From f892cda659f0acde5bfcd2db2b98415ecbd3edb2 Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Mon, 15 Jun 2020 14:28:20 +0200 Subject: [PATCH] testing and update of story Windows Service Abuse --- ...eviously_seen_running_windows_services.yml | 9 +++---- ...irst_time_seen_running_windows_service.yml | 8 +++--- ...ulating_windows_services_registry_keys.yml | 27 +++++++------------ .../sc_exe_manipulating_windows_services.yml | 11 ++------ 4 files changed, 19 insertions(+), 36 deletions(-) diff --git a/baselines/previously_seen_running_windows_services.yml b/baselines/previously_seen_running_windows_services.yml index 457c380a0f..a16c57937f 100644 --- a/baselines/previously_seen_running_windows_services.yml +++ b/baselines/previously_seen_running_windows_services.yml @@ -1,17 +1,16 @@ name: Previously Seen Running Windows Services id: 64ce0ade-cb01-4678-bddd-d31c0b175394 -version: 2 -date: '2020-01-13' +version: 3 +date: '2020-06-15' description: This collects the services that have been started across your entire enterprise. how_to_implement: While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 5.0.0 or above. author: David Dorsey, Splunk -search: '`wineventlog_system` signature_id=7036 | rename param1 as service_name | +search: '`wineventlog_system` EventCode=7036 | rename param1 as service_name | rename param2 as action | search action="running" | stats earliest(_time) as firstTime, - latest(_time) as lastTime by service_name | outputlookup previously_seen_running_windows_services - | stats count' + latest(_time) as lastTime by service_name | outputlookup previously_seen_running_windows_services' tags: analytics_story: - Orangeworm Attack Group diff --git a/detections/first_time_seen_running_windows_service.yml b/detections/first_time_seen_running_windows_service.yml index 7700039828..5643426dd6 100644 --- a/detections/first_time_seen_running_windows_service.yml +++ b/detections/first_time_seen_running_windows_service.yml @@ -1,7 +1,7 @@ name: First Time Seen Running Windows Service id: 823136f2-d755-4b6d-ae04-372b486a5808 -version: 2 -date: '2020-01-13' +version: 3 +date: '2020-06-15' description: This search looks for the first time a Windows service is seen running in your environment. how_to_implement: While this search does not require you to adhere to Splunk CIM, @@ -12,9 +12,9 @@ how_to_implement: While this search does not require you to adhere to Splunk CIM type: ESCU references: [] author: David Dorsey, Splunk -search: '`wineventlog_system` signature_id=7036 | rename param1 as service_name | +search: '`wineventlog_system` EventCode=7036 | rename param1 as service_name | rename param2 as action | search action="running" [ search `wineventlog_system` - signature_id=7036 | rename param1 as service_name | rename param2 as action | search + EventCode=7036 | rename param1 as service_name | rename param2 as action | search action="running" | stats earliest(_time) as firstTime, latest(_time) as lastTime by service_name | inputlookup append=t previously_seen_running_windows_services | stats min(firstTime) as firstTime max(lastTime) as lastTime by service_name | diff --git a/detections/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/reg_exe_manipulating_windows_services_registry_keys.yml index d2aca8b976..1d98e75a92 100644 --- a/detections/reg_exe_manipulating_windows_services_registry_keys.yml +++ b/detections/reg_exe_manipulating_windows_services_registry_keys.yml @@ -1,25 +1,18 @@ name: Reg exe Manipulating Windows Services Registry Keys id: 8470d755-0c13-45b3-bd63-387a373c10cf -version: 2 -date: '2019-03-01' +version: 3 +date: '2020-06-15' description: The search looks for reg.exe modifying registry keys that define Windows services and their configurations. -how_to_implement: To successfully implement this search you need to be ingesting information - on registry changes that include the name of the process responsible for the changes - from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` - nodes. type: ESCU references: [] author: Rico Valdez, Splunk -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime values(Processes.process_name) as process_name values(Processes.parent_process_name) - as parent_process_name values(Processes.user) as user FROM datamodel=Endpoint.Processes - where Processes.process_name = reg.exe by Processes.process_id Processes.dest | - `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | join [| tstats `security_content_summariesonly` values(Registry.registry_path) - as registry_path count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\services\\*" - by Registry.process_id Registry.dest | `drop_dm_object_name("Registry")` | table - process_id dest registry_path] | `reg_exe_manipulating_windows_services_registry_keys_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process_name) as process_name + values(Processes.parent_process_name) as parent_process_name values(Processes.user) as user FROM datamodel=Endpoint.Processes + where Processes.process_name=reg.exe Processes.process=*reg* Processes.process=*add* Processes.process=*Services* + by Processes.process_id Processes.dest Processes.process | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `reg_exe_manipulating_windows_services_registry_keys_filter`' known_false_positives: It is unusual for a service to be created or modified by directly manipulating the registry. However, there may be legitimate instances of this behavior. It is important to validate and investigate, as appropriate. @@ -28,9 +21,7 @@ tags: - Windows Service Abuse - Windows Persistence Techniques mitre_attack_id: - - T1050 - - T1031 - - T1089 + - T1058 kill_chain_phases: - Installation cis20: diff --git a/detections/sc_exe_manipulating_windows_services.yml b/detections/sc_exe_manipulating_windows_services.yml index 78563ec4a4..2301370072 100644 --- a/detections/sc_exe_manipulating_windows_services.yml +++ b/detections/sc_exe_manipulating_windows_services.yml @@ -1,14 +1,9 @@ name: Sc exe Manipulating Windows Services id: f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d -version: 2 -date: '2019-02-27' +version: 3 +date: '2020-06-15' description: This search looks for arguments to sc.exe indicating the creation or modification of a Windows service. -how_to_implement: You must be ingesting data that records process activity from your - hosts to populate the Endpoint data model in the Processes node. You must also be - ingesting logs with both the process name and command line from your endpoints. - The command-line arguments are mapped to the "process" field in the Endpoint data - model. type: ESCU references: [] author: Rico Valdez, Splunk @@ -30,8 +25,6 @@ tags: - Disabling Security Tools mitre_attack_id: - T1050 - - T1031 - - T1089 kill_chain_phases: - Installation cis20: