From 4549e7ac62959623ac20c3d00a04da84bf68fb15 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 11 Jul 2023 15:13:42 -0500 Subject: [PATCH 1/7] updates for testing --- ...powershell_script_block_with_url_chain.yml | 74 ++++++++++++++++ ...ershell_webrequest_using_memory_stream.yml | 69 +++++++++++++++ ...ss_executed_from_container_file_filter.yml | 71 +++++++++++++++ .../windows_registry_payload_injection.yml | 87 +++++++++++++++++++ ...s_scheduled_task_service_spawned_shell.yml | 75 ++++++++++++++++ 5 files changed, 376 insertions(+) create mode 100644 detections/endpoint/powershell_powershell_script_block_with_url_chain.yml create mode 100644 detections/endpoint/powershell_webrequest_using_memory_stream.yml create mode 100644 detections/endpoint/suspicious_process_executed_from_container_file_filter.yml create mode 100644 detections/endpoint/windows_registry_payload_injection.yml create mode 100644 detections/endpoint/windows_scheduled_task_service_spawned_shell.yml diff --git a/detections/endpoint/powershell_powershell_script_block_with_url_chain.yml b/detections/endpoint/powershell_powershell_script_block_with_url_chain.yml new file mode 100644 index 0000000000..c39f9d6851 --- /dev/null +++ b/detections/endpoint/powershell_powershell_script_block_with_url_chain.yml @@ -0,0 +1,74 @@ +name: PowerShell Script Block With URL Chain +id: 4a3f2a7d-6402-4e64-a76a-869588ec3b57 +version: 1 +date: '2023-06-13' +author: Steven Dick +status: production +type: TTP +description: The following analytic identifies a suspicious PowerShell script execution via EventCode 4104 that contains multiple URLs within a function or array. + This is typically found in obfuscated PowerShell or PowerShell executing embedded .NET or binary files that are attempting to download 2nd stage payloads. + During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. +data_source: +- Powershell 4104 +search: '`powershell` EventCode=4104 ScriptBlockText IN ("*http:*","*https:*") +| regex ScriptBlockText="(\"?(https?:\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b(?:[-a-zA-Z0-9()@:%_\+.~#?&\/=]*))\"?(?:,|\))?){2,}" +| rex max_match=20 field=ScriptBlockText "(?https?:\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b(?:[-a-zA-Z0-9()@:%_\+.~#?&\/=]*))" +| eval Path = case(isnotnull(Path),Path,true(),"unknown") +| stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command values(Path) as file_name values(user) as user values(url) as url dc(url) as url_count by ActivityID, Computer, EventCode +| rename Computer as dest, EventCode as signature_id +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `powershell_scriptblock_with_url_chain_filter`' +how_to_implement: The following analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: Unknown, possible custom scripting. +references: +- https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations +- https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ +- https://attack.mitre.org/techniques/T1059/001/ +tags: + analytic_story: + - Malicious PowerShell + asset_type: Endpoint + confidence: 80 + impact: 100 + message: A suspicious powershell script used by $user$ on host $dest$ contains $url_count$ URLs in an array, this is commonly used for malware. + mitre_attack_id: + - T1059.001 + - T1105 + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + - name: file_name + type: File Name + role: + - Attacker + - name: url + type: URL String + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ActivityID + - Computer + - ScriptBlockText + risk_score: 80 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/powershell_webrequest_using_memory_stream.yml b/detections/endpoint/powershell_webrequest_using_memory_stream.yml new file mode 100644 index 0000000000..80efc992b6 --- /dev/null +++ b/detections/endpoint/powershell_webrequest_using_memory_stream.yml @@ -0,0 +1,69 @@ +name: PowerShell WebRequest Using Memory Stream +id: 103affa6-924a-4b53-aff4-1d5075342aab +version: 1 +date: '2023-06-13' +author: Steven Dick +status: production +type: TTP +description: This analytic identifies a common fileless malware staging technique of using .NET classes + to directly download a URL payload into memory. The analytic utilizes PowerShell Script Block Logging + (EventCode=4104) to identify suspicious PowerShell execution. +data_source: +- Powershell 4104 +search: '`powershell` EventCode=4104 ScriptBlockText IN ("*system.net.webclient*","*system.net.webrequest*") AND ScriptBlockText="*IO.MemoryStream*" +| eval Path = case(isnotnull(Path),Path,true(),"unknown") +| stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command values(Path) as file_name values(user) as user by ActivityID, Computer, EventCode +| rename Computer as dest, EventCode as signature_id +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `powershell_webrequest_using_memorystream_filter`' +how_to_implement: The following analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: Unknown, possible custom scripting. +references: +- https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations +- https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ +- https://attack.mitre.org/techniques/T1059/001/ +tags: + analytic_story: + - Malicious PowerShell + asset_type: