mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
Bhavin Patel
@@ -0,0 +1,69 @@
|
||||
name: CMD Carry Out String Command Parameter
|
||||
id: 54a6ed00-3256-11ec-b031-acde48001122
|
||||
version: 1
|
||||
date: '2021-10-21'
|
||||
author: Teoderick Contreras, Splunk, Bhavin Patel, Splunk
|
||||
type: Hunting
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This search looks for command-line arguments where `cmd.exe /c` is used
|
||||
to execute a program. This technique is commonly seen in adversaries and malware
|
||||
to execute batch command using different shell like powershell or different process
|
||||
other than cmd.exe. This is a good hunting query for suspicious commandline made
|
||||
by a script or relative process execute it.
|
||||
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where `process_cmd` AND Processes.process="*
|
||||
/c *" by Processes.dest Processes.user Processes.parent_process Processes.process_name
|
||||
Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
|
||||
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| `cmd_carry_out_string_command_parameter_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
|
||||
tags:
|
||||
analytic_story:
|
||||
- IcedID
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/cmd_carry_str_param/sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1059.003
|
||||
- T1059
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.parent_process_name
|
||||
- Processes.parent_process
|
||||
- Processes.process_name
|
||||
- Processes.process_id
|
||||
- Processes.process
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_id
|
||||
security_domain: endpoint
|
||||
impact: 60
|
||||
confidence: 50
|
||||
risk_score: 30
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Execution
|
||||
message: $process_name$ with commandline $process$ in $dest$
|
||||
observable:
|
||||
- name: dest
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
- name: user
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,66 @@
|
||||
name: Disable Defender AntiVirus Registry
|
||||
id: aa4f695a-3024-11ec-9987-acde48001122
|
||||
version: 1
|
||||
date: '2021-10-18'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This particular behavior is typically executed when an adversaries or
|
||||
malware gains access to an endpoint and beings to perform execution and to evade
|
||||
detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
|
||||
task modifications will occur. During triage, review parallel processes and identify
|
||||
any further file modifications. Endpoint should be isolated.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows
|
||||
Defender*" Registry.registry_value_name = DisableAntiVirus Registry.registry_value_data
|
||||
= 0x00000001 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
|
||||
Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
|
||||
| `security_content_ctime(firstTime)` | `disable_defender_antivirus_registry_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the registry value name, registry path, and registry value data from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: admin or user may choose to disable windows defender product
|
||||
references:
|
||||
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
|
||||
tags:
|
||||
analytic_story:
|
||||
- IceID
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
- T1562
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.dest
|
||||
- Registry.user
|
||||
- Registry.registry_value_name
|
||||
- Registry.registry_key_name
|
||||
- Registry.registry_path
|
||||
- Registry.registry_value_data
|
||||
security_domain: endpoint
|
||||
impact: 70
|
||||
confidence: 70
|
||||
risk_score: 49
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
message: modified/added/deleted registry entry $registry_path$ in $dest$
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: user
|
||||
type: user
|
||||
role:
|
||||
- Victim
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,65 @@
|
||||
name: Disable Defender BlockAtFirstSeen Feature
|
||||
id: 2dd719ac-3021-11ec-97b4-acde48001122
|
||||
version: 1
|
||||
date: '2021-10-18'
|
||||
author: Teoderick Contreras
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This analytic is to detect a suspicious modification of registry to disable
|
||||
windows defender feature. This technique is to bypassed or evade detection from
|
||||
Windows Defender AV product specially the BlockAtFirstSeen feature where it block
|
||||
suspicious file first seen in the host.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows
|
||||
Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data
|
||||
= 0x00000001 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
|
||||
Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
|
||||
| `security_content_ctime(firstTime)` | `disable_defender_blockatfirstseen_feature_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the registry value name, registry path, and registry value data from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: admin or user may choose to disable windows defender product
|
||||
references:
|
||||
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
|
||||
tags:
|
||||
analytic_story:
|
||||
- IceID
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
- T1562
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.dest
|
||||
- Registry.user
|
||||
- Registry.registry_value_name
|
||||
- Registry.registry_key_name
|
||||
- Registry.registry_path
|
||||
- Registry.registry_value_data
|
||||
security_domain: endpoint
|
||||
impact: 70
|
||||
confidence: 70
|
||||
risk_score: 49
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
message: modified/added/deleted registry entry $registry_path$ in $dest$
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: user
|
||||
type: user
|
||||
role:
|
||||
- Victim
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,65 @@
|
||||
name: Disable Defender Enhanced Notification
|
||||
id: dc65678c-301f-11ec-8e30-acde48001122
|
||||
version: 1
