From f29b5e8d3876ea19246c2cf025c2e8113c5233fe Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Thu, 13 May 2021 12:55:57 -0500 Subject: [PATCH 1/3] Fixed small bug in pipeline (two | | back to back) --- .../ssa___system_process_running_unexpected_location.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml index 8257e37e3d..470afb0ec1 100644 --- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml +++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml @@ -224,7 +224,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe"; | from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 | - union $cond_6 | | where process_path NOT LIKE "%\\windows\\system32%" OR process_path + union $cond_6 | where process_path NOT LIKE "%\\windows\\system32%" OR process_path NOT LIKE "%\\windows\\syswow64%" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(device, user), body=create_map(["process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();' From e63e6c4cfb2c9a49426df8241695e0eadc2dd4f9 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 13 May 2021 12:14:03 -0600 Subject: [PATCH 2/3] rclone --- .../detect_rclone_command_line_usage.yml | 46 +++++++++++++++++++ detections/endpoint/detect_renamed_rclone.yml | 43 +++++++++++++++++ .../detect_rclone_command_line_usage.test.yml | 12 +++++ tests/endpoint/detect_renamed_rclone.test.yml | 12 +++++ 4 files changed, 113 insertions(+) create mode 100644 detections/endpoint/detect_rclone_command_line_usage.yml create mode 100644 detections/endpoint/detect_renamed_rclone.yml create mode 100644 tests/endpoint/detect_rclone_command_line_usage.test.yml create mode 100644 tests/endpoint/detect_renamed_rclone.test.yml diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml new file mode 100644 index 0000000000..c5fbe3f58b --- /dev/null +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -0,0 +1,46 @@ +name: Detect RClone Command-Line Usage +id: 32e0baea-b3f1-11eb-a2ce-acde48001122 +version: 1 +date: '2021-05-13' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies commonly used command-line arguments used by `rclone.exe to initiate a file transfer. Some arguments were negated as they are specific to the configuration used by adversaries. + In particular, an adversary may list the files or directories of the remote file share using `ls` or `lsd`, which is not indicative of malicious behavior. + During triage, at this stage of a ransomware event, exfiltration is about to occur or has already. Isolate the endpoint and continue investigating by review file modifications and parallel processes. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*copy*", "*mega*", "*pcloud*", "*ftp*", "*--config*", "*--progress*", "*--no-check-certificate*", "*--ignore-existing*", "*--auto-confirm*", "*--transfers*", "*--multi-thread-streams*") by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_rclone_command_line_usage_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: There is potential for false positives as these arguments may be used by other applications. Filter or tune the analytic as needed. +references: + - https://redcanary.com/blog/rclone-mega-extortion/ + - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html + - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ +tags: + analytic_story: + - DarkSide Ransomware + - Ransomware + dataset: [] + kill_chain_phases: + - Exfiltration + mitre_attack_id: + - T1020 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml new file mode 100644 index 0000000000..26ad52ea0a --- /dev/null +++ b/detections/endpoint/detect_renamed_rclone.yml @@ -0,0 +1,43 @@ +name: Detect Renamed RClone +id: 6dca1124-b3ec-11eb-9328-acde48001122 +version: 1 +date: '2021-05-13' +author: Michael Haag, Splunk +type: batch +datamodel: [] +description: The following analytic identifies the usage of `rclone.exe`, renamed, being used to exfiltrate data to a remote destination. RClone has been used by multiple ransomware groups to exfiltrate data. In many instances, it will be downloaded from the legitimate site and executed accordingly. + During triage, isolate the endpoint and begin to review parallel processes for additional behavior. At this stage, the adversary may have staged data to be exfiltrated. +search: '`sysmon` EventID=1 OriginalFileName=rclone.exe NOT process_name=rclone.exe | stats + count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, + process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_rclone_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: False positives should be limited as this analytic identifies renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business use case. +references: + - https://redcanary.com/blog/rclone-mega-extortion/ + - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html + - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ +tags: + analytic_story: + - DarkSide Ransomware + - Ransomware + dataset: [] + kill_chain_phases: + - Exfiltration + mitre_attack_id: + - T1020 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - OriginalFileName + - process_name + - process_path + - CommandLine + - dest + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/detect_rclone_command_line_usage.test.yml b/tests/endpoint/detect_rclone_command_line_usage.test.yml new file mode 100644 index 0000000000..029bbfe41b --- /dev/null +++ b/tests/endpoint/detect_rclone_command_line_usage.test.yml @@ -0,0 +1,12 @@ +name: Detect RClone Command-Line Usage Unit Test +tests: +- name: Detect RClone Command-Line Usage + file: endpoint/detect_rclone_command_line_usage.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/detect_renamed_rclone.test.yml b/tests/endpoint/detect_renamed_rclone.test.yml new file mode 100644 index 0000000000..592b5da53d --- /dev/null +++ b/tests/endpoint/detect_renamed_rclone.test.yml @@ -0,0 +1,12 @@ +name: Detect Renamed RClone Unit Test +tests: +- name: Detect Renamed RClone + file: endpoint/detect_renamed_rclone.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From eaae607c1213851d795740c9606bc8173316d080 Mon Sep 17 00:00:00 2001 From: tcontreras Date: Thu, 13 May 2021 20:21:22 +0200 Subject: [PATCH 3/3] com_obj2 --- detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml index ca7aad1281..3860d56b07 100644 --- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml +++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml @@ -8,11 +8,12 @@ datamodel: - Endpoint description: This search is to detect a potential process using COM Object like CMLUA or CMSTPLUA to bypassed UAC. This technique used by ransomware to gain administrative privileges to its running process. -search: '`sysmon` EventCode=7 process_name ="darkside.exe" ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll", "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) -| stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `cmlua_or_cmstplua_uac_bypass_filter`' +search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll", "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) + NOT(Image IN("*\\windows\\*", "*\\program files\\*")) + | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `cmlua_or_cmstplua_uac_bypass_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the