Endpoint + confidence: 80 + impact: 100 + message: Powershell webrequest to memory stream behavior. Possible fileless malware staging on $dest$ by $user$. + mitre_attack_id: + - T1059.001 + - T1105 + - T1027.011 + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + - name: file_name + type: File Name + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ActivityID + - Computer + - ScriptBlockText + risk_score: 80 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml b/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml new file mode 100644 index 0000000000..7635e9d772 --- /dev/null +++ b/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml @@ -0,0 +1,71 @@ +name: Suspicious Process Executed From Container File +id: d8120352-3b62-4e3c-8cb6-7b47584dd5e8 +version: 1 +date: '2023-06-13' +author: Steven Dick +status: production +type: TTP +description: This analytic identifies a suspicious process spawned by another process from within common container/archive +file types. This technique was a common technique used by adversaries and malware to execute scripts or evade defenses. +This TTP may detect some normal software installation or user behaviors where opening archive files is common. +data_source: +- Sysmon 1 +- Windows Security 4688 +search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name min(_time) as firstTime max(_time) as lastTime +from datamodel=Endpoint.Processes where Processes.process IN ("*.ZIP\\*","*.ISO\\*","*.IMG\\*","*.CAB\\*","*.TAR\\*","*.GZ\\*","*.RAR\\*","*.7Z\\*") +AND Processes.action="allowed" by Processes.dest Processes.parent_process Processes.process Processes.user +| `drop_dm_object_name(Processes)` +| regex process="(?i).*(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z)\\\\.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH)\"?$" +| rex field=process "(?i).+\\\\(?[^\\\]+\.(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z))\\\\((.+\\\\)+)?(?.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH))\"?$" +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `suspicious_process_executed_from_container_file_filter`' +how_to_implement: The following analytic requires Sysmon or Windows logging with +command line logging enabled. Use filter to remove known environment known false +positives prior to full production usage. +known_false_positives: Various business process or userland applications and behavior. +references: +- https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations +- https://www.crowdstrike.com/blog/weaponizing-disk-image-files-analysis/ +- https://attack.mitre.org/techniques/T1204/002/ +tags: + analytic_story: + - Unusual Processes + asset_type: Endpoint + confidence: 20 + impact: 80 + message: A suspicious process $process_name$ was launched from $file_name$ on $dest$. + mitre_attack_id: + - T1204.002 + - T1036.008 + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + - name: file_name + type: File Name + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.parent_process + - Processes.process + - Processes.user + risk_score: 40 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/windows_registry_payload_injection.yml b/detections/endpoint/windows_registry_payload_injection.yml new file mode 100644 index 0000000000..3336452421 --- /dev/null +++ b/detections/endpoint/windows_registry_payload_injection.yml @@ -0,0 +1,87 @@ +name: Windows Registry Payload Injection +id: c6b2d80f-179a-41a1-b95e-ce5601d7427a +version: 1 +date: '2023-06-15' +author: Steven Dick +type: TTP +description: The following analytic identifies when suspiciouly long data is written to the registry. This behavior is often +associated with certain fileless malware threats or persistence techniques used by threat actors. Data stored in the registy +is considered fileless since it does not get written to disk and is traditionally not well defended since normal users can +modify thier own registry. +data_source: +- Sysmon EventID 1 +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime +FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name +Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid +| `drop_dm_object_name(Processes)` +| join max=0 dest process_guid [ +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_value_data=* by _time span=1h +Registry.dest Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_value_data Registry.registry_key_name + | `drop_dm_object_name(Registry)` + | eval reg_data_len = len(registry_value_data) + | where reg_data_len > 512] +| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid +| where isnotnull(registry_value_data) +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_registry_payload_injection_filter`' +how_to_implement: The following analytic requires Sysmon or Windows logging with +command line and registry modification logging enabled. Use filter to remove known +environment known false positives prior to full production usage. +known_false_positives: Unknown, possible custom scripting. +references: +- https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations +- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/kovter-an-evolving-malware-gone-fileless +- https://attack.mitre.org/techniques/T1027/011/ +tags: + analytic_story: + confidence: 