|
||||
date: '2021-10-18'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This analytic is to detect a suspicious modification of registry to disable
|
||||
windows defender feature. This technique is to bypassed or evade detection from
|
||||
Windows Defender AV product specially the Enhanced Notification feature wher user
|
||||
or admin set to show or display alerts.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*Microsoft\\Windows
|
||||
Defender\\Reporting*" Registry.registry_value_name = DisableEnhancedNotifications
|
||||
Registry.registry_value_data = 0x00000001 by Registry.dest Registry.user Registry.registry_path
|
||||
Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)`
|
||||
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_defender_enhanced_notification_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the registry value name, registry path, and registry value data executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: user may choose to disable windows defender AV
|
||||
references:
|
||||
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
|
||||
tags:
|
||||
analytic_story:
|
||||
- IceID
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
- T1562
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.dest
|
||||
- Registry.user
|
||||
- Registry.registry_value_name
|
||||
- Registry.registry_key_name
|
||||
- Registry.registry_path
|
||||
- Registry.registry_value_data
|
||||
security_domain: endpoint
|
||||
impact: 70
|
||||
confidence: 70
|
||||
risk_score: 49
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
message: modified/added/deleted registry entry $registry_path$ in $dest$
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: user
|
||||
type: user
|
||||
role:
|
||||
- Victim
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,66 @@
|
||||
name: Disable Defender MpEngine Registry
|
||||
id: cc391750-3024-11ec-955a-acde48001122
|
||||
version: 1
|
||||
date: '2021-10-18'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This particular behavior is typically executed when an adversaries or
|
||||
malware gains access to an endpoint and beings to perform execution and to evade
|
||||
detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
|
||||
task modifications will occur. During triage, review parallel processes and identify
|
||||
any further file modifications. Endpoint should be isolated.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows
|
||||
Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data
|
||||
= 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
|
||||
Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
|
||||
| `security_content_ctime(firstTime)` | `disable_defender_mpengine_registry_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the registry value name, registry path, and registry value data from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: admin or user may choose to disable windows defender product
|
||||
references:
|
||||
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
|
||||
tags:
|
||||
analytic_story:
|
||||
- IceID
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
- T1562
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.dest
|
||||
- Registry.user
|
||||
- Registry.registry_value_name
|
||||
- Registry.registry_key_name
|
||||
- Registry.registry_path
|
||||
- Registry.registry_value_data
|
||||
security_domain: endpoint
|
||||
impact: 70
|
||||
confidence: 70
|
||||
risk_score: 49
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
message: modified/added/deleted registry entry $registry_path$ in $dest$
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: user
|
||||
type: user
|
||||
role:
|
||||
- Victim
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,64 @@
|
||||
name: Disable Defender Spynet Reporting
|
||||
id: 898debf4-3021-11ec-ba7c-acde48001122
|
||||
version: 1
|
||||
date: '2021-10-18'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This analytic is to detect a suspicious modification of registry to disable
|
||||
windows defender feature. This technique is to bypassed or evade detection from
|
||||
Windows Defender AV product specially the spynet reporting for its telemetry.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows
|
||||
Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data
|
||||
= 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
|
||||
Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
|
||||
| `security_content_ctime(firstTime)` | `disable_defender_spynet_reporting_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the registry value name, registry path, and registry value data from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: admin or user may choose to disable windows defender product
|
||||
references:
|
||||
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
|
||||
tags:
|
||||
analytic_story:
|
||||
- IceID
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
- T1562
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.dest
|
||||
- Registry.user
|
||||
- Registry.registry_value_name
|
||||
- Registry.registry_key_name
|
||||
- Registry.registry_path
|
||||
- Registry.registry_value_data
|
||||
security_domain: endpoint
|
||||
impact: 70
|
||||
confidence: 70
|
||||
risk_score: 49
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
message: modified/added/deleted registry entry $registry_path$ in $dest$
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: user
|
||||
type: user
|
||||
role:
|
||||
- Victim
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,64 @@
|
||||
name: Disable Defender Submit Samples Consent Feature
|
||||
id: 73922ff8-3022-11ec-bf5e-acde48001122
|
||||
version: 1
|
||||
date: '2021-10-18'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: his analytic is to detect a suspicious modification of registry to disable
|
||||
windows defender feature. This technique is to bypassed or evade detection from
|
||||
Windows Defender AV product specially the submit samples feature for further analysis..
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows
|
||||
Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data
|
||||
= 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
|
||||
Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
|
||||
| `security_content_ctime(firstTime)` | `disable_defender_submit_samples_consent_feature_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the registry value name, registry path, and registry value data from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: admin or user may choose to disable windows defender product
|
||||
references:
|
||||
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
|
||||
tags:
|
||||
analytic_story:
|
||||
- IceID
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
- T1562
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.dest
|
||||
- Registry.user
|
||||
- Registry.registry_value_name
|
||||
- Registry.registry_key_name
|
||||
- Registry.registry_path
|
||||
- Registry.registry_value_data
|
||||
security_domain: endpoint
|
||||
impact: 70
|
||||
confidence: 70
|
||||
risk_score: 49
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: user
|
||||
type: user
|
||||
role:
|
||||
- Victim
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,62 @@
|
||||
name: Disable Schedule Task
|
||||
id: db596056-3019-11ec-a9ff-acde48001122
|
||||
version: 1
|
||||
date: '2021-10-18'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This analytic is to detect a suspicious commandline to disable existing
|
||||
schedule task. This technique is used by adversaries or commodity malware like IceID
|
||||
to disable security application (AV products) in the targetted host to evade detections.
|
||||
This TTP is a good pivot to check further why and what other process run before
|
||||
and after this detection. check which process execute the commandline and what task
|
||||
is disabled. parent child process is quite valuable in this scenario too.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
|
||||
max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe
|
||||
Processes.process=*/change* Processes.process=*/disable* by Processes.user Processes.process_name
|
||||
Processes.process Processes.parent_process_name Processes.parent_process Processes.dest
|
||||
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| `disable_schedule_task_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: admin may disable problematic schedule task
|
||||
references:
|
||||
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
|
||||
tags:
|
||||
analytic_story:
|
||||
- IcedID
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_schtask/sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
- T1562
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.user
|
||||
- Processes.process_name
|
||||
- Processes.parent_process_name
|
||||
- Processes.dest
|
||||
security_domain: endpoint
|
||||
impact: 70
|
||||
confidence: 80
|
||||
risk_score: 56
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
message: schtask process with commandline $process$ to disable schedule task in
|
||||
$dest$
|
||||
observable:
|
||||
- name: dest
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,67 @@
|
||||
name: Disabling Defender Services
|
||||
id: 911eacdc-317f-11ec-ad30-acde48001122
|
||||
version: 1
|
||||
date: '2021-10-20'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This particular behavior is typically executed when an adversaries or
|
||||
malware gains access to an endpoint and beings to perform execution and to evade
|
||||
detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
|
||||
task modifications will occur. During triage, review parallel processes and identify
|
||||
any further file modifications. Endpoint should be isolated.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*"
|
||||
AND (Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*",
|
||||
"*WinDefend*", "*SecurityHealthService*")) AND Registry.registry_value_name = Start
|
||||
Registry.registry_value_data = 0x00000004 by Registry.dest Registry.user Registry.registry_path
|
||||
Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)`
|
||||
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disabling_defender_services_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: admin or user may choose to disable windows defender product
|
||||
references:
|
||||
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
|
||||
tags:
|
||||
analytic_story:
|
||||
- IceID
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
- T1562
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.dest
|
||||
- Registry.user
|
||||
- Registry.registry_value_name
|
||||
- Registry.registry_key_name
|
||||
- Registry.registry_path
|
||||
- Registry.registry_value_data
|
||||
security_domain: endpoint
|
||||
impact: 70
|
||||
confidence: 70
|
||||
risk_score: 49
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
message: modified/added/deleted registry entry $registry_path$ in $dest$
