Merge branch 'develop' into TR-318_mfa

automated_detection_testing/requirements.txt

@@ -13,8 +13,8 @@ azure-mgmt-core==1.2.2
 azure-mgmt-network==17.0.0
 azure-mgmt-resource==15.0.0
 bcrypt==3.2.0
-boto3==1.16.51
-botocore==1.19.51
+boto3==1.16.53
+botocore==1.19.53
 certifi==2020.12.5
 cffi==1.14.4
 cfgv==2.0.1
@@ -65,7 +65,7 @@ pywinrm==0.4.1
 PyYAML==5.3.1
 requests==2.25.1
 requests-ntlm==1.1.0
-s3transfer==0.3.3
+s3transfer==0.3.4
 six==1.13.0
 smmap==3.0.4
 splunk-sdk==1.6.14

detections/endpoint/bcdedit_failure_recovery_modification.yml

@@ -0,0 +1,38 @@
+name: BCDEdit Failure Recovery Modification
+id: 809b31d2-5462-11eb-ae93-0242ac130002
+version: 1
+date: '2020-12-21'
+description: This search looks for flags passed to bcdedit.exe modifications to the
+  built-in Windows error recovery boot configurations. This is typically used by ransomware
+  to prevent recovery.
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints to populate the Endpoint
+  data model in the Processes node. Tune based on parent process names.
+type: ESCU
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe
+  Processes.process="*recoveryenabled*" (Processes.process="* no*") by Processes.process_name
+  Processes.process Processes.parent_process_name Processes.dest Processes.user |
+  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `bcdedit_failure_recovery_modification_filter`'
+known_false_positives: Administrators may modify the boot configuration.
+tags:
+  analytics_story:
+  - Ryuk Ransomware
+  - Ransomware
+  mitre_attack_id:
+  - T1490
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.IP
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

tests/endpoint/bcdedit_failure_recovery_modification.test.yml

@@ -0,0 +1,13 @@
+name: BCDEdit Failure Recovery Modification
+tests:
+- name: BCDEdit Failure Recovery Modification
+  file: endpoint/bcdedit_failure_recovery_modification.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: True