60 + impact: 100 + message: The process $process_name$ added a suspicious length of registry data on $dest$. + mitre_attack_id: + - T1027 + - T1027.011 + observable: + - name: dest + type: hostname + role: + - Victim + - name: user + type: user + role: + - Victim + - name: process + type: other + role: + - Attacker + - name: process_name + type: other + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - user + - dest + - process_id + - process_name + - process + - process_path + - parent_process_name + - parent_process + - process_guid + - registry_path + - registry_value_name + - registry_value_data + - registry_key_name + risk_score: 60 + security_domain: endpoint + tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml new file mode 100644 index 0000000000..c7d6807d78 --- /dev/null +++ b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml @@ -0,0 +1,75 @@ +name: Windows Scheduled Task Service Spawned Shell +id: d8120352-3b62-4e3c-8cb6-7b47584dd5e8 +version: 1 +date: '2023-06-13' +author: Steven Dick +status: production +type: TTP +description: The following analytic identifies when the Task Scheduler service "svchost.exe -k netsvcs -p -s Schedule" is the parent process +to common command line, scripting, or shell execution binaries. Attackers often abuse the task scheduler service with these binaries as an +execution and persistence mechanism in order to blend in with normal Windows operations. +This TTP is also commonly seen for legitimate purposes such as business scripts or application updates. +data_source: +- Sysmon 1 +- Windows Security 4688 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where +Processes.parent_process="*\\system32\\svchost.exe -k netsvcs -p -s Schedule*" Processes.process_name +IN("powershell.exe", "wscript.exe", "cscript.exe", "cmd.exe", "sh.exe", "ksh.exe", "zsh.exe", "bash.exe", "scrcons.exe","pwsh.exe") +by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_scheduled_task_service_spawned_shell_filter`' +how_to_implement: The following analytic requires Sysmon or Windows logging with +command line logging enabled. Use filter to remove known environment known false +positives prior to full production usage. +known_false_positives: Unknown, possible custom scripting. +references: +- https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations +- https://nasbench.medium.com/a-deep-dive-into-windows-scheduled-tasks-and-the-processes-running-them-218d1eed4cce +- https://attack.mitre.org/techniques/T1053/005/ +tags: + analytic_story: + - Windows Persistence Techniques + asset_type: Endpoint + confidence: 25 + impact: 80 + message: A windows scheduled task spawned the shell application $process_name$ on $dest$. + mitre_attack_id: + - T1053.005 + - T1059 + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + - name: process + type: Process Name + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + risk_score: 20 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog \ No newline at end of file From 9b1a632b39e1d3b5276b337bdf551ce2b7308a8b Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 11 Jul 2023 15:36:57 -0500 Subject: [PATCH 2/7] validation errors --- ...ss_executed_from_container_file_filter.yml | 26 +++++-------- .../windows_registry_payload_injection.yml | 37 ++++++------------- ...s_scheduled_task_service_spawned_shell.yml | 9 +---- 3 files changed, 23 insertions(+), 49 deletions(-) diff --git a/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml b/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml index 7635e9d772..d4d1154b55 100644 --- a/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml +++ b/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml @@ -1,28 +1,20 @@ name: Suspicious Process Executed From Container File -id: d8120352-3b62-4e3c-8cb6-7b47584dd5e8 +id: d8120352-3b62-411c-8cb6-7b47584dd5e8 version: 1 date: '2023-06-13' author: Steven Dick status: production type: TTP -description: This analytic identifies a suspicious process spawned by another process from within common container/archive -file types. This technique was a common technique used by adversaries and malware to execute scripts or evade defenses. -This TTP may detect some normal software installation or user behaviors where opening archive files is common. +description: This analytic identifies a suspicious process spawned by another process from within common container/archive file types. This technique was a common technique used by adversaries and malware to execute scripts or evade defenses. This TTP may detect some normal software installation or user behaviors where opening archive files is common. data_source: - Sysmon 1 - Windows Security 4688 -search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name min(_time) as firstTime max(_time) as lastTime -from datamodel=Endpoint.Processes where Processes.process IN ("*.ZIP\\*","*.ISO\\*","*.IMG\\*","*.CAB\\*","*.TAR\\*","*.GZ\\*","*.RAR\\*","*.7Z\\*") -AND Processes.action="allowed" by Processes.dest Processes.parent_process Processes.process Processes.user -| `drop_dm_object_name(Processes)` -| regex process="(?i).*(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z)\\\\.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH)\"?$" -| rex field=process "(?i).+\\\\(?[^\\\]+\.(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z))\\\\((.+\\\\)+)?(?.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH))\"?$" -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `suspicious_process_executed_from_container_file_filter`' -how_to_implement: The following analytic requires Sysmon or Windows logging with -command line logging enabled. Use filter to remove known environment known false -positives prior to full production usage. +search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*.ZIP\\*","*.ISO\\*","*.IMG\\*","*.CAB\\*","*.TAR\\*","*.GZ\\*","*.RAR\\*","*.7Z\\*") AND Processes.action="allowed" by Processes.dest Processes.parent_process Processes.process Processes.user| `drop_dm_object_name(Processes)`| regex process="(?i).*(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z)\\\\.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH)\"?$" | rex field=process "(?i).+\\\\(?[^\\\]+\.(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z))\\\\((.+\\\\)+)?(?.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH))\"?$"| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_executed_from_container_file_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: Various business process or userland applications and behavior. references: - https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations @@ -61,7 +53,7 @@ tags: - Processes.parent_process - Processes.process - Processes.user - risk_score: 40 + risk_score: 16 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_registry_payload_injection.yml b/detections/endpoint/windows_registry_payload_injection.yml index 3336452421..35746f8e48 100644 --- a/detections/endpoint/windows_registry_payload_injection.yml +++ b/detections/endpoint/windows_registry_payload_injection.yml @@ -3,31 +3,16 @@ id: c6b2d80f-179a-41a1-b95e-ce5601d7427a version: 1 date: '2023-06-15' author: Steven Dick +status: production type: TTP -description: The following analytic identifies when suspiciouly long data is written to the registry. This behavior is often -associated with certain fileless malware threats or persistence techniques used by threat actors. Data stored in the registy -is considered fileless since it does not get written to disk and is traditionally not well defended since normal users can -modify thier own registry. +description: The following analytic identifies when suspiciouly long data is written to the registry. This behavior is often associated with certain fileless malware threats or persistence techniques used by threat actors. Data stored in the registy is considered fileless since it does not get written to disk and is traditionally not well defended since normal users can modify thier own registry. data_source: - Sysmon EventID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime -FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name -Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid -| `drop_dm_object_name(Processes)` -| join max=0 dest process_guid [ -| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_value_data=* by _time span=1h -Registry.dest Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_value_data Registry.registry_key_name +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid| `drop_dm_object_name(Processes)` | join max=0 dest process_guid [| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_value_data=* by _time span=1h Registry.dest Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_value_data Registry.registry_key_name | `drop_dm_object_name(Registry)` | eval reg_data_len = len(registry_value_data) - | where reg_data_len > 512] -| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid -| where isnotnull(registry_value_data) -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `windows_registry_payload_injection_filter`' -how_to_implement: The following analytic requires Sysmon or Windows logging with -command line and registry modification logging enabled. Use filter to remove known -environment known false positives prior to full production usage. + | where reg_data_len > 512] | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_registry_payload_injection_filter`' +how_to_implement: The following analytic requires Sysmon or Windows logging with command line and registry modification logging enabled. Use filter to remove known environment known false positives prior to full production usage. known_false_positives: Unknown, possible custom scripting. references: - https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations @@ -35,6 +20,8 @@ references: - https://attack.mitre.org/techniques/T1027/011/ tags: analytic_story: + - Unusual Processes + asset_type: Endpoint confidence: 60 impact: 100 message: The process $process_name$ added a suspicious length of registry data on $dest$. @@ -43,19 +30,19 @@ tags: - T1027.011 observable: - name: dest - type: hostname + type: Endpoint role: - Victim - name: user - type: user + type: User role: - Victim - name: process - type: other + type: Process role: - Attacker - name: process_name - type: other + type: Process role: - Attacker product: @@ -79,7 +66,7 @@ tags: - registry_key_name risk_score: 60 security_domain: endpoint - tests: +tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log diff --git a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml index c7d6807d78..8915c89e14 100644 --- a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml +++ b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml @@ -5,10 +5,7 @@ date: '2023-06-13' author: Steven Dick status: production type: TTP -description: The following analytic identifies when the Task Scheduler service "svchost.exe -k netsvcs -p -s Schedule" is the parent process -to common command line, scripting, or shell execution binaries. Attackers often abuse the task scheduler service with these binaries as an -execution and persistence mechanism in order to blend in with normal Windows operations. -This TTP is also commonly seen for legitimate purposes such as business scripts or application updates. +description: The following analytic identifies when the Task Scheduler service "svchost.exe -k netsvcs -p -s Schedule" is the parent process to common command line, scripting, or shell execution binaries. Attackers often abuse the task scheduler service with these binaries as an execution and persistence mechanism in order to blend in with normal Windows operations. This TTP is also commonly seen for legitimate purposes such as business scripts or application updates. data_source: - Sysmon 1 - Windows Security 4688 @@ -20,9 +17,7 @@ by Processes.dest Processes.user Processes.parent_process Processes.process_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_task_service_spawned_shell_filter`' -how_to_implement: The following analytic requires Sysmon or Windows logging with -command line logging enabled. Use filter to remove known environment known false -positives prior to full production usage. +how_to_implement: The following analytic requires Sysmon or Windows logging with command line logging enabled. Use filter to remove known environment known false positives prior to full production usage. known_false_positives: Unknown, possible custom scripting. references: - https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations From a24d5c0c867149ef2ebc155e4fd3b7c58b02f218 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 24 Jul 2023 18:17:08 -0500 Subject: [PATCH 3/7] Update powershell_powershell_script_block_with_url_chain.yml --- .../powershell_powershell_script_block_with_url_chain.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/powershell_powershell_script_block_with_url_chain.yml b/detections/endpoint/powershell_powershell_script_block_with_url_chain.yml index c39f9d6851..527f228577 100644 --- a/detections/endpoint/powershell_powershell_script_block_with_url_chain.yml +++ b/detections/endpoint/powershell_powershell_script_block_with_url_chain.yml @@ -18,7 +18,7 @@ search: '`powershell` EventCode=4104 ScriptBlockText IN ("*http:*","*https:*") | rename Computer as dest, EventCode as signature_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` -| `powershell_scriptblock_with_url_chain_filter`' +| `powershell_script_block_with_url_chain_filter`' how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -71,4 +71,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: XmlWinEventLog From ac129ddf7bceb262c58ef99ccdf39bfc42004cfb Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 24 Jul 2023 18:45:19 -0700 Subject: [PATCH 4/7] Fixed name of one detection. Fixed misnamed macros in a handful of detections. Updated test information for all detections since they originally pointed to a single log file with multiple sources in it, leading to it being parsed incorrectly. --- ...l_chain.yml => powershell_script_block_with_url_chain.yml} | 4 ++-- .../endpoint/powershell_webrequest_using_memory_stream.yml | 4 ++-- ...suspicious_process_executed_from_container_file_filter.yml | 4 ++-- detections/endpoint/windows_registry_payload_injection.yml | 4 ++-- .../endpoint/windows_scheduled_task_service_spawned_shell.yml | 4 ++-- 5 files changed, 10 insertions(+), 10 deletions(-) rename detections/endpoint/{powershell_powershell_script_block_with_url_chain.yml => powershell_script_block_with_url_chain.yml} (96%) diff --git a/detections/endpoint/powershell_powershell_script_block_with_url_chain.yml b/detections/endpoint/powershell_script_block_with_url_chain.yml similarity index 96% rename from detections/endpoint/powershell_powershell_script_block_with_url_chain.yml rename to detections/endpoint/powershell_script_block_with_url_chain.yml index 527f228577..8c40215cdd 100644 --- a/detections/endpoint/powershell_powershell_script_block_with_url_chain.yml +++ b/detections/endpoint/powershell_script_block_with_url_chain.yml @@ -69,6 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/powershell_webrequest_using_memory_stream.yml b/detections/endpoint/powershell_webrequest_using_memory_stream.yml index 80efc992b6..41b2cadc90 100644 --- a/detections/endpoint/powershell_webrequest_using_memory_stream.yml +++ b/detections/endpoint/powershell_webrequest_using_memory_stream.yml @@ -16,7 +16,7 @@ search: '`powershell` EventCode=4104 ScriptBlockText IN ("*system.net.webclient | rename Computer as dest, EventCode as signature_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` -| `powershell_webrequest_using_memorystream_filter`' +| `powershell_webrequest_using_memory_stream_filter`' how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -64,6 