diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml new file mode 100644 index 0000000000..5d3290232e --- /dev/null +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -0,0 +1,69 @@ +name: CMD Carry Out String Command Parameter +id: 54a6ed00-3256-11ec-b031-acde48001122 +version: 1 +date: '2021-10-21' +author: Teoderick Contreras, Splunk, Bhavin Patel, Splunk +type: Hunting +datamodel: +- Endpoint +description: This search looks for command-line arguments where `cmd.exe /c` is used + to execute a program. This technique is commonly seen in adversaries and malware + to execute batch command using different shell like powershell or different process + other than cmd.exe. This is a good hunting query for suspicious commandline made + by a script or relative process execute it. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_cmd` AND Processes.process="* + /c *" by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `cmd_carry_out_string_command_parameter_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ +tags: + analytic_story: + - IcedID + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/cmd_carry_str_param/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.003 + - T1059 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.process + - Processes.dest + - Processes.user + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 60 + confidence: 50 + risk_score: 30 + context: + - Source:Endpoint + - Stage:Execution + message: $process_name$ with commandline $process$ in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml new file mode 100644 index 0000000000..be393f739c --- /dev/null +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -0,0 +1,66 @@ +name: Disable Defender AntiVirus Registry +id: aa4f695a-3024-11ec-9987-acde48001122 +version: 1 +date: '2021-10-18' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This particular behavior is typically executed when an adversaries or + malware gains access to an endpoint and beings to perform execution and to evade + detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled + task modifications will occur. During triage, review parallel processes and identify + any further file modifications. Endpoint should be isolated. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows + Defender*" Registry.registry_value_name = DisableAntiVirus Registry.registry_value_data + = 0x00000001 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name + Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `disable_defender_antivirus_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: admin or user may choose to disable windows defender product +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ +tags: + analytic_story: + - IceID + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: modified/added/deleted registry entry $registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml new file mode 100644 index 0000000000..24d821cbba --- /dev/null +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -0,0 +1,65 @@ +name: Disable Defender BlockAtFirstSeen Feature +id: 2dd719ac-3021-11ec-97b4-acde48001122 +version: 1 +date: '2021-10-18' +author: Teoderick Contreras +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious modification of registry to disable + windows defender feature. This technique is to bypassed or evade detection from + Windows Defender AV product specially the BlockAtFirstSeen feature where it block + suspicious file first seen in the host. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows + Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data + = 0x00000001 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name + Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `disable_defender_blockatfirstseen_feature_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: admin or user may choose to disable windows defender product +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ +tags: + analytic_story: + - IceID + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: modified/added/deleted registry entry $registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml new file mode 100644 index 0000000000..3f349bd1ed --- /dev/null +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -0,0 +1,65 @@ +name: Disable Defender Enhanced Notification +id: dc65678c-301f-11ec-8e30-acde48001122 +version: 1 +date: '2021-10-18' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious modification of registry to disable + windows defender feature. This technique is to bypassed or evade detection from + Windows Defender AV product specially the Enhanced Notification feature wher user + or admin set to show or display alerts. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*Microsoft\\Windows + Defender\\Reporting*" Registry.registry_value_name = DisableEnhancedNotifications + Registry.registry_value_data = 0x00000001 by Registry.dest Registry.user Registry.registry_path + Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_defender_enhanced_notification_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: user may choose to disable windows defender AV +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ +tags: + analytic_story: + - IceID + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: modified/added/deleted registry entry $registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml new file mode 100644 index 0000000000..9004ac9271 --- /dev/null +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -0,0 +1,66 @@ +name: Disable Defender MpEngine Registry +id: cc391750-3024-11ec-955a-acde48001122 +version: 1 +date: '2021-10-18' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This particular behavior is typically executed when an adversaries or + malware gains access to an endpoint and beings to perform execution and to evade + detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled + task modifications will occur. During triage, review parallel processes and identify + any further file modifications. Endpoint should be isolated. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows + Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data + = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name + Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `disable_defender_mpengine_registry_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: admin or user may choose to disable windows defender product +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ +tags: + analytic_story: + - IceID + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: modified/added/deleted registry entry $registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml new file mode 100644 index 0000000000..a7816063bd --- /dev/null +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -0,0 +1,64 @@ +name: Disable Defender Spynet Reporting +id: 898debf4-3021-11ec-ba7c-acde48001122 +version: 1 +date: '2021-10-18' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious modification of registry to disable + windows defender feature. This technique is to bypassed or evade detection from + Windows Defender AV product specially the spynet reporting for its telemetry. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows + Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data + = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name + Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `disable_defender_spynet_reporting_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: admin or user may choose to disable windows defender product +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ +tags: + analytic_story: + - IceID + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: modified/added/deleted registry entry $registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml new file mode 100644 index 0000000000..864719bfca --- /dev/null +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -0,0 +1,64 @@ +name: Disable Defender Submit Samples Consent Feature +id: 73922ff8-3022-11ec-bf5e-acde48001122 +version: 1 +date: '2021-10-18' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: his analytic is to detect a suspicious modification of registry to disable + windows defender feature. This technique is to bypassed or evade detection from + Windows Defender AV product specially the submit samples feature for further analysis.. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows + Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data + = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name + Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `disable_defender_submit_samples_consent_feature_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the registry value name, registry path, and registry value data from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: admin or user may choose to disable windows defender product +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ +tags: + analytic_story: + - IceID + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/disable_schedule_task.yml b/detections/endpoint/disable_schedule_task.yml new file mode 100644 index 0000000000..b860cc10a7 --- /dev/null +++ b/detections/endpoint/disable_schedule_task.yml @@ -0,0 +1,62 @@ +name: Disable Schedule Task +id: db596056-3019-11ec-a9ff-acde48001122 +version: 1 +date: '2021-10-18' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to detect a suspicious commandline to disable existing + schedule task. This technique is used by adversaries or commodity malware like IceID + to disable security application (AV products) in the targetted host to evade detections. + This TTP is a good pivot to check further why and what other process run before + and after this detection. check which process execute the commandline and what task + is disabled. parent child process is quite valuable in this scenario too. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe + Processes.process=*/change* Processes.process=*/disable* by Processes.user Processes.process_name + Processes.process Processes.parent_process_name Processes.parent_process Processes.dest + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `disable_schedule_task_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: admin may disable problematic schedule task +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ +tags: + analytic_story: + - IcedID + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_schtask/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.user + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + security_domain: endpoint + impact: 70 + confidence: 80 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: schtask process with commandline $process$ to disable schedule task in + $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml new file mode 100644 index 0000000000..ea6063fb95 --- /dev/null +++ b/detections/endpoint/disabling_defender_services.yml @@ -0,0 +1,67 @@ +name: Disabling Defender Services +id: 911eacdc-317f-11ec-ad30-acde48001122 +version: 1 +date: '2021-10-20' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This particular behavior is typically executed when an adversaries or + malware gains access to an endpoint and beings to perform execution and to evade + detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled + task modifications will occur. During triage, review parallel processes and identify + any further file modifications. Endpoint should be isolated. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" + AND (Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*", + "*WinDefend*", "*SecurityHealthService*")) AND Registry.registry_value_name = Start + Registry.registry_value_data = 0x00000004 by Registry.dest Registry.user Registry.registry_path + Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disabling_defender_services_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: admin or user may choose to disable windows defender product +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ +tags: + analytic_story: + - IceID + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.dest + - Registry.user + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: modified/added/deleted registry entry $registry_path$ in $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: user + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml new file mode 100644 index 0000000000..f6a49d4547 --- /dev/null +++ b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml @@ -0,0 +1,79 @@ +name: Wmic NonInteractive App Uninstallation +id: bff0e7a0-317f-11ec-ab4e-acde48001122 +version: 1 +date: '2021-10-20' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic is to detect a suspicious wmic commandlined that uninstall + application non interactively. This technique was seen in IceID to uninstall av + products to the compromised host to bypassed and evade detections. This Hunting + query maybe a good indicator that some process tries to uninstall application using + wmic which is not a common behavior. This approach may seen in some script or third + part appication to uninstall their application but it is a good thing to check what + it uninstall and why. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe + Processes.process="* product *" Processes.process="*where name*" Processes.process="*call + uninstall*" Processes.process="*/nointeractive*" by Processes.dest Processes.user + Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmic_noninteractive_app_uninstallation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: third party application may use this approach to uninstall + there application +references: +- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ +tags: + analytic_story: + - IceID + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: wmic $process$ with commandline $process$ in $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + - name: process_name + type: Process + role: + - Target + automated_detection_testing: passed diff --git a/tests/endpoint/cmd_carry_out_string_command_parameter.test.yml b/tests/endpoint/cmd_carry_out_string_command_parameter.test.yml new file mode 100644 index 0000000000..c39f5caf49 --- /dev/null +++ b/tests/endpoint/cmd_carry_out_string_command_parameter.test.yml @@ -0,0 +1,12 @@ +name: CMD Carry Out String Command Parameter Unit Test +tests: +- name: CMD Carry Out String Command Parameter + file: endpoint/cmd_carry_out_string_command_parameter.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/cmd_carry_str_param/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disable_defender_antivirus_registry.test.yml b/tests/endpoint/disable_defender_antivirus_registry.test.yml new file mode 100644 index 0000000000..7bc896bf0d --- /dev/null +++ b/tests/endpoint/disable_defender_antivirus_registry.test.yml @@ -0,0 +1,12 @@ +name: Disable Defender AntiVirus Registry Unit Test +tests: +- name: Disable Defender AntiVirus Registry + file: endpoint/disable_defender_antivirus_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disable_defender_blockatfirstseen_feature.test.yml b/tests/endpoint/disable_defender_blockatfirstseen_feature.test.yml new file mode 100644 index 0000000000..c59a71686e --- /dev/null +++ b/tests/endpoint/disable_defender_blockatfirstseen_feature.test.yml @@ -0,0 +1,12 @@ +name: Disable Defender BlockAtFirstSeen Feature Unit Test +tests: +- name: Disable Defender BlockAtFirstSeen Feature + file: endpoint/disable_defender_blockatfirstseen_feature.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disable_defender_enhanced_notification.test.yml b/tests/endpoint/disable_defender_enhanced_notification.test.yml new file mode 100644 index 0000000000..04986935f3 --- /dev/null +++ b/tests/endpoint/disable_defender_enhanced_notification.test.yml @@ -0,0 +1,12 @@ +name: Disable Defender Enhanced Notification Unit Test +tests: +- name: Disable Defender Enhanced Notification + file: endpoint/disable_defender_enhanced_notification.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disable_defender_mpengine_registry.test.yml b/tests/endpoint/disable_defender_mpengine_registry.test.yml new file mode 100644 index 0000000000..a54f28cc63 --- /dev/null +++ b/tests/endpoint/disable_defender_mpengine_registry.test.yml @@ -0,0 +1,12 @@ +name: Disable Defender MpEngine Registry Unit Test +tests: +- name: Disable Defender MpEngine Registry + file: endpoint/disable_defender_mpengine_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disable_defender_spynet_reporting.test.yml b/tests/endpoint/disable_defender_spynet_reporting.test.yml new file mode 100644 index 0000000000..2c4152f134 --- /dev/null +++ b/tests/endpoint/disable_defender_spynet_reporting.test.yml @@ -0,0 +1,12 @@ +name: Disable Defender Spynet Reporting Unit Test +tests: +- name: Disable Defender Spynet Reporting + file: endpoint/disable_defender_spynet_reporting.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disable_defender_submit_samples_consent_feature.test.yml b/tests/endpoint/disable_defender_submit_samples_consent_feature.test.yml new file mode 100644 index 0000000000..f981577b65 --- /dev/null +++ b/tests/endpoint/disable_defender_submit_samples_consent_feature.test.yml @@ -0,0 +1,12 @@ +name: Disable Defender Submit Samples Consent Feature Unit Test +tests: +- name: Disable Defender Submit Samples Consent Feature + file: endpoint/disable_defender_submit_samples_consent_feature.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disable_schedule_task.test.yml b/tests/endpoint/disable_schedule_task.test.yml new file mode 100644 index 0000000000..b12f5e2458 --- /dev/null +++ b/tests/endpoint/disable_schedule_task.test.yml @@ -0,0 +1,12 @@ +name: Disable Schedule Task Unit Test +tests: +- name: Disable Schedule Task + file: endpoint/disable_schedule_task.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_schtask/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/disabling_defender_services.test.yml b/tests/endpoint/disabling_defender_services.test.yml new file mode 100644 index 0000000000..c22cc73c4f --- /dev/null +++ b/tests/endpoint/disabling_defender_services.test.yml @@ -0,0 +1,12 @@ +name: Disabling Defender Services Unit Test +tests: +- name: Disabling Defender Services + file: endpoint/disabling_defender_services.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon2.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/wmic_noninteractive_app_uninstallation.test.yml b/tests/endpoint/wmic_noninteractive_app_uninstallation.test.yml new file mode 100644 index 0000000000..1bf7a12066 --- /dev/null +++ b/tests/endpoint/wmic_noninteractive_app_uninstallation.test.yml @@ -0,0 +1,12 @@ +name: Wmic NonInteractive App Uninstallation Unit Test +tests: +- name: Wmic NonInteractive App Uninstallation + file: endpoint/wmic_noninteractive_app_uninstallation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon2.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file