diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml index ea81a3a6df..1564b9ae86 100644 --- a/detections/endpoint/disabling_defender_services.yml +++ b/detections/endpoint/disabling_defender_services.yml @@ -37,6 +37,7 @@ tags: analytic_story: - IcedID - Windows Registry Abuse + - RedLine Stealer asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml new file mode 100644 index 0000000000..fc7f609281 --- /dev/null +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml @@ -0,0 +1,60 @@ +name: Windows Credentials from Password Stores Chrome Extension Access +id: 2e65afe0-9a75-4487-bd87-ada9a9f1b9af +version: 1 +date: '2023-04-26' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Security Event ID 4663 +description: The following analytic identifies a non-chrome process accessing Chrome extensions file. + This file stores various settings and information related to the browser's extensions on your computer. Threat actor, adversaries and malware author + also abused this file to attempt to extract sensitive information from the chrome browser of the target host. + This anomaly detection can be a good pivot of analysis for suspicious process aside from chrome.exe and explorer.exe executable. +search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*" + AND NOT (process_path IN ("*:\\Windows\\explorer.exe", "*\\chrome.exe")) + | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_credentials_from_password_stores_chrome_extension_access_filter`' +how_to_implement: To successfully implement this search, you must ingest Windows Security + Event logs and track event code 4663. For 4663, enable "Audit Object Access" in + Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: Uninstall chrome browser extension application may access this file and folder path to removed chrome installation in the target host. Filter is needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 50 + impact: 50 + message: A non-chrome process $process_name$ accessing chrome browser extension folder files on $dest$ + mitre_attack_id: + - T1012 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - object_file_name + - object_file_path + - process_name + - process_path + - process_id + - EventCode + - dest + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/browser_ext_access/security-ext-raw.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml new file mode 100644 index 0000000000..535824e170 --- /dev/null +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -0,0 +1,60 @@ +name: Windows Credentials from Password Stores Chrome LocalState Access +id: 3b1d09a8-a26f-473e-a510-6c6613573657 +version: 1 +date: '2023-04-26' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Security Event ID 4663 +description: The following analytic identifies a non-chrome process accessing Chrome user data "local state" file. + This file stores various settings and information related to the browser's operation on your computer. Threat actor, adversaries and malware author + also abused this file to attempt to extract the encrypted master key to decrypt password saved in chrome browser. + This anomaly detection can be a good pivot of analysis for suspicious process aside from chrome.exe and explorer.exe executable. +search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" + NOT (process_name IN ("*\\chrome.exe","*:\\Windows\\explorer.exe")) + | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_credentials_from_password_stores_chrome_localstate_access_filter`' +how_to_implement: To successfully implement this search, you must ingest Windows Security + Event logs and track event code 4663. For 4663, enable "Audit Object Access" in + Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: Uninstall chrome application may access this file and folder path to removed chrome installation in target host. Filter is needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 50 + impact: 50 + message: A non-chrome process $process_name$ accessing "Chrome\\User Data\\Local State" file on $dest$ + mitre_attack_id: + - T1012 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - object_file_name + - object_file_path + - process_name + - process_path + - process_id + - EventCode + - dest + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/chrome_local_state_simulate_access/redline-local-state-security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml new file mode 100644 index 0000000000..a0d9fe42ee --- /dev/null +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -0,0 +1,61 @@ +name: Windows Credentials from Password Stores Chrome Login Data Access +id: 0d32ba37-80fc-4429-809c-0ba15801aeaf +version: 1 +date: '2023-04-27' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Security Event ID 4663 +description: The following analytic identifies a non-chrome process accessing Chrome user data "login data" file. + This sqlite db file stores various information related to the browser's operation on your computer. Threat actor, adversaries and malware author + also abused this file to attempt to extract and decrypt password saved in chrome browser. + This anomaly detection can be a good pivot of analysis for suspicious process aside from chrome.exe and explorer.exe executable. +search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" + AND NOT (process_path IN ("*:\\Windows\\explorer.exe", "*:\\Windows\\System32\\dllhost.exe", "*\\chrome.exe")) + | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_credentials_from_password_stores_chrome_login_data_access_filter`' +how_to_implement: To successfully implement this search, you must ingest Windows Security + Event logs and track event code 4663. For 4663, enable "Audit Object Access" in + Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: Uninstall application may access this registry to remove the entry of the target application. filter is needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 70 + impact: 70 + message: A non-chrome process $process_name$ accessing Chrome "Login Data" file on $dest$ + mitre_attack_id: + - T1012 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - object_file_name + - object_file_path + - process_name + - process_path + - process_id + - EventCode + - dest + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/chrome_login_data_simulate_access/redline-login-data-security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + diff --git a/detections/endpoint/windows_query_registry_browser_list_application.yml b/detections/endpoint/windows_query_registry_browser_list_application.yml new file mode 100644 index 0000000000..36b4f78c04 --- /dev/null +++ b/detections/endpoint/windows_query_registry_browser_list_application.yml @@ -0,0 +1,61 @@ +name: Windows Query Registry Browser List Application +id: 45ebd21c-f4bf-4ced-bd49-d25b6526cebb +version: 1 +date: '2023-04-25' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Security Event ID 4663 +description: The following analytic identifies a suspicious process accessing default internet browsers registry entry. + This registry is used by Windows to store information about default internet browsers installed on a system. + Malware, adversaries or red-teamers can abuse this registry key to collect data about the installed internet browsers and their associated settings. + This information can be used to steal sensitive data such as login credentials, browsing history, and saved passwords. + We observed noise that needs to be filter out so we add several known path of Windows Application to make this detection more stable. +search: '`wineventlog_security` EventCode=4663 object_file_path IN ("*\\SOFTWARE\\Clients\\StartMenuInternet\\*", "*\\SOFTWARE\\Clients\\StartMenuInternet\\*") + AND NOT (process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWow64\\*", "*:\\Program Files*", "*:\\Windows\\*")) + | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_query_registry_browser_list_application_filter`' +how_to_implement: To successfully implement this search, you must ingest Windows Security + Event logs and track event code 4663. For 4663, enable "Audit Object Access" in + Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: uninstall application may access this registry to remove the entry of the target application. filter is needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 50 + impact: 50 + message: A suspicious process accessing installed default browser registry on $dest$ + mitre_attack_id: + - T1012 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - object_file_name + - object_file_path + - process_name + - process_path + - process_id + - EventCode + - dest + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/browser_list/ar3_4663_redline_reg.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_query_registry_uninstall_program_list.yml b/detections/endpoint/windows_query_registry_uninstall_program_list.yml new file mode 100644 index 0000000000..ed5649b780 --- /dev/null +++ b/detections/endpoint/windows_query_registry_uninstall_program_list.yml @@ -0,0 +1,59 @@ +name: Windows Query Registry UnInstall Program List +id: 535fd4fc-7151-4062-9d7e-e896bea77bf6 +version: 1 +date: '2023-04-25' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Security Event ID 4663 +description: The following analytic identifies a suspicious query on uninstall application list in Windows OS registry. + This registry is commonly used by legitimate software to store information about installed applications on a Windows system, such as their name, version, publisher, and installation path. + However, malware, adversaries or even red-teamers can abuse this registry key to retrieve information stored in the "Uninstall" key to gather data about installed applications in the target host. + This Anomaly detection can be a good pivot to detect a possible suspicious process accessing this registry which is not commonly accessed by a normal user. +search: '`wineventlog_security` EventCode=4663 object_file_path="\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*" + | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_query_registry_uninstall_program_list_filter`' +how_to_implement: To successfully implement this search, you must ingest Windows Security + Event logs and track event code 4663. For 4663, enable "Audit Object Access" in + Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: Uninstall application may access this registry to remove the entry of the target application. Filter is needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 50 + impact: 50 + message: A suspicious process $process_name$ accessing uninstall registry on $dest$ + mitre_attack_id: + - T1012 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - object_file_name + - object_file_path + - process_name + - process_path + - process_id + - EventCode + - dest + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/recon_registry/recon-reg-redline-security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_service_stop_win_updates.yml b/detections/endpoint/windows_service_stop_win_updates.yml new file mode 100644 index 0000000000..b8d5271570 --- /dev/null +++ b/detections/endpoint/windows_service_stop_win_updates.yml @@ -0,0 +1,63 @@ +name: Windows Service Stop Win Updates +id: 0dc25c24-6fcf-456f-b08b-dd55a183e4de +version: 1 +date: '2023-04-21' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- System Event ID 7040 +description: The following analytic identifies a windows update service being disabled in Windows OS. + This technique is being abused by adversaries or threat actors to add defense mechanisms to their malware implant in the targeted host. + Disabling windows update will put the compromised host vulnerable in some zero day exploit or even some update features against threats. + RedLine Stealer kills this service as part of its defense evasion mechanism. +search: '`wineventlog_system` EventCode=7040 + (service_name IN ("Update Orchestrator Service for Windows Update", "WaaSMedicSvc", "Windows Update") OR param1 IN ("UsoSvc", "WaaSMedicSvc", "wuauserv")) AND + (param3=disabled OR start_mode = disabled) + | stats count min(_time) as firstTime max(_time) as lastTime by Computer Error_Code service_name start_mode param1 param2 param3 param4 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_service_stop_win_updates_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the Service name, Service File Name Service Start type, and Service Type + from your endpoints (like Windows system.log Event ID 7040) +known_false_positives: Network administrator may disable this services as part of its audit process within the network. Filter is needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 70 + impact: 70 + message: Windows update services $service_name$ was being disabled on $dest$ + mitre_attack_id: + - T1489 + observable: + - name: Computer + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Computer + - EventCode + - Error_Code + - service_name + - start_mode + - param1 + - param2 + - param3 + - param4 + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/win_update_services_stop/system.log + source: XmlWinEventLog:System + sourcetype: XmlWinEventLog