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml b/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml index d4d1154b55..2afd72ceac 100644 --- a/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml +++ b/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml @@ -58,6 +58,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/endpoint/windows_registry_payload_injection.yml b/detections/endpoint/windows_registry_payload_injection.yml index 35746f8e48..15c7f08022 100644 --- a/detections/endpoint/windows_registry_payload_injection.yml +++ b/detections/endpoint/windows_registry_payload_injection.yml @@ -69,6 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml index 8915c89e14..1b30649708 100644 --- a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml +++ b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml @@ -65,6 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: xmlwineventlog \ No newline at end of file From 183902ba38e8e8726fc3a4814fe8f7a4613fa72b Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 7 Aug 2023 12:06:01 -0700 Subject: [PATCH 5/7] Update powershell_script_block_with_url_chain.yml --- .../endpoint/powershell_script_block_with_url_chain.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/powershell_script_block_with_url_chain.yml b/detections/endpoint/powershell_script_block_with_url_chain.yml index 8c40215cdd..dee0d121a2 100644 --- a/detections/endpoint/powershell_script_block_with_url_chain.yml +++ b/detections/endpoint/powershell_script_block_with_url_chain.yml @@ -14,7 +14,7 @@ search: '`powershell` EventCode=4104 ScriptBlockText IN ("*http:*","*https:*") | regex ScriptBlockText="(\"?(https?:\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b(?:[-a-zA-Z0-9()@:%_\+.~#?&\/=]*))\"?(?:,|\))?){2,}" | rex max_match=20 field=ScriptBlockText "(?https?:\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b(?:[-a-zA-Z0-9()@:%_\+.~#?&\/=]*))" | eval Path = case(isnotnull(Path),Path,true(),"unknown") -| stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command values(Path) as file_name values(user) as user values(url) as url dc(url) as url_count by ActivityID, Computer, EventCode +| stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command values(Path) as file_name values(UserID) as user values(url) as url dc(url) as url_count by ActivityID, Computer, EventCode | rename Computer as dest, EventCode as signature_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -71,4 +71,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: XmlWinEventLog From f8c9715966289cd5f749ebb904729b504c6b989d Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 7 Aug 2023 12:06:24 -0700 Subject: [PATCH 6/7] Update powershell_webrequest_using_memory_stream.yml --- .../endpoint/powershell_webrequest_using_memory_stream.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/powershell_webrequest_using_memory_stream.yml b/detections/endpoint/powershell_webrequest_using_memory_stream.yml index 41b2cadc90..379dd5b6d5 100644 --- a/detections/endpoint/powershell_webrequest_using_memory_stream.yml +++ b/detections/endpoint/powershell_webrequest_using_memory_stream.yml @@ -12,7 +12,7 @@ data_source: - Powershell 4104 search: '`powershell` EventCode=4104 ScriptBlockText IN ("*system.net.webclient*","*system.net.webrequest*") AND ScriptBlockText="*IO.MemoryStream*" | eval Path = case(isnotnull(Path),Path,true(),"unknown") -| stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command values(Path) as file_name values(user) as user by ActivityID, Computer, EventCode +| stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command values(Path) as file_name values(UserID) as user by ActivityID, Computer, EventCode | rename Computer as dest, EventCode as signature_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -66,4 +66,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: XmlWinEventLog From b80946f3633fdee16b004e785dd70e916ff71f51 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 7 Aug 2023 12:16:31 -0700 Subject: [PATCH 7/7] Update windows_scheduled_task_service_spawned_shell.yml --- .../endpoint/windows_scheduled_task_service_spawned_shell.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml index 1b30649708..bf72730ea2 100644 --- a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml +++ b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml @@ -10,7 +10,7 @@ data_source: - Sysmon 1 - Windows Security 4688 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where -Processes.parent_process="*\\system32\\svchost.exe -k netsvcs -p -s Schedule*" Processes.process_name +Processes.parent_process="*\\system32\\svchost.exe*" AND Processes.parent_process="*-k*" AND Processes.parent_process= "*netsvcs*" AND Processes.parent_process="*-p*" AND Processes.parent_process="*-s*" AND Processes.parent_process="*Schedule*" Processes.process_name IN("powershell.exe", "wscript.exe", "cscript.exe", "cmd.exe", "sh.exe", "ksh.exe", "zsh.exe", "bash.exe", "scrcons.exe","pwsh.exe") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` @@ -67,4 +67,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file + sourcetype: xmlwineventlog