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: user
|
||||
type: user
|
||||
role:
|
||||
- Victim
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,79 @@
|
||||
name: Wmic NonInteractive App Uninstallation
|
||||
id: bff0e7a0-317f-11ec-ab4e-acde48001122
|
||||
version: 1
|
||||
date: '2021-10-20'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Hunting
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This analytic is to detect a suspicious wmic commandlined that uninstall
|
||||
application non interactively. This technique was seen in IceID to uninstall av
|
||||
products to the compromised host to bypassed and evade detections. This Hunting
|
||||
query maybe a good indicator that some process tries to uninstall application using
|
||||
wmic which is not a common behavior. This approach may seen in some script or third
|
||||
part appication to uninstall their application but it is a good thing to check what
|
||||
it uninstall and why.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe
|
||||
Processes.process="* product *" Processes.process="*where name*" Processes.process="*call
|
||||
uninstall*" Processes.process="*/nointeractive*" by Processes.dest Processes.user
|
||||
Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name
|
||||
Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmic_noninteractive_app_uninstallation_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: third party application may use this approach to uninstall
|
||||
there application
|
||||
references:
|
||||
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
|
||||
tags:
|
||||
analytic_story:
|
||||
- IceID
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
- T1562
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process_name
|
||||
- Processes.parent_process
|
||||
- Processes.original_file_name
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_path
|
||||
- Processes.process_path
|
||||
- Processes.parent_process_id
|
||||
security_domain: endpoint
|
||||
impact: 50
|
||||
confidence: 50
|
||||
risk_score: 25
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
message: wmic $process$ with commandline $process$ in $dest$
|
||||
observable:
|
||||
- name: dest
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
- name: user
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: process_name
|
||||
type: Process
|
||||
role:
|
||||
- Target
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,12 @@
|
||||
name: CMD Carry Out String Command Parameter Unit Test
|
||||
tests:
|
||||
- name: CMD Carry Out String Command Parameter
|
||||
file: endpoint/cmd_carry_out_string_command_parameter.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/cmd_carry_str_param/sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Disable Defender AntiVirus Registry Unit Test
|
||||
tests:
|
||||
- name: Disable Defender AntiVirus Registry
|
||||
file: endpoint/disable_defender_antivirus_registry.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Disable Defender BlockAtFirstSeen Feature Unit Test
|
||||
tests:
|
||||
- name: Disable Defender BlockAtFirstSeen Feature
|
||||
file: endpoint/disable_defender_blockatfirstseen_feature.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Disable Defender Enhanced Notification Unit Test
|
||||
tests:
|
||||
- name: Disable Defender Enhanced Notification
|
||||
file: endpoint/disable_defender_enhanced_notification.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Disable Defender MpEngine Registry Unit Test
|
||||
tests:
|
||||
- name: Disable Defender MpEngine Registry
|
||||
file: endpoint/disable_defender_mpengine_registry.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Disable Defender Spynet Reporting Unit Test
|
||||
tests:
|
||||
- name: Disable Defender Spynet Reporting
|
||||
file: endpoint/disable_defender_spynet_reporting.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Disable Defender Submit Samples Consent Feature Unit Test
|
||||
tests:
|
||||
- name: Disable Defender Submit Samples Consent Feature
|
||||
file: endpoint/disable_defender_submit_samples_consent_feature.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Disable Schedule Task Unit Test
|
||||
tests:
|
||||
- name: Disable Schedule Task
|
||||
file: endpoint/disable_schedule_task.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_schtask/sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Disabling Defender Services Unit Test
|
||||
tests:
|
||||
- name: Disabling Defender Services
|
||||
file: endpoint/disabling_defender_services.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: sysmon2.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Wmic NonInteractive App Uninstallation Unit Test
|
||||
tests:
|
||||
- name: Wmic NonInteractive App Uninstallation
|
||||
file: endpoint/wmic_noninteractive_app_uninstallation.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: sysmon2.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
Reference in New Issue
Block a user