 @@ -name: MS Scripting Process Lading WMI Module Unit Test +name: MS Scripting Process Loading WMI Module Unit Test tests: -- name: MS Scripting Process Lading WMI Module - file: endpoint/ms_scripting_process_lading_wmi_module.yml +- name: MS Scripting Process Loading WMI Module + file: endpoint/ms_scripting_process_loading_wmi_module.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From bb3a0f2d88ccaa062839a7fb65a80ada1e48191c Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 17 Sep 2021 09:55:04 +0200 Subject: [PATCH 19/29] fin7 --- .../endpoint/ms_scripting_process_loading_ldap_module.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml index 72e12288e5..c595553346 100644 --- a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml @@ -15,7 +15,7 @@ search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") Ima by Image EventCode process_name ProcessId ProcessGuid Computer | where count >= 2 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `ms_scripting_process_loading_wmi_module_filter`' + | `ms_scripting_process_loading_ldap_module_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the From f9360d885182fd65db419c087bd4cb0a59095cc1 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 17 Sep 2021 09:59:49 +0200 Subject: [PATCH 20/29] fin7 --- detections/endpoint/ms_scripting_process_loading_wmi_module.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml index 52474819f9..e59d3ee277 100644 --- a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml @@ -15,7 +15,7 @@ search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") Ima by Image EventCode process_name ProcessId ProcessGuid Computer | where count >= 5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `ms_scripting_process_loading_ldap_module_filter`' + | `ms_scripting_process_loading_wmi_module_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the From 68ba204036d6ecaabf02b3c7801b95a41ab5f28c Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 17 Sep 2021 11:06:52 +0200 Subject: [PATCH 21/29] fin7 --- .../endpoint/ms_scripting_process_loading_ldap_module.yml | 4 ++-- .../endpoint/ms_scripting_process_loading_wmi_module.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml index c595553346..09251aed16 100644 --- a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml @@ -11,8 +11,8 @@ description: This search is to detect a suspicious MS scripting process such as server. this anomaly detections is a good initial step to hunt further a suspicious ldap query or ldap related events to the host that may give you good information regarding ldap or AD information processing or might be a attacker. search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") -| stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count - by Image EventCode process_name ProcessId ProcessGuid Computer | where count >= 2 +| stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count as NumberOfLoadedModules + by Image EventCode process_name ProcessId ProcessGuid Computer | where NumberOfLoadedModules >= 2 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_ldap_module_filter`' diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml index e59d3ee277..65f370f372 100644 --- a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml @@ -11,8 +11,8 @@ description: This search is to detect a suspicious MS scripting process such as server. this anomaly detections is a good initial step to hunt further a suspicious wmi query or wmi related events to the host that may give you good information regarding process that are commonly using wmi query or modules or might be an attacker using this technique. search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" , "*\\wmiutils.dll", "*\\wbemcomn.dll") -| stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count - by Image EventCode process_name ProcessId ProcessGuid Computer | where count >= 5 +| stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count as NumberOfLoadedModules + by Image EventCode process_name ProcessId ProcessGuid Computer | where NumberOfLoadedModules >= 5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_wmi_module_filter`' From 9a5907c2b0a37165c572d08c4f79a977a36ae555 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 17 Sep 2021 12:31:03 +0200 Subject: [PATCH 22/29] fin7 --- .../endpoint/ms_scripting_process_loading_ldap_module.test.yml | 2 +- tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml b/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml index 848f6c5d1d..923eca488e 100644 --- a/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml +++ b/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml @@ -3,7 +3,7 @@ tests: - name: MS Scripting Process Loading Ldap Module file: endpoint/ms_scripting_process_loading_ldap_module.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' + earliest_time: '-365d' latest_time: 'now' attack_data: - file_name: sysmon.log diff --git a/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml b/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml index 1119b78e24..de9fde4bc7 100644 --- a/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml +++ b/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml @@ -3,7 +3,7 @@ tests: - name: MS Scripting Process Loading WMI Module file: endpoint/ms_scripting_process_loading_wmi_module.