Branch was auto-updated.

detections/endpoint/ssa___wbadmin_delete_system_backups.yml

@@ -14,10 +14,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  (cmd_line IS NOT NULL AND process_name IS NOT NULL) AND (process_name="wbadmin.exe"
-  AND like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line,
-  "%systemstatebackup%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where (cmd_line IS NOT NULL AND process_name IS NOT NULL)
+  | where process_name="wbadmin.exe"
+  | where like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line,  "%systemstatebackup%")
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name, "parent_process_name", parent_process_name, "process_path", process_path])

detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml

@@ -0,0 +1,91 @@
+name: Windows Script Host Spawn MSBuild
+id: 92886f1c-9b11-11ec-848a-acde48001122
+version: 1
+date: '2022-03-03'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This analytic is to detect a suspicious child process of MSBuild spawned
+  by Windows Script Host - cscript or wscript. This behavior or event are commonly
+  seen and used by malware or adversaries to execute malicious msbuild process using
+  malicious script in the compromised host. During triage, review parallel processes
+  and identify any file modifications. MSBuild may load a script from the same path
+  without having command-line arguments.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT NULL | where (parent_process_name LIKE "%wscript.exe" OR parent_process_name LIKE "%cscript.exe%") AND process_name="msbuild.exe"
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives should be limited as developers do not spawn
+  MSBuild via a WSH.
+references:
+- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#
+- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1127.001_MSBuild/InvokeMSBuild.ps1
+tags:
+  analytic_story:
+  - Trusted Developer Utilities Proxy Execution MSBuild
+  - Living Off The Land
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1127.001
+  - T1127
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$.
+  nist:
+  - PR.PT
+  - DE.CM
+  cis20:
+  - CIS 8
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process Name
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  asset_type: Endpoint

detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml

@@ -0,0 +1,92 @@
+name: Windows WMIPrvse Spawn MSBuild
+id: 76b3b290-9b31-11ec-a934-acde48001122
+version: 1
+date: '2022-03-03'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies wmiprvse.exe spawning msbuild.exe.
+  This behavior is indicative of a COM object being utilized to spawn msbuild from
+  wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using
+  Visual Studio. In this instance, there will be command line arguments and file paths.
+  In a malicious instance, MSBuild.exe will spawn from non-standard processes and
+  have no command line arguments. For example, MSBuild.exe spawning from explorer.exe,
+  powershell.exe is far less common and should be investigated.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=lower(ucast(map_get(input_event, "parent_process_name"), "string",
+  null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT NULL | where parent_process_name LIKE "%wmiprvse.exe%" AND process_name="msbuild.exe"
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+tags:
+  analytic_story:
+  - Trusted Developer Utilities Proxy Execution MSBuild
+  - Living Off The Land
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1127
+  - T1127.001
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$.
+  nist:
+  - PR.PT
+  - DE.CM
+  cis20:
+  - CIS 8
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process Name
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  asset_type: Endpoint

detections/endpoint/suspicious_msbuild_path.yml

@@ -1,7 +1,7 @@
 name: Suspicious msbuild path
 id: f5198224-551c-11eb-ae93-0242ac130002
-version: 2
-date: '2021-01-12'
+version: 3
+date: '2022-03-08'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -13,7 +13,7 @@ description: The following analytic identifies msbuild.exe executing from a non-
   there are instances of build applications that will move or use a copy of MSBuild.
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_msbuild` AND (Processes.process_path!=c:\\windows\\microsoft.net\\framework*\\v*\\*)
+  as lastTime from datamodel=Endpoint.Processes where `process_msbuild` AND (Processes.process_path!=*\\framework*\\v*\\*)
   by Processes.dest Processes.original_file_name Processes.parent_process Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
   `suspicious_msbuild_path_filter`'

dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml

@@ -1,63 +0,0 @@
-name: WBAdmin Delete System Backups
-id: 71efbf52-4dbb-4c00-a520-306aa546cbb7
-version: 1
-description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
-  Tool) that delete backup files. This is typically used by ransomware to prevent
-  recovery.
-search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
-  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
-  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
-  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
-  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  (cmd_line IS NOT NULL AND process_name IS NOT NULL) AND (process_name="wbadmin.exe"
-  AND like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line,
-  "%systemstatebackup%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
-  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
-  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
-  | into write_ssa_detected_events();'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint_Processess` datamodel.
-known_false_positives: Administrators may modify the boot configuration.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
-- https://thedfirreport.com/2020/10/08/ryuks-return/
-- https://attack.mitre.org/techniques/T1490/
-- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
-tags:
-  analytic_story:
-  - Ryuk Ransomware
-  - Ransomware
-  cis20:
-  - CIS 8
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1490
-  nist:
-  - PR.AC
-  - PR.IP
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - cmd_line
-  risk_score: 15
-  security_domain: endpoint
-  risk_severity: low
-test:
-  name: WBAdmin Delete System Backups Unit Test
-  tests:
-  - name: WBAdmin Delete System Backups
-    file: endpoint/ssa___wbadmin_delete_system_backups.yml
-    pass_condition: '@count_gt(0)'
-    attack_data:
-    - file_name: windows-sysmon.log
-      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
-      source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml

@@ -5,6 +5,6 @@ tests:
   pass_condition: '@count_gt(0)'
   description: Test detection of WBAdmin Delete System Backups
   attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+  - file_name: windows-security_bcdedit_wbadmin.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log
+    source: WinEventLog:Security

tests/endpoint/ssa___windows_script_host_spawn_msbuild.test.yml

@@ -0,0 +1,9 @@
+name: Windows Script Host Spawn MSBuild Unit Test
+tests:
+- name: Windows Script Host Spawn MSBuild
+  file: endpoint/ssa___windows_script_host_spawn_msbuild.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: msbuild-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log
+    source: WinEventLog:Security

tests/endpoint/ssa___windows_wmiprvse_spawn_msbuild.test.yml

@@ -0,0 +1,9 @@
+name: Windows WMIPrvse Spawn MSBuild Unit Test
+tests:
+- name: Windows WMIPrvse Spawn MSBuild
+  file: endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: msbuild-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log
+    source: WinEventLog:Security