From b185a3c1a9e80e1e93bc00305b78854798df7bc4 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Fri, 7 Feb 2025 13:34:34 -0500 Subject: [PATCH 01/19] Add files via upload --- lookups/windows_suspicious_tasks.csv | 128 +++++++++++++++++++++++++++ lookups/windows_suspicious_tasks.yml | 15 ++++ 2 files changed, 143 insertions(+) create mode 100644 lookups/windows_suspicious_tasks.csv create mode 100644 lookups/windows_suspicious_tasks.yml diff --git a/lookups/windows_suspicious_tasks.csv b/lookups/windows_suspicious_tasks.csv new file mode 100644 index 0000000000..fdb712acae --- /dev/null +++ b/lookups/windows_suspicious_tasks.csv @@ -0,0 +1,128 @@ +task_name,task_command,task_arguments,tool,tool_category,tool_type,link,severity,comment,reference +,*powershell.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*wscript.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*cscript.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*cmd.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*sh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*ksh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*zsh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*bash.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*scrcons.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,*pwsh.exe*,,shell command use,exploitation,greyware_tool,https://attack.mitre.org/techniques/T1053/005/,medium,N/A, +,powershell.exe,*-Command whoami*,whoami,Discovery,greyware_tool,https://github.com/mthcht/awesome-lists,medium,N/A,https://github.com/mthcht/awesome-lists +,powershell.exe,-encodedCommand *,powershell,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,medium,base64 encoded command from a scheduled task,https://github.com/mthcht/awesome-lists +,powershell.exe,-enc *,powershell,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,medium,base64 encoded command from a scheduled task,https://github.com/mthcht/awesome-lists +,cmd.exe,*/c whoami*,whoami,Discovery,greyware_tool,https://github.com/mthcht/awesome-lists,medium,N/A,https://github.com/mthcht/awesome-lists +\area41,C:\_Microsoft\Microsoft.exe,,CryptInject,Malware,offensive_tool,https://github.com/roadwy/DefenderYara/blob/9bbdb7f9fd3513ce30aa69cd1d88830e3cf596ca/Trojan/Win32/CryptInject/Trojan_Win32_CryptInject_PJ_MTB.yar#L36,critical,N/A,https://github.com/mthcht/awesome-lists +\OfficeServicesStatus,*wscript*\public\*,,ISMDoor,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oilrig-uses-ismdoor-variant-possibly-linked-greenbug-threat-group/,high,N/A,https://github.com/mthcht/awesome-lists +\Business Aviation,*wscript*,,Gootloader,Malware,offensive_tool,https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/,critical,N/A,https://github.com/mthcht/awesome-lists +\Destination Branding,*wscript*,,Gootloader,Malware,offensive_tool,https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/,critical,N/A,https://github.com/mthcht/awesome-lists +\InetlSecurityAssistManager,*wscript *,,OopsIE,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/,high,N/A,https://github.com/mthcht/awesome-lists +,*wevtutil.exe,cl *,wevtutil,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,high,clearing event logs with wevtutil.exe,https://github.com/mthcht/awesome-lists +\GoogleUpdateTaskMachineUI,*update.vbs*,,Helminth,Malware,offensive_tool,https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/,high,N/A,https://github.com/mthcht/awesome-lists +\Wow64 Subsystem,*programdata*mswow86.exe*,,NetSupport Manager,RAT,offensive_tool,https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/,medium,N/A,https://github.com/mthcht/awesome-lists +\copy,*powershell.exe*,*Copy-Item*\ProgramData\*,BlackJack,Ransomware,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/blackjack-hacktivists-connection-with-twelve_113959/content.txt#L1515,high,N/A,https://github.com/mthcht/awesome-lists +\def,*powershell.exe*,*Get-MpPreference*,BlackJack,Ransomware,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/blackjack-hacktivists-connection-with-twelve_113959/content.txt#L1515,high,N/A,https://github.com/mthcht/awesome-lists +\FJ_load,*madHcCtrl.exe*,,Danabot,Infostealer,offensive_tool,https://securelist.com/tusk-infostealers-campaign/113367/,high,N/A,https://github.com/mthcht/awesome-lists +\shell,*Invoke-PowerShellTcpRun*,,Schtasks_latmov.bat,Lateral Movement,offensive_tool,https://github.com/S3cur3Th1sSh1t/Creds/blob/f71e780c51fdc2fdabe4e51831fa6289b1bede96/batch/Schtasks_latmov.bat#L2,critical,N/A,https://github.com/mthcht/awesome-lists +*StageProxyOps*,*HTTP-Server.ps1*,,HTTP-Server,Persistence,offensive_tool,https://github.com/NullArray/WinBins-Plus/blob/1e4af04ceaa8085b532757a1331113e919a20f4b/Scripts/persist.cmd#L2,critical,N/A,https://github.com/mthcht/awesome-lists +\GoogleUpdatesTaskMachineUI,*fireeye.vbs*,,Helminth,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oilrig-actors-provide-glimpse-development-testing-efforts/,high,N/A,https://github.com/mthcht/awesome-lists +\MicrosoftEdgeUpdateTaskMachineMS,*EdgeBrowser.cmd*,,MeshAgent,RAT,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/awaken-likho-apt-new-implant-campaign_114101/content.txt#L831,high,N/A,https://github.com/mthcht/awesome-lists +\run1,*cmd.exe*,*/c *\ProgramData\*,BlackJack,Ransomware,offensive_tool,https://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/securelist_com/blackjack-hacktivists-connection-with-twelve_113959/content.txt#L1515,high,N/A,https://github.com/mthcht/awesome-lists +\SecurityAssist,*Certutil*,,OopsIE,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/,high,N/A,https://github.com/mthcht/awesome-lists +\mstask,*C:\temp\*,,Trojan.Win32.BreakWin,Malware,offensive_tool,https://www.sentinelone.com/labs/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll/,critical,N/A,https://github.com/mthcht/awesome-lists +\ReportHealth,*appdata*\srvHealth.exe*,,ISMInjector,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/,high,N/A,https://github.com/mthcht/awesome-lists +,*\Windows\Debug*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the *\Windows\Debug folder,https://github.com/mthcht/awesome-lists +\MicrosoftEdgeUpdateTaskMachineUC,*\users\public\*,,autohotkey,keylogger,offensive_tool,https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/,high,N/A,https://github.com/mthcht/awesome-lists +,*\Users\public*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the Public user profile,https://github.com/mthcht/awesome-lists +,*\Users*\Downloads*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the users Downloads folder,https://github.com/mthcht/awesome-lists +,*\Users*\Documents*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the users Documents folder,https://github.com/mthcht/awesome-lists +,*\Users*\AppData\Roaming*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the roaming folder,https://github.com/mthcht/awesome-lists +,*\Users*\AppData\Local*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the appdata folder,https://github.com/mthcht/awesome-lists +\SystemFailureReporter,*\public\*,,SideTwist Backdoor (APT34),Malware,offensive_tool,https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/,critical,N/A,https://github.com/mthcht/awesome-lists +,*\ProgramData*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,task in the ProgramData folder,https://github.com/mthcht/awesome-lists +\MEGA\MEGAsync Update Task*,*\MEGAupdater.exe,,MEGASync,Data Exfiltration,greyware_tool,https://mega.io/en/desktop,high,N/A,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/L-N/MEGAsync.csv +\WallPaperChangeApp,*\Autoit3\Autoit3.exe*,,OxtaRAT,Malware,offensive_tool,https://research.checkpoint.com/2023/operation-silent-watch-desktop-surveillance-in-azerbaijan-and-armenia/,critical,N/A,https://github.com/mthcht/awesome-lists +,*\AppData\Local\Temp\*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,high,task in the temp folder,https://github.com/mthcht/awesome-lists +\Microsoft_Auto_Scheduler,*\AppData\*,,Kube Ransomware,Ransomware,offensive_tool,https://x.com/ShanHolo/status/1880566701009563915/photo/1,high,N/A,https://github.com/mthcht/awesome-lists +,*:\Windows\Temp\*,,suspicious paths,exploitation,greyware_tool,https://github.com/mthcht/awesome-lists,medium,executable from the temp folder,https://github.com/mthcht/awesome-lists +,*:\windows\system32\calc.exe,,POC,exploitation,greyware_tool,https://x.com/hackingforbeer/status/1719402854085951883,medium,POC schtasks /create /sc minute /tn 'dongs' /tr 'C:\windows\system32\calc.exe',https://github.com/mthcht/awesome-lists +"\tMicNet Work40,",*.vbs*,,AsyncRAT,Malware,offensive_tool,https://any.run/cybersecurity-blog/asyncrat-open-directories-infection-analysis/,critical,AsyncRAT’s Infection samples,https://github.com/mthcht/awesome-lists +\yastcat,,,Wannamine,Cryptominer,offensive_tool,crowdstrike.com/blog/cryptomining-harmless-nuisance-disruptive-threat/,critical,Moonero miner - command SCHTASKS /create /RU System /SC DAILY /TN yastcat /f /TR %temp%\y1.bat &&SCHTASKS /run /TN yastcat,https://github.com/mthcht/awesome-lists +\OneNote 4726,,,Unkown,Malware,offensive_tool,https://x.com/Gi7w0rm/status/1864307803914981837,medium,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeAll,,,Trojan.Win32.BreakWin,Malware,offensive_tool,https://www.sentinelone.com/labs/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll/,critical,N/A,https://github.com/mthcht/awesome-lists +\dongs,,,suspicious names,exploitation,offensive_tool,https://x.com/hackingforbeer/status/1719402854085951883,medium,POC schtasks /create /sc minute /tn 'dongs' /tr 'C:\windows\system32\calc.exe',https://github.com/mthcht/awesome-lists +\StopVMMSandKillVMWP,,,StopVMMSandKillVMWP script,Defense evasion,offensive_tool,https://x.com/GroupIB_DFIR/status/1750452267692728516,high,schtasks /create /tn StopVMMSandKillVMWP /tr 'powershell.exe -Command get-service -name vmms | stop-service -force ; taskkill /f /im vmwp.exe' /sc minute /mo 30 /ru SYSTEM /f,https://github.com/mthcht/awesome-lists +\SSH Key Exchange,,,sshd,Persistence,greyware_tool,https://www.trellix.com/blogs/research/cactus-ransomware-new-strain-in-the-market/,medium,compliance,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/schtasks.csv +\SSH Server,,,sshd,Persistence,greyware_tool,https://www.trellix.com/blogs/research/cactus-ransomware-new-strain-in-the-market/,medium,compliance,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/schtasks.csv +\MeterpeterC2,,,redpill,exploitation,offensive_tool,https://github.com/r00t-3xp10it/redpill/blob/611d39b8bff717ac84d58550dc04e1b312acb19e/bin/SchTasks.ps1#L83,critical,SchTasks.ps1,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/redpill.csv +\RedPillTask,,,redpill,exploitation,offensive_tool,https://github.com/r00t-3xp10it/redpill/blob/611d39b8bff717ac84d58550dc04e1b312acb19e/redpill.ps1#L743,critical,redpill.ps1,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/redpill.csv +\SQLC2AgentPS*,,,PowerUpSQL,C2,offensive_tool,https://github.com/NetSPI/PowerUpSQL/blob/a83cad211983290bf38708e6e237cacbfe023e32/scripts/pending/SQLC2.ps1#L958,critical,N/A,https://github.com/mthcht/awesome-lists +My Startup Task,,,Powershell-Scripts-for-Hackers-and-Pentesters,Persistence,offensive_tool,https://github.com/Whitecat18/Powershell-Scripts-for-Hackers-and-Pentesters/blob/788e89e9584b4b43f982721d59c06c77c0b3b566/PS-020.md?plain=1#L20,medium,N/A,https://github.com/mthcht/awesome-lists +,,*Set-MpPreference -DisableRealtimeMonitoring *,powershell,Defense Evasion,greyware_tool,https://github.com/mthcht/awesome-lists,high,disabling Defender Real time monitoring,https://github.com/mthcht/awesome-lists +\OneDrive Security,,,Nitrogen,Malware,offensive_tool,https://news.sophos.com/en-us/2023/07/26/into-the-tank-with-nitrogen/,high,N/A,https://github.com/mthcht/awesome-lists +\Demovale,,,Nightdoor,Malware,offensive_tool,lhttps://github.com/mthcht/ThreatIntel-Reports/blob/3a4f91c1dbdc45f837f74ca4f3265caba6a09f84/Intel%20Reports/www_welivesecurity_com/en_eset-research_evasive-panda-leverages-monlam-festival-target-tibetans/content.txt#L269C143-L269C152,high,N/A,https://github.com/mthcht/awesome-lists +\8766714F94DD,,,more_eggs,Malware,offensive_tool,https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/n=,high,N/A,https://github.com/mthcht/awesome-lists +\Loki,,,LokiLocker,Ransomware,offensive_tool,https://blogs.blackberry.com/en/2022/03/lokilocker-ransomware,critical,command observed schtasks /CREATE /SC ONLOGON /TN Loki /TR *,https://github.com/mthcht/awesome-lists +\LimeRAT-Admin,,,Lime-RAT,Malware,offensive_tool,https://github.com/NYAN-x-CAT/Lime-RAT/blob/87e189781c0aef0e84cabe2f8c2e7d8f5143e594/Project/Client/C_Installation.vb#L76,critical,N/A,https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/L-N/Lime-RAT.csv +\NFUBffk,,,LemonDuck,Malware,offensive_tool,https://notes.netbytesec.com/2024/10/lemonduck-unleashes-cryptomining.html,high,N/A,https://github.com/mthcht/awesome-lists +\K0adic,,,koadic,C2,offensive_tool,https://github.com/Averroes/koadic/blob/97886ed570f31efff09d1e06c4a7ece2d9b6bd27/data/implant/persist/schtasks.js#L4C21-L4C27,critical,N/A,https://github.com/mthcht/awesome-lists +\Feedback_API_VS_Services_Client,,,Keyzetsu clipper variant,Malware,offensive_tool,https://checkmarx.com/blog/new-technique-to-trick-developers-detected-in-an-open-source-supply-chain-attack/,medium,N/A,https://github.com/mthcht/awesome-lists +\Tater,,,Invoke-Tater,Privilege Escalation,offensive_tool,https://github.com/BC-SECURITY/Empire/blob/8aca42747da6cf2b0def7edede94586f6b3258e8/empire/server/data/module_source/privesc/Invoke-Tater.ps1#L101,critical,PowerShell implementation of the Hot Potato Windows Privilege Escalation exploit from @breenmachine and @foxglovesec,https://github.com/mthcht/awesome-lists +\\Defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\DefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Application Experience\\StartupAppTaskCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Application Experience\\StartupAppTaskCkeck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\ATPUpd,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Data Integrity Scan\Data Integrity Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\DefenderUPDService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\IISUpdateService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Speech\\SpeechModelInstallTask,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\WiMSDFS,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Windows Defender\\Defender Update Service,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Windows Defender\\Service Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Windows Error Reporting\\CheckReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Windows Error Reporting\\SubmitReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\Windows Filtering Platform\\BfeOnServiceStart,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\WindowsDefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\WindowsDefenderService2,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\WindowsUpdate\\Scheduled AutoCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Check,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\\WindowUpdate,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\defender,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\DefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Application Experience\StartupAppTaskCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Application Experience\StartupAppTaskCkeck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\ATPUpd,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Data Integrity Scan\Data Integrity Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\DefenderUPDService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\IISUpdateService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Speech\SpeechModelInstallTask,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\WiMSDFS,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Windows Defender\Defender Update Service,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Windows Defender\Service Update,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Windows Error Reporting\CheckReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Windows Error Reporting\SubmitReporting,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStart,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\WindowsDefenderService,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\WindowsDefenderService2,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\WindowsUpdate\Scheduled AutoCheck,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\Microsoft\Windows\WindowsUpdate\Scheduled Check,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\WindowUpdate,,,GraphicalProton backdoor,Malware,offensive_tool,https://www.ic3.gov/CSA/2023/231213.pdf,high,N/A,https://github.com/mthcht/awesome-lists +\InfrSiRfucture Technologies,,,Gootloader,Malware,offensive_tool,https://thedfirreport.com/2024/02/26/seo-poisoning-to-domain-control-the-gootloader-saga-continues/,critical,N/A,https://github.com/mthcht/awesome-lists +\SynchronizeTimeZone,,,frp,Data Exfiltration,offensive_tool,https://www.aha.org/system/files/media/file/2021/05/fbi-flash-tlp-white-apt-actors-exploiting-fortinet-vulnerabilities-to-gain-access-for-malicious-activity-5-27-21.pdf,high,APT Actors Exploiting Fortinet Vulnerabilities to Gain Access for Malicious Activity - creating specific scheduled task for exfiltration,https://github.com/mthcht/awesome-lists +\CursorSvc,,,Fentanyl Stealer,Malware,offensive_tool,https://github.com/dekrypted/Fentanyl/blob/2b4a008934f21df4eed7b90fb3019d3395f7c909/fenty.py#L699C53-L699C62,critical,Similar to Bandit Stealer,https://github.com/mthcht/awesome-lists +\DisableBitdefender-*,,,Dispossesor,Ransomware,offensive_tool,https://vx-underground.org/Archive/Dispossessor%20Leaks,high,N/A,https://github.com/mthcht/awesome-lists +\DHARMA,,,Dharma,Ransomware,offensive_tool,https://www.joesandbox.com/analysis/860608/0/lighthtml,critical,command observed schtasks /CREATE /SC ONLOGON /TN DHARMA /TR C:\ProgramData\harma.exe*,https://github.com/mthcht/awesome-lists +\Sorry,,,Cryptominer,Cryptominer,offensive_tool,https://x.com/cglyer/status/1001463072672886785,high,schtasks /create /tn 'Sorry' /tr C:\Windows\Temp\taskhost.exe /sc daily /mo 2 /st 22:00:00 /f4,https://x.com/cglyer/status/1001463072672886785 +\shadowdev,,,CobaltStrike,C2,offensive_tool,https://cloud.google.com/blog/topics/threat-intelligence/melting-unc2198-icedid-to-ransomware-operations,critical,cmd.exe /c schtasks /create /sc minute /mo 1 /tn shadowdev /tr C:\\ProgramData\\S\u0443sH\u0435\u0430ls\\T\u0430s\u0441host.exe,https://github.com/mthcht/awesome-lists +\ClearEventLogs,,,Cleareventlog script,Defense Evasion,offensive_tool,https://x.com/GroupIB_DFIR/status/1750452304606810175,high,schtasks /create /tn ClearEventLogs /tr 'powershell.exe -Command wevtutil el | foreach { wevtutil cl $_ }' /sc daily /st 03:00 /ru SYSTEM /f,https://github.com/mthcht/awesome-lists +\SC Scheduled Scan,,,Chafer,Malware,offensive_tool,https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/,high,Chafer activity attributed to OilRig,https://github.com/mthcht/awesome-lists +\UpdatMachine,,,Chafer,Malware,offensive_tool,https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/,high,Chafer activity attributed to OilRig,https://github.com/mthcht/awesome-lists +\drogon,,,BadRabbit,Malware,offensive_tool,https://www.vmray.com/analyses/bad-rabbit-ransomware-flash-analysis/report/overview.html,critical,schtasks /Create /SC once /TN drogon /RU SYSTEM /TR 'C:\Windows\system32\shutdown.exe /r /t 0 /f' /ST 02:34:00,https://github.com/mthcht/awesome-lists +\BaiduUpdateTask1,,,BADNEWS,Malware,offensive_tool,https://unit42.paloaltonetworks.com/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/,high,N/A,https://github.com/mthcht/awesome-lists +\AutoRDPwn,,,AutoRDPwn,C2,offensive_tool,https://github.com/JoelGMSec/AutoRDPwn/blob/839d6afbd2cfa64b01a188b4e09a3e079c9c81d3/AutoRDPwn.ps1#L678,critical,N/A,https://github.com/mthcht/awesome-lists +\thepiratMicrosoftEdgeUpdateTask,,,AsyncRAT,Malware,offensive_tool,https://any.run/cybersecurity-blog/asyncrat-open-directories-infection-analysis/,critical,AsyncRAT’s Infection samples,https://github.com/mthcht/awesome-lists +\kbnvmmmhjo,,,Agent Tesla,Malware,offensive_tool,https://isc.sans.edu/diary/PowerPoint+attachments+Agent+Tesla+and+code+reuse+in+malware/28154,critical,N/A,https://github.com/mthcht/awesome-lists \ No newline at end of file diff --git a/lookups/windows_suspicious_tasks.yml b/lookups/windows_suspicious_tasks.yml new file mode 100644 index 0000000000..68cc6d0fee --- /dev/null +++ b/lookups/windows_suspicious_tasks.yml @@ -0,0 +1,15 @@ +name: windows_suspicious_tasks +date: 2025-02-07 +version: 1 +id: 928cba69-be80-4601-9b0d-3ec81f714338 +author: Steven Dick +lookup_type: csv +description: A list of suspicious Windows Scheduled Task names and locations +default_match: false +match_type: +- WILDCARD(task_name) +- WILDCARD(task_command) +- WILDCARD(task_arguments) +min_matches: 1 +max_matches: 1 +case_sensitive_match: false \ No newline at end of file From bb6cd1f747acf907cbf647b2af8f274e8510d121 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Fri, 7 Feb 2025 13:36:09 -0500 Subject: [PATCH 02/19] Add files via upload --- ...scheduled_task_with_suspicious_command.yml | 76 +++++++++++++++++++ ...nt_scheduled_task_with_suspicious_name.yml | 76 +++++++++++++++++++ 2 files changed, 152 insertions(+) create mode 100644 detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml create mode 100644 detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml diff --git a/detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml b/detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml new file mode 100644 index 0000000000..cfc7e4f617 --- /dev/null +++ b/detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml @@ -0,0 +1,76 @@ +name: WinEvent Scheduled Task with Suspicious Command +id: 1f44c126-c26a-4dd3-83bb-0f9a0f03ecc3 +version: 1 +date: '2025-02-07' +author: Steven Dick +status: production +type: TTP +description: The following analytic detects the creation of scheduled tasks designed to execute commands using native Windows shells like PowerShell, Cmd, Wscript, or Cscript or from public folders such as Users, Temp, or ProgramData. It leverages Windows Security EventCode 4698, 4700, and 4702 to identify when such tasks are registered, enabled, or modified. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment. +data_source: +- Windows Event Log Security 4698 +- Windows Event Log Security 4700 +- Windows Event Log Security 4702 +search: |- + `wineventlog_security` EventCode IN (4698,4700,4702) + | eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent) + | xmlkv TaskContent + | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, Task_Name, Command, Enabled, Hidden, EventCode + | lookup windows_suspicious_tasks task_command as Command + | where tool == "shell command use" OR tool == "suspicious paths" + | eval command=Task_Name, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `winevent_scheduled_task_with_suspicious_command_filter` +how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. +known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. Windows Defender, Google Chrome, and MS Edge updates may trigger this detection. +references: +- https://attack.mitre.org/techniques/T1053/005/ +- https://www.ic3.gov/CSA/2023/231213.pdf +- https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/ +- https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv +drilldown_searches: +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: Investigate schedule tasks on $dest$ + search: '`wineventlog_security` EventCode IN (4698,4700,4702) Computer="$dest$" Caller_User_Name="$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A suspicious windows scheduled task named [$Task_Name$] was detected on $dest$, this may be an indicator of [$tool$] + risk_objects: + - field: dest + type: system + score: 70 + - field: user + type: user + score: 70 + threat_objects: + - field: Command + type: signature +tags: + analytic_story: + - Scheduled Tasks + - Windows Persistence Techniques + - Ransomware + - Ryuk Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1053.005 + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml b/detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml new file mode 100644 index 0000000000..c8bfd9e0f0 --- /dev/null +++ b/detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml @@ -0,0 +1,76 @@ +name: WinEvent Scheduled Task with Suspicious Name +id: 9e9ab4e3-c9d0-4967-a197-6d755e8a7e6e +version: 1 +date: '2025-02-07' +author: Steven Dick +status: production +type: TTP +description: The following analytic detects the creation, modification, or enabling of scheduled tasks with known suspicious or malicious task names. It leverages Windows Security EventCode 4698, 4700, and 4702 to identify when such tasks are registered, modified, or enabled. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment. +data_source: +- Windows Event Log Security 4698 +- Windows Event Log Security 4700 +- Windows Event Log Security 4702 +search: |- + `wineventlog_security` EventCode IN (4698,4700,4702) + | eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent) + | xmlkv TaskContent + | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Task_Name, Command, Enabled, Hidden,Caller_User_Name, EventCode + | lookup windows_suspicious_tasks task_name as Task_Name + | where isnotnull(tool_type) + | eval command=Task_Name, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `winevent_scheduled_task_with_suspicious_name_filter` +how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. +known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. +references: +- https://attack.mitre.org/techniques/T1053/005/ +- https://www.ic3.gov/CSA/2023/231213.pdf +- https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/ +- https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv +drilldown_searches: +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: Investigate schedule tasks on $dest$ + search: '`wineventlog_security` EventCode IN (4698,4700,4702) | xmlkv TaskContent | search dest="$dest$" AND Task_Name = "$Task_Name$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A windows scheduled task was created with known suspicious task name [$Task_Name$] on $dest$, this may be a [$tool$] indicator + risk_objects: + - field: dest + type: system + score: 70 + - field: user + type: user + score: 70 + threat_objects: + - field: Command + type: signature +tags: + analytic_story: + - Scheduled Tasks + - Windows Persistence Techniques + - Ransomware + - Ryuk Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1053.005 + - T1053 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_with_suspect_name/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog \ No newline at end of file From 70f0d68506726293ef093c6f4f8942a1740c7c2f Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Fri, 7 Feb 2025 14:01:13 -0500 Subject: [PATCH 03/19] Update winevent_scheduled_task_with_suspicious_name.yml --- .../winevent_scheduled_task_with_suspicious_name.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml b/detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml index c8bfd9e0f0..2b13e85f31 100644 --- a/detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml +++ b/detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml @@ -30,11 +30,11 @@ references: - https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: Investigate schedule tasks on $dest$ @@ -73,4 +73,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_with_suspect_name/windows-xml.log source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: XmlWinEventLog From b007e91c6e9bc3b05f1ea0e235f44d943bd22f65 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Fri, 7 Feb 2025 14:01:48 -0500 Subject: [PATCH 04/19] Update winevent_scheduled_task_with_suspicious_command.yml --- .../winevent_scheduled_task_with_suspicious_command.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml b/detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml index cfc7e4f617..02ee078fc7 100644 --- a/detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml +++ b/detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml @@ -30,11 +30,11 @@ references: - https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_tasks_list.csv drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: Investigate schedule tasks on $dest$ @@ -73,4 +73,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: XmlWinEventLog From d1d24fc46c224e0fe9a0c1792bf801fd6f166814 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Fri, 14 Feb 2025 08:58:40 -0500 Subject: [PATCH 05/19] Update and rename winevent_scheduled_task_with_suspicious_command.yml to windows_scheduled_task_with_suspicious_command.yml Rename to align with other detections --- ...yml => windows_scheduled_task_with_suspicious_command.yml} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename detections/endpoint/{winevent_scheduled_task_with_suspicious_command.yml => windows_scheduled_task_with_suspicious_command.yml} (95%) diff --git a/detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml similarity index 95% rename from detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml rename to detections/endpoint/windows_scheduled_task_with_suspicious_command.yml index 02ee078fc7..007015b297 100644 --- a/detections/endpoint/winevent_scheduled_task_with_suspicious_command.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml @@ -1,4 +1,4 @@ -name: WinEvent Scheduled Task with Suspicious Command +name: Windows Scheduled Task with Suspicious Command id: 1f44c126-c26a-4dd3-83bb-0f9a0f03ecc3 version: 1 date: '2025-02-07' @@ -20,7 +20,7 @@ search: |- | eval command=Task_Name, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `winevent_scheduled_task_with_suspicious_command_filter` + | `windows_scheduled_task_with_suspicious_command_filter` how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. Windows Defender, Google Chrome, and MS Edge updates may trigger this detection. references: From 0ca3c1d5b97cbceb2b04436f872ae3d137d54f8e Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Fri, 14 Feb 2025 08:59:12 -0500 Subject: [PATCH 06/19] Update and rename winevent_scheduled_task_with_suspicious_name.yml to windows_scheduled_task_with_suspicious_name.yml --- ...me.yml => windows_scheduled_task_with_suspicious_name.yml} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename detections/endpoint/{winevent_scheduled_task_with_suspicious_name.yml => windows_scheduled_task_with_suspicious_name.yml} (95%) diff --git a/detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml similarity index 95% rename from detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml rename to detections/endpoint/windows_scheduled_task_with_suspicious_name.yml index 2b13e85f31..bb4c11c224 100644 --- a/detections/endpoint/winevent_scheduled_task_with_suspicious_name.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml @@ -1,4 +1,4 @@ -name: WinEvent Scheduled Task with Suspicious Name +name: Windows Scheduled Task with Suspicious Name id: 9e9ab4e3-c9d0-4967-a197-6d755e8a7e6e version: 1 date: '2025-02-07' @@ -20,7 +20,7 @@ search: |- | eval command=Task_Name, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `winevent_scheduled_task_with_suspicious_name_filter` + | `windows_scheduled_task_with_suspicious_name_filter` how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. references: From 68f3d88ba2c69877297b1db16da25621e3cd6205 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Fri, 14 Feb 2025 09:10:01 -0500 Subject: [PATCH 07/19] Update windows_scheduled_task_with_suspicious_command.yml --- .../endpoint/windows_scheduled_task_with_suspicious_command.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml index 007015b297..a1b6c330ce 100644 --- a/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml @@ -62,7 +62,6 @@ tags: asset_type: Endpoint mitre_attack_id: - T1053.005 - - T1053 product: - Splunk Enterprise - Splunk Enterprise Security From 6055d2605de3e51f2aabab92dcf4c3400e669f3c Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Fri, 14 Feb 2025 09:10:20 -0500 Subject: [PATCH 08/19] Update windows_scheduled_task_with_suspicious_name.yml --- .../endpoint/windows_scheduled_task_with_suspicious_name.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml index bb4c11c224..e1231d4fe8 100644 --- a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml @@ -62,7 +62,6 @@ tags: asset_type: Endpoint mitre_attack_id: - T1053.005 - - T1053 product: - Splunk Enterprise - Splunk Enterprise Security From e23ed50fc60b805655ee977128cad2dfea6e815f Mon Sep 17 00:00:00 2001 From: 0xC0FFEEEE <119874251+0xC0FFEEEE@users.noreply.github.com> Date: Fri, 14 Feb 2025 19:53:37 +0000 Subject: [PATCH 09/19] O365 Suspicious Mailbox Rule Created --- .../o365_suspicious_mailbox_rule_created.yml | 57 +++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 detections/cloud/o365_suspicious_mailbox_rule_created.yml diff --git a/detections/cloud/o365_suspicious_mailbox_rule_created.yml b/detections/cloud/o365_suspicious_mailbox_rule_created.yml new file mode 100644 index 0000000000..83f3c63bce --- /dev/null +++ b/detections/cloud/o365_suspicious_mailbox_rule_created.yml @@ -0,0 +1,57 @@ +name: O365 Suspicious Mailbox Rule Created +id: 603ebac2-f157-4df7-a6ac-34e8d0350f86 +version: 1 +date: '2025-02-14' +author: 0xC0FFEEEE +type: TTP +status: production +enabled_by_default: true +description: This analytic detects suspicious mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers. + This may indicate that an attacker has gained access to the account. +search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" | rename Parameters{}.* + as * | eval temp=mvzip(Name,Value, "") | fields - Name Value | mvexpand temp + | eval temp_name=mvindex(split(temp,""),0), temp_value=mvindex(split(temp,""),1) + | eval {temp_name}=temp_value | stats values(Name) as Name, values(MarkAsRead) as + MarkAsRead, values(MoveToFolder) as MoveToFolder by _time Id user | lookup ut_shannon_lookup word as Name + | eval entropy_score=if(ut_shannon<=2, 1, 0) | eval len_score=if(len(Name)<=3, 1, + 0) | eval read_score=if(MarkAsRead="True", 1, 0) | eval folder_score=if(match(MoveToFolder, + "^(RSS|Conversation History|Archive)"), 1, 0) | eval suspicious_score=entropy_score+len_score+read_score+folder_score + | where suspicious_score>2 | `o365_suspicious_mailbox_rule_created_filter`' +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest + Office 365 management activity events. +known_false_positives: Short rule names may trigger false positives. Adjust + the entropy and length thresholds as needed. +references: +- https://attack.mitre.org/techniques/T1564/008/ +drilldown_searches: +- name: View the detection results + search: '%original_detection_search%' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for $user$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$user$" starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A suspicious mailbox rule was created by $user$ + risk_objects: + - field: user + type: user + score: 25 +tags: + analytic_story: + - Office 365 Account Takeover + asset_type: O365 Tenant + mitre_attack_id: + - T1564.008 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: audit +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564.008/o365/o365_suspicious_mailbox_rule.log + sourcetype: o365:management:activity + source: o365 From b4783e0319c7c35244fb40cf1d4b4d40cec44fec Mon Sep 17 00:00:00 2001 From: 0xC0FFEEEE <119874251+0xC0FFEEEE@users.noreply.github.com> Date: Wed, 19 Feb 2025 07:52:12 +0000 Subject: [PATCH 10/19] remove enabled_by_default --- detections/cloud/o365_suspicious_mailbox_rule_created.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/cloud/o365_suspicious_mailbox_rule_created.yml b/detections/cloud/o365_suspicious_mailbox_rule_created.yml index 83f3c63bce..ce6873bcf0 100644 --- a/detections/cloud/o365_suspicious_mailbox_rule_created.yml +++ b/detections/cloud/o365_suspicious_mailbox_rule_created.yml @@ -5,7 +5,6 @@ date: '2025-02-14' author: 0xC0FFEEEE type: TTP status: production -enabled_by_default: true description: This analytic detects suspicious mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers. This may indicate that an attacker has gained access to the account. search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" | rename Parameters{}.* From f9c28ccdb334d9d9c92a422e1037f0386703d3e6 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 19 Feb 2025 12:33:51 -0800 Subject: [PATCH 11/19] minor changes to ensure CI testing works --- detections/cloud/o365_suspicious_mailbox_rule_created.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/cloud/o365_suspicious_mailbox_rule_created.yml b/detections/cloud/o365_suspicious_mailbox_rule_created.yml index ce6873bcf0..6168775f9f 100644 --- a/detections/cloud/o365_suspicious_mailbox_rule_created.yml +++ b/detections/cloud/o365_suspicious_mailbox_rule_created.yml @@ -2,7 +2,7 @@ name: O365 Suspicious Mailbox Rule Created id: 603ebac2-f157-4df7-a6ac-34e8d0350f86 version: 1 date: '2025-02-14' -author: 0xC0FFEEEE +author: '0xC0FFEEEE, Github Community' type: TTP status: production description: This analytic detects suspicious mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers. @@ -37,6 +37,7 @@ rba: - field: user type: user score: 25 + threat_objects: [] tags: analytic_story: - Office 365 Account Takeover From 569d453b4928d329ee1e95a882c19b169d4ba19e Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Wed, 19 Feb 2025 16:55:30 -0500 Subject: [PATCH 12/19] Update windows_scheduled_task_with_suspicious_command.yml Task_Name to TaskName swap --- .../windows_scheduled_task_with_suspicious_command.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml index a1b6c330ce..a935ff3610 100644 --- a/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml @@ -14,10 +14,10 @@ search: |- `wineventlog_security` EventCode IN (4698,4700,4702) | eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent) | xmlkv TaskContent - | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, Task_Name, Command, Enabled, Hidden, EventCode + | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, TaskName, Command, Enabled, Hidden, EventCode | lookup windows_suspicious_tasks task_command as Command | where tool == "shell command use" OR tool == "suspicious paths" - | eval command=Task_Name, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode + | eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_task_with_suspicious_command_filter` @@ -42,7 +42,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A suspicious windows scheduled task named [$Task_Name$] was detected on $dest$, this may be an indicator of [$tool$] + message: A suspicious windows scheduled task named [$TaskName$] was detected on $dest$, this may be an indicator of [$tool$] risk_objects: - field: dest type: system From fe46608339fcfeb8e0a71baf8d7883386c8bc165 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Wed, 19 Feb 2025 16:57:14 -0500 Subject: [PATCH 13/19] Update windows_scheduled_task_with_suspicious_name.yml Task_Name to TaskName --- .../windows_scheduled_task_with_suspicious_name.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml index e1231d4fe8..9c039ab87b 100644 --- a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml @@ -14,10 +14,10 @@ search: |- `wineventlog_security` EventCode IN (4698,4700,4702) | eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent) | xmlkv TaskContent - | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Task_Name, Command, Enabled, Hidden,Caller_User_Name, EventCode - | lookup windows_suspicious_tasks task_name as Task_Name + | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, TaskName, Command, Enabled, Hidden,Caller_User_Name, EventCode + | lookup windows_suspicious_tasks task_name as TaskName | where isnotnull(tool_type) - | eval command=Task_Name, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer + | eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_task_with_suspicious_name_filter` @@ -38,11 +38,11 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: Investigate schedule tasks on $dest$ - search: '`wineventlog_security` EventCode IN (4698,4700,4702) | xmlkv TaskContent | search dest="$dest$" AND Task_Name = "$Task_Name$"' + search: '`wineventlog_security` EventCode IN (4698,4700,4702) | xmlkv TaskContent | search dest="$dest$" AND TaskName = "$TaskName$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A windows scheduled task was created with known suspicious task name [$Task_Name$] on $dest$, this may be a [$tool$] indicator + message: A windows scheduled task was created with known suspicious task name [$TaskName$] on $dest$, this may be a [$tool$] indicator risk_objects: - field: dest type: system From 7e9f15047457077150e6ef7dcbc9abe90c0e185d Mon Sep 17 00:00:00 2001 From: 0xC0FFEEEE <119874251+0xC0FFEEEE@users.noreply.github.com> Date: Wed, 19 Feb 2025 22:17:11 +0000 Subject: [PATCH 14/19] add url toolbox requirement --- detections/cloud/o365_suspicious_mailbox_rule_created.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/cloud/o365_suspicious_mailbox_rule_created.yml b/detections/cloud/o365_suspicious_mailbox_rule_created.yml index 6168775f9f..925030c0b1 100644 --- a/detections/cloud/o365_suspicious_mailbox_rule_created.yml +++ b/detections/cloud/o365_suspicious_mailbox_rule_created.yml @@ -17,7 +17,8 @@ search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" "^(RSS|Conversation History|Archive)"), 1, 0) | eval suspicious_score=entropy_score+len_score+read_score+folder_score | where suspicious_score>2 | `o365_suspicious_mailbox_rule_created_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest - Office 365 management activity events. + Office 365 management activity events. You also need to have the Splunk TA URL + Toolbox (https://splunkbase.splunk.com/app/2734/) installed. known_false_positives: Short rule names may trigger false positives. Adjust the entropy and length thresholds as needed. references: From 10d1435990c162c230cac85bbca110ec6a0ac6d5 Mon Sep 17 00:00:00 2001 From: 0xC0FFEEEE <119874251+0xC0FFEEEE@users.noreply.github.com> Date: Tue, 25 Feb 2025 22:04:49 +0000 Subject: [PATCH 15/19] Update detection name --- ...created.yml => o365_bec_email_hiding_rule_created.yml} | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) rename detections/cloud/{o365_suspicious_mailbox_rule_created.yml => o365_bec_email_hiding_rule_created.yml} (86%) diff --git a/detections/cloud/o365_suspicious_mailbox_rule_created.yml b/detections/cloud/o365_bec_email_hiding_rule_created.yml similarity index 86% rename from detections/cloud/o365_suspicious_mailbox_rule_created.yml rename to detections/cloud/o365_bec_email_hiding_rule_created.yml index 925030c0b1..54dffb8b87 100644 --- a/detections/cloud/o365_suspicious_mailbox_rule_created.yml +++ b/detections/cloud/o365_bec_email_hiding_rule_created.yml @@ -1,11 +1,11 @@ -name: O365 Suspicious Mailbox Rule Created +name: O365 BEC Email Hiding Rule Created id: 603ebac2-f157-4df7-a6ac-34e8d0350f86 version: 1 date: '2025-02-14' author: '0xC0FFEEEE, Github Community' type: TTP status: production -description: This analytic detects suspicious mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers. +description: This analytic detects mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers. This may indicate that an attacker has gained access to the account. search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" | rename Parameters{}.* as * | eval temp=mvzip(Name,Value, "") | fields - Name Value | mvexpand temp @@ -15,7 +15,7 @@ search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" | eval entropy_score=if(ut_shannon<=2, 1, 0) | eval len_score=if(len(Name)<=3, 1, 0) | eval read_score=if(MarkAsRead="True", 1, 0) | eval folder_score=if(match(MoveToFolder, "^(RSS|Conversation History|Archive)"), 1, 0) | eval suspicious_score=entropy_score+len_score+read_score+folder_score - | where suspicious_score>2 | `o365_suspicious_mailbox_rule_created_filter`' + | where suspicious_score>2 | `o365_bec_email_hiding_rule_created_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You also need to have the Splunk TA URL Toolbox (https://splunkbase.splunk.com/app/2734/) installed. @@ -33,7 +33,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A suspicious mailbox rule was created by $user$ + message: Potential BEC mailbox rule was created by $user$ risk_objects: - field: user type: user From 9d23cc4bf0189f0130da335e2d4ead6d14899659 Mon Sep 17 00:00:00 2001 From: 0xC0FFEEEE <119874251+0xC0FFEEEE@users.noreply.github.com> Date: Thu, 27 Feb 2025 07:35:08 +0000 Subject: [PATCH 16/19] simplify SPL & add threat object --- .../cloud/o365_bec_email_hiding_rule_created.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/detections/cloud/o365_bec_email_hiding_rule_created.yml b/detections/cloud/o365_bec_email_hiding_rule_created.yml index 54dffb8b87..fdd0710400 100644 --- a/detections/cloud/o365_bec_email_hiding_rule_created.yml +++ b/detections/cloud/o365_bec_email_hiding_rule_created.yml @@ -7,13 +7,11 @@ type: TTP status: production description: This analytic detects mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers. This may indicate that an attacker has gained access to the account. -search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" | rename Parameters{}.* - as * | eval temp=mvzip(Name,Value, "") | fields - Name Value | mvexpand temp - | eval temp_name=mvindex(split(temp,""),0), temp_value=mvindex(split(temp,""),1) - | eval {temp_name}=temp_value | stats values(Name) as Name, values(MarkAsRead) as - MarkAsRead, values(MoveToFolder) as MoveToFolder by _time Id user | lookup ut_shannon_lookup word as Name - | eval entropy_score=if(ut_shannon<=2, 1, 0) | eval len_score=if(len(Name)<=3, 1, - 0) | eval read_score=if(MarkAsRead="True", 1, 0) | eval folder_score=if(match(MoveToFolder, +search: '`o365_management_activity` Workload=Exchange Operation="New-InboxRule" | + stats values(Name) as Name, values(MarkAsRead) as MarkAsRead, values(MoveToFolder) + as MoveToFolder by _time Id user | lookup ut_shannon_lookup word as Name | eval + entropy_score=if(ut_shannon<=2, 1, 0) | eval len_score=if(len(Name)<=3, 1,0) | eval + read_score=if(MarkAsRead="True", 1, 0) | eval folder_score=if(match(MoveToFolder, "^(RSS|Conversation History|Archive)"), 1, 0) | eval suspicious_score=entropy_score+len_score+read_score+folder_score | where suspicious_score>2 | `o365_bec_email_hiding_rule_created_filter`' how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest @@ -38,7 +36,9 @@ rba: - field: user type: user score: 25 - threat_objects: [] + threat_objects: + - field: Name + type: signature tags: analytic_story: - Office 365 Account Takeover From d5feba1042182ad2a34a6c4a91ad19a834f1a9fb Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 11 Mar 2025 13:22:04 -0700 Subject: [PATCH 17/19] drilldown update- minor --- detections/cloud/o365_bec_email_hiding_rule_created.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/o365_bec_email_hiding_rule_created.yml b/detections/cloud/o365_bec_email_hiding_rule_created.yml index fdd0710400..51e7cd1c9a 100644 --- a/detections/cloud/o365_bec_email_hiding_rule_created.yml +++ b/detections/cloud/o365_bec_email_hiding_rule_created.yml @@ -22,8 +22,8 @@ known_false_positives: Short rule names may trigger false positives. Adjust references: - https://attack.mitre.org/techniques/T1564/008/ drilldown_searches: -- name: View the detection results - search: '%original_detection_search%' +- name: View the detection results for - "$user$" + search: '%original_detection_search% | search dest = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for $user$ From 8295f6139b569140edc77ea4fc1b6e09469768d8 Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Tue, 11 Mar 2025 22:56:06 -0400 Subject: [PATCH 18/19] Add files via upload --- data_sources/windows_event_log_security_4700.yml | 16 ++++++++++++++++ data_sources/windows_event_log_security_4702.yml | 16 ++++++++++++++++ 2 files changed, 32 insertions(+) create mode 100644 data_sources/windows_event_log_security_4700.yml create mode 100644 data_sources/windows_event_log_security_4702.yml diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml new file mode 100644 index 0000000000..39bc4c1033 --- /dev/null +++ b/data_sources/windows_event_log_security_4700.yml @@ -0,0 +1,16 @@ +name: Windows Event Log Security 4700 +id: 22184889-0f07-46b9-b25f-8a55a9ad63 +version: 1 +date: '2025-03-11' +author: Steven Dick +description: Data source object for Windows Event Log Security 4700 +source: XmlWinEventLog:Security +sourcetype: xmlwineventlog +separator: EventID +supported_TA: +- name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 9.0.1 +fields: +- EventID +example_log: ' 4700 0 0 12804 0 0x8020000000000000 344861 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin LeastPrivilege CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe ' diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml new file mode 100644 index 0000000000..b6056ee988 --- /dev/null +++ b/data_sources/windows_event_log_security_4702.yml @@ -0,0 +1,16 @@ +name: Windows Event Log Security 4702 +id: 167e378e-3675-4042-b611-d3bfb6d2abc7 +version: 1 +date: '2025-03-11' +author: Steven Dick +description: Data source object for Windows Event Log Security 4702 +source: XmlWinEventLog:Security +sourcetype: xmlwineventlog +separator: EventID +supported_TA: +- name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 9.0.1 +fields: +- EventID +example_log: ' 4702 0 0 12804 0 0x8020000000000000 344863 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin HighestAvailable CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe ' From 5060b8cefdb87f93f72b12a6f5d2968a4dc4278f Mon Sep 17 00:00:00 2001 From: Steven Dick <38897662+nterl0k@users.noreply.github.com> Date: Tue, 11 Mar 2025 22:59:08 -0400 Subject: [PATCH 19/19] Update windows_event_log_security_4700.yml --- data_sources/windows_event_log_security_4700.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index 39bc4c1033..56b76ecfdf 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -1,5 +1,5 @@ name: Windows Event Log Security 4700 -id: 22184889-0f07-46b9-b25f-8a55a9ad63 +id: 89895c7b-2aba-41ca-ad12-8b6d290b5dde version: 1 date: '2025-03-11' author: Steven Dick