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' + earliest_time: '-365d' latest_time: 'now' attack_data: - file_name: sysmon.log From 0b7a836e4354bcafe04f9ae1bbe588e4cf29c176 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 20 Sep 2021 10:33:09 +0200 Subject: [PATCH 23/29] fin7 --- .../endpoint/ms_scripting_process_loading_ldap_module.yml | 2 +- detections/endpoint/ms_scripting_process_loading_wmi_module.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml index 09251aed16..d265607267 100644 --- a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml @@ -11,7 +11,7 @@ description: This search is to detect a suspicious MS scripting process such as server. this anomaly detections is a good initial step to hunt further a suspicious ldap query or ldap related events to the host that may give you good information regarding ldap or AD information processing or might be a attacker. search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") -| stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count as NumberOfLoadedModules + | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count as NumberOfLoadedModules by Image EventCode process_name ProcessId ProcessGuid Computer | where NumberOfLoadedModules >= 2 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml index 65f370f372..da7676cbfb 100644 --- a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml @@ -11,7 +11,7 @@ description: This search is to detect a suspicious MS scripting process such as server. this anomaly detections is a good initial step to hunt further a suspicious wmi query or wmi related events to the host that may give you good information regarding process that are commonly using wmi query or modules or might be an attacker using this technique. search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" , "*\\wmiutils.dll", "*\\wbemcomn.dll") -| stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count as NumberOfLoadedModules + | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count as NumberOfLoadedModules by Image EventCode process_name ProcessId ProcessGuid Computer | where NumberOfLoadedModules >= 5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 6e0789be3ee929671c781e00a5561d1e054dd643 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 20 Sep 2021 11:35:38 +0200 Subject: [PATCH 24/29] fin7 --- .../endpoint/ms_scripting_process_loading_ldap_module.yml | 2 +- detections/endpoint/ms_scripting_process_loading_wmi_module.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml index d265607267..079e8925c2 100644 --- a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml @@ -28,7 +28,7 @@ tags: analytic_story: - FIN7 dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/ldap_module_loaded_sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml index da7676cbfb..b24d5a6102 100644 --- a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml @@ -28,7 +28,7 @@ tags: analytic_story: - FIN7 dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/wmi_module_loaded_sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: From bbcaf7a93b2b07a6c12b5d14b53d13bdfccee1f6 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 20 Sep 2021 11:37:07 +0200 Subject: [PATCH 25/29] fin7 --- .../endpoint/ms_scripting_process_loading_ldap_module.test.yml | 2 +- tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml b/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml index 923eca488e..aba42645ad 100644 --- a/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml +++ b/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/ldap_module_loaded_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml b/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml index de9fde4bc7..a789671737 100644 --- a/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml +++ b/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' attack_data: - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/wmi_module_loaded_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog From 4ed026fa3532db6a40eb44f957d4501b0fc6b7a6 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 20 Sep 2021 12:22:12 +0200 Subject: [PATCH 26/29] fin7 --- .../endpoint/ms_scripting_process_loading_ldap_module.test.yml | 2 +- tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml b/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml index aba42645ad..ce023d39b9 100644 --- a/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml +++ b/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-365d' latest_time: 'now' attack_data: - - file_name: sysmon.log + - file_name: ldap_module_loaded_sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/ldap_module_loaded_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml b/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml index a789671737..3515bb490e 100644 --- a/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml +++ b/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-365d' latest_time: 'now' attack_data: - - file_name: sysmon.log + - file_name: wmi_module_loaded_sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/wmi_module_loaded_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog From 5a703824666e0a0a72d9654e77ae630f8884dcbd Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 20 Sep 2021 15:21:53 +0200 Subject: [PATCH 27/29] fin7 --- .../endpoint/ms_scripting_process_loading_ldap_module.yml | 7 ++++--- .../endpoint/ms_scripting_process_loading_wmi_module.yml | 7 ++++--- .../ms_scripting_process_loading_ldap_module.test.yml | 8 ++++---- .../ms_scripting_process_loading_wmi_module.test.yml | 8 ++++---- 4 files changed, 16 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml index 079e8925c2..b5e03b3403 100644 --- a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml @@ -11,8 +11,8 @@ description: This search is to detect a suspicious MS scripting process such as server. this anomaly detections is a good initial step to hunt further a suspicious ldap query or ldap related events to the host that may give you good information regarding ldap or AD information processing or might be a attacker. search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") - | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count as NumberOfLoadedModules - by Image EventCode process_name ProcessId ProcessGuid Computer | where NumberOfLoadedModules >= 2 + | stats min(_time) as firstTime max(_time) as lastTime count + by Image EventCode process_name ProcessId ProcessGuid Computer ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_ldap_module_filter`' @@ -28,7 +28,7 @@ tags: analytic_story: - FIN7 dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/ldap_module_loaded_sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -45,6 +45,7 @@ tags: - ProcessId - ProcessGuid - Computer + - ImageLoaded security_domain: endpoint impact: 30 confidence: 30 diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml index b24d5a6102..242b7ffa27 100644 --- a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml @@ -11,8 +11,8 @@ description: This search is to detect a suspicious MS scripting process such as server. this anomaly detections is a good initial step to hunt further a suspicious wmi query or wmi related events to the host that may give you good information regarding process that are commonly using wmi query or modules or might be an attacker using this technique. search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" , "*\\wmiutils.dll", "*\\wbemcomn.dll") - | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count as NumberOfLoadedModules - by Image EventCode process_name ProcessId ProcessGuid Computer | where NumberOfLoadedModules >= 5 + | stats min(_time) as firstTime max(_time) as lastTime count + by Image EventCode process_name ProcessId ProcessGuid Computer ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_wmi_module_filter`' @@ -28,7 +28,7 @@ tags: analytic_story: - FIN7 dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/wmi_module_loaded_sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -45,6 +45,7 @@ tags: - ProcessId - ProcessGuid - Computer + - ImageLoaded security_domain: endpoint impact: 30 confidence: 30 diff --git a/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml b/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml index ce023d39b9..3e60648541 100644 --- a/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml +++ b/tests/endpoint/ms_scripting_process_loading_ldap_module.test.yml @@ -2,11 +2,11 @@ name: MS Scripting Process Loading Ldap Module Unit Test tests: - name: MS Scripting Process Loading Ldap Module file: endpoint/ms_scripting_process_loading_ldap_module.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-365d' + pass_condition: '| stats count | where count >= 2' + earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: ldap_module_loaded_sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/ldap_module_loaded_sysmon.log + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml b/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml index 3515bb490e..df5d0a537c 100644 --- a/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml +++ b/tests/endpoint/ms_scripting_process_loading_wmi_module.test.yml @@ -2,12 +2,12 @@ name: MS Scripting Process Loading WMI Module Unit Test tests: - name: MS Scripting Process Loading WMI Module file: endpoint/ms_scripting_process_loading_wmi_module.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-365d' + pass_condition: '| stats count | where count >=5' + earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: wmi_module_loaded_sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/wmi_module_loaded_sysmon.log + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog From 5d8af6f24231283d1230759bb165c1e7bd64efa4 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 20 Sep 2021 13:41:30 +0000 Subject: [PATCH 28/29] Added detection testing service results inMS Scripting Process Loading WMI Module --- ...s_scripting_process_loading_wmi_module.yml | 34 +++++++++++-------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml index 242b7ffa27..930a359778 100644 --- a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml @@ -6,21 +6,25 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading wmi module to process - wmi query. This behavior was seen in FIN7 implant where it uses javascript to execute wmi query to parse host information that will send to its C2 - server. this anomaly detections is a good initial step to hunt further a suspicious wmi query or wmi related events to the host that may - give you good information regarding process that are commonly using wmi query or modules or might be an attacker using this technique. -search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" , "*\\wmiutils.dll", "*\\wbemcomn.dll") - | stats min(_time) as firstTime max(_time) as lastTime count - by Image EventCode process_name ProcessId ProcessGuid Computer ImageLoaded - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect a suspicious MS scripting process such as wscript.exe + or cscript.exe that loading wmi module to process wmi query. This behavior was seen + in FIN7 implant where it uses javascript to execute wmi query to parse host information + that will send to its C2 server. this anomaly detections is a good initial step + to hunt further a suspicious wmi query or wmi related events to the host that may + give you good information regarding process that are commonly using wmi query or + modules or might be an attacker using this technique. +search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded + IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" , + "*\\wmiutils.dll", "*\\wbemcomn.dll") | stats min(_time) as firstTime max(_time) + as lastTime count by Image EventCode process_name ProcessId ProcessGuid Computer + ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_wmi_module_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: automation scripting language may used by network operator to do ldap query. +known_false_positives: automation scripting language may used by network operator + to do ldap query. references: - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html - https://attack.mitre.org/groups/G0046/ @@ -44,14 +48,13 @@ tags: - process_name - ProcessId - ProcessGuid - - Computer + - Computer - ImageLoaded security_domain: endpoint impact: 30 - confidence: 30 - # (impact * confidence)/100 + confidence: 30 risk_score: 9 - context: + context: - Source:Endpoint - Stage:Execution message: $process_name$ loading wmi modules $ImageLoaded$ in $dest$ @@ -59,4 +62,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From f4d532b6a2736c150e0032844df6f2773b00bebc Mon Sep 17 00:00:00 2001 From: root Date: Mon, 20 Sep 2021 13:42:55 +0000 Subject: [PATCH 29/29] Added detection testing service results inMS Scripting Process Loading Ldap Module --- ..._scripting_process_loading_ldap_module.yml | 33 ++++++++++--------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml index b5e03b3403..09746b2012 100644 --- a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml @@ -6,21 +6,24 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading ldap module to process - ldap query. This behavior was seen in FIN7 implant where it uses javascript to execute ldap query to parse host information that will send to its C2 - server. this anomaly detections is a good initial step to hunt further a suspicious ldap query or ldap related events to the host that may - give you good information regarding ldap or AD information processing or might be a attacker. -search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") - | stats min(_time) as firstTime max(_time) as lastTime count - by Image EventCode process_name ProcessId ProcessGuid Computer ImageLoaded - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect a suspicious MS scripting process such as wscript.exe + or cscript.exe that loading ldap module to process ldap query. This behavior was + seen in FIN7 implant where it uses javascript to execute ldap query to parse host + information that will send to its C2 server. this anomaly detections is a good initial + step to hunt further a suspicious ldap query or ldap related events to the host + that may give you good information regarding ldap or AD information processing or + might be a attacker. +search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded + IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") | stats min(_time) as firstTime + max(_time) as lastTime count by Image EventCode process_name ProcessId ProcessGuid + Computer ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_ldap_module_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: automation scripting language may used by network operator to do ldap query. +known_false_positives: automation scripting language may used by network operator + to do ldap query. references: - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html - https://attack.mitre.org/groups/G0046/ @@ -44,14 +47,13 @@ tags: - process_name - ProcessId - ProcessGuid - - Computer + - Computer - ImageLoaded security_domain: endpoint impact: 30 - confidence: 30 - # (impact * confidence)/100 + confidence: 30 risk_score: 9 - context: + context: - Source:Endpoint - Stage:Execution message: $process_name$ loading ldap modules $ImageLoaded$ in $dest$ @@ -59,4 +61,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed