From d99e66f3679f6defcbddba41283e48a4a656f035 Mon Sep 17 00:00:00 2001 From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com> Date: Mon, 11 Jan 2021 12:25:19 -0700 Subject: [PATCH 01/11] T1490 BCDedit T1490 BCDedit --- .../bcdedit_failure_recovery_modification.yml | 34 +++++++++++++++++++ ...dit_failure_recovery_modification.test.yml | 12 +++++++ 2 files changed, 46 insertions(+) create mode 100644 detections/endpoint/bcdedit_failure_recovery_modification.yml create mode 100644 tests/endpoint/bcdedit_failure_recovery_modification.test.yml diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml new file mode 100644 index 0000000000..c9a9117925 --- /dev/null +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -0,0 +1,34 @@ +name: BCDEdit Failure Recovery Modification +id: +version: 1 +date: '2020-12-21' +description: This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery. +how_to_implement: You must be ingesting endpoint data that tracks process activity, + including parent-child relationships from your endpoints to populate the Endpoint + data model in the Processes node. Tune based on parent process names. +type: ESCU +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair +author: Michael Haag, Splunk +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe + Processes.process="*recoveryenabled*" (Processes.process="* no*") by Processes.process_name Processes.process Processes.parent_process_name + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime) | `security_content_ctime(lastTime)` | `bcdedit_failure_recovery_modification_filter`' +known_false_positives: Administrators may modify the boot configuration. +tags: + analytics_story: + - Ryuk Ransomware + - Ransomware + mitre_attack_id: + - T1490 + kill_chain_phases: + - Actions on Objectives + cis20: + - CIS 8 + nist: + - PR.IP + security_domain: endpoint + asset_type: Endpoint + automated_detection_testing: passed + dataset: + - diff --git a/tests/endpoint/bcdedit_failure_recovery_modification.test.yml b/tests/endpoint/bcdedit_failure_recovery_modification.test.yml new file mode 100644 index 0000000000..ae0e287d46 --- /dev/null +++ b/tests/endpoint/bcdedit_failure_recovery_modification.test.yml @@ -0,0 +1,12 @@ +name: BCDEdit Failure Recovery Modification +tests: +- name: BCDEdit Failure Recovery Modification + file: endpoint/bcdedit_failure_recovery_modification.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From def94c46233ee4897f32a28edb67e1409927f6e7 Mon Sep 17 00:00:00 2001 From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com> Date: Mon, 11 Jan 2021 13:57:05 -0700 Subject: [PATCH 02/11] Update bcdedit_failure_recovery_modification.test.yml --- tests/endpoint/bcdedit_failure_recovery_modification.test.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/endpoint/bcdedit_failure_recovery_modification.test.yml b/tests/endpoint/bcdedit_failure_recovery_modification.test.yml index ae0e287d46..331aa85f72 100644 --- a/tests/endpoint/bcdedit_failure_recovery_modification.test.yml +++ b/tests/endpoint/bcdedit_failure_recovery_modification.test.yml @@ -7,6 +7,7 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog + update_timestamp: True \ No newline at end of file From b7d9fb164bcda8f0918a33c96bec9411a32aa800 Mon Sep 17 00:00:00 2001 From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com> Date: Mon, 11 Jan 2021 15:45:45 -0700 Subject: [PATCH 03/11] Update bcdedit_failure_recovery_modification.yml --- detections/endpoint/bcdedit_failure_recovery_modification.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index c9a9117925..dabe62ca91 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -29,6 +29,5 @@ tags: - PR.IP security_domain: endpoint asset_type: Endpoint - automated_detection_testing: passed dataset: - - + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log From 723d3dac11428cfd5c2828c0faffbb6a56edde1a Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Mon, 11 Jan 2021 17:51:42 -0500 Subject: [PATCH 04/11] minor syntax error --- detections/endpoint/bcdedit_failure_recovery_modification.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index dabe62ca91..bb42818422 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -13,7 +13,7 @@ author: Michael Haag, Splunk search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe Processes.process="*recoveryenabled*" (Processes.process="* no*") by Processes.process_name Processes.process Processes.parent_process_name - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime) | `security_content_ctime(lastTime)` | `bcdedit_failure_recovery_modification_filter`' + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bcdedit_failure_recovery_modification_filter`' known_false_positives: Administrators may modify the boot configuration. tags: analytics_story: From a2fa25f9bc13fdf981e9b008dbd85dd118f082d2 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 11 Jan 2021 23:08:28 +0000 Subject: [PATCH 05/11] Added detection testing service results inBCDEdit Failure Recovery Modification --- .../bcdedit_failure_recovery_modification.yml | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index bb42818422..84898da41b 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -1,8 +1,10 @@ name: BCDEdit Failure Recovery Modification -id: +id: null version: 1 date: '2020-12-21' -description: This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery. +description: This search looks for flags passed to bcdedit.exe modifications to the + built-in Windows error recovery boot configurations. This is typically used by ransomware + to prevent recovery. how_to_implement: You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. Tune based on parent process names. @@ -12,9 +14,11 @@ references: author: Michael Haag, Splunk search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe - Processes.process="*recoveryenabled*" (Processes.process="* no*") by Processes.process_name Processes.process Processes.parent_process_name - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bcdedit_failure_recovery_modification_filter`' -known_false_positives: Administrators may modify the boot configuration. + Processes.process="*recoveryenabled*" (Processes.process="* no*") by Processes.process_name + Processes.process Processes.parent_process_name Processes.dest Processes.user | + `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `bcdedit_failure_recovery_modification_filter`' +known_false_positives: Administrators may modify the boot configuration. tags: analytics_story: - Ryuk Ransomware @@ -31,3 +35,4 @@ tags: asset_type: Endpoint dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log + automated_detection_testing: passed From 84fef240a13a421a587660e16e82b86a5360f419 Mon Sep 17 00:00:00 2001 From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com> Date: Mon, 11 Jan 2021 16:12:59 -0700 Subject: [PATCH 06/11] Update bcdedit_failure_recovery_modification.yml --- detections/endpoint/bcdedit_failure_recovery_modification.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index 84898da41b..e0a1fe6c70 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -1,5 +1,5 @@ name: BCDEdit Failure Recovery Modification -id: null +id: 809b31d2-5462-11eb-ae93-0242ac130002 version: 1 date: '2020-12-21' description: This search looks for flags passed to bcdedit.exe modifications to the From c99e244a05608196d41e59a369a5343be79cb992 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 12 Jan 2021 14:02:46 +0000 Subject: [PATCH 07/11] Bump boto3 from 1.16.51 to 1.16.52 Bumps [boto3](https://github.com/boto/boto3) from 1.16.51 to 1.16.52. - [Release notes](https://github.com/boto/boto3/releases) - [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst) - [Commits](https://github.com/boto/boto3/compare/1.16.51...1.16.52) Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index ddf157c3ba..2a0129e41a 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -13,7 +13,7 @@ azure-mgmt-core==1.2.2 azure-mgmt-network==17.0.0 azure-mgmt-resource==15.0.0 bcrypt==3.2.0 -boto3==1.16.51 +boto3==1.16.52 botocore==1.19.51 certifi==2020.12.5 cffi==1.14.4 From 905c5cf16a8e9bb5e8263e0890843b165ca3b296 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 12 Jan 2021 14:45:04 +0000 Subject: [PATCH 08/11] Bump s3transfer from 0.3.3 to 0.3.4 Bumps [s3transfer](https://github.com/boto/s3transfer) from 0.3.3 to 0.3.4. - [Release notes](https://github.com/boto/s3transfer/releases) - [Changelog](https://github.com/boto/s3transfer/blob/develop/CHANGELOG.rst) - [Commits](https://github.com/boto/s3transfer/compare/0.3.3...0.3.4) Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 2a0129e41a..9323320ca0 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -65,7 +65,7 @@ pywinrm==0.4.1 PyYAML==5.3.1 requests==2.25.1 requests-ntlm==1.1.0 -s3transfer==0.3.3 +s3transfer==0.3.4 six==1.13.0 smmap==3.0.4 splunk-sdk==1.6.14 From 446ce95cb6fa45c37a268e7f794263ec32bed6b1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 12 Jan 2021 14:45:09 +0000 Subject: [PATCH 09/11] Bump botocore from 1.19.51 to 1.19.52 Bumps [botocore](https://github.com/boto/botocore) from 1.19.51 to 1.19.52. - [Release notes](https://github.com/boto/botocore/releases) - [Changelog](https://github.com/boto/botocore/blob/develop/CHANGELOG.rst) - [Commits](https://github.com/boto/botocore/compare/1.19.51...1.19.52) Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 2a0129e41a..cfb6d3e866 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -14,7 +14,7 @@ azure-mgmt-network==17.0.0 azure-mgmt-resource==15.0.0 bcrypt==3.2.0 boto3==1.16.52 -botocore==1.19.51 +botocore==1.19.52 certifi==2020.12.5 cffi==1.14.4 cfgv==2.0.1 From b803026060357d923ff20fd91f99a16592457114 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 13 Jan 2021 14:03:28 +0000 Subject: [PATCH 10/11] Bump boto3 from 1.16.52 to 1.16.53 Bumps [boto3](https://github.com/boto/boto3) from 1.16.52 to 1.16.53. - [Release notes](https://github.com/boto/boto3/releases) - [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst) - [Commits](https://github.com/boto/boto3/compare/1.16.52...1.16.53) Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 4e71111bc7..d595111547 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -13,7 +13,7 @@ azure-mgmt-core==1.2.2 azure-mgmt-network==17.0.0 azure-mgmt-resource==15.0.0 bcrypt==3.2.0 -boto3==1.16.52 +boto3==1.16.53 botocore==1.19.52 certifi==2020.12.5 cffi==1.14.4 From 5c60992f68b397d01bc0a58e5b2b2bd90bb99301 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 13 Jan 2021 14:44:01 +0000 Subject: [PATCH 11/11] Bump botocore from 1.19.52 to 1.19.53 Bumps [botocore](https://github.com/boto/botocore) from 1.19.52 to 1.19.53. - [Release notes](https://github.com/boto/botocore/releases) - [Changelog](https://github.com/boto/botocore/blob/develop/CHANGELOG.rst) - [Commits](https://github.com/boto/botocore/compare/1.19.52...1.19.53) Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index d595111547..9880d4c85e 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -14,7 +14,7 @@ azure-mgmt-network==17.0.0 azure-mgmt-resource==15.0.0 bcrypt==3.2.0 boto3==1.16.53 -botocore==1.19.52 +botocore==1.19.53 certifi==2020.12.5 cffi==1.14.4 cfgv==2.0.1