Branch was auto-updated.

detections/endpoint/windows_event_for_service_disabled.yml

@@ -0,0 +1,62 @@
+name: Windows Event For Service Disabled
+id: 9c2620a8-94a1-11ec-b40c-acde48001122
+version: 1
+date: '2022-02-23'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic will identify suspicious system event of services that was modified from start to disabled. 
+  This technique is seen where the adversary attempts to disable security app services, other malware services to evade the defense systems on the compromised host
+search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from demand start to disabled." 
+  | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Message User Sid
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_event_for_service_disabled_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the Service name, Service File Name Service Start type, and Service Type
+  from your endpoints.
+known_false_positives: Windows service update may cause this event. In that scenario, filtering is needed.
+references:
+-  https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/system.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ComputerName 
+  - EventCode 
+  - Message 
+  - User 
+  - Sid
+  security_domain: endpoint
+  impact: 60
+  confidence: 60 
+  # (impact * confidence)/100
+  risk_score: 36
+  context: 
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: Service was disabled on $Computer$
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16

detections/endpoint/windows_excessive_disabled_services_event.yml

@@ -0,0 +1,65 @@
+name: Windows Excessive Disabled Services Event
+id: c3f85976-94a5-11ec-9a58-acde48001122
+version: 1
+date: '2022-02-23'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic will identify suspicious excessive number of system events of services that was modified from start to disabled. 
+  This technique is seen where the adversary attempts to disable security app services, other malware services oer serve as an destructive impact
+  to complete the objective on the compromised system. One good example for this scenario is Olympic destroyer where it disable all active services 
+  in the compromised host as part of its destructive impact and defense evasion.
+search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from demand start to disabled." 
+  | stats count values(Message) as MessageList dc(Message) as MessageCount min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode  User Sid
+  | where MessageCount >=10
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_excessive_disabled_services_event_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the Service name, Service File Name Service Start type, and Service Type
+  from your endpoints.
+known_false_positives: Unknown
+references:
+-  https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/system.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ComputerName 
+  - EventCode 
+  - Message 
+  - User 
+  - Sid
+  security_domain: endpoint
+  impact: 90
+  confidence: 90 
+  # (impact * confidence)/100
+  risk_score: 81
+  context: 
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: Service was disabled in $Computer$
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16

detections/endpoint/windows_high_file_deletion_frequency.yml

@@ -1,4 +1,4 @@
-name: High File Deletion Frequency
+name: Windows High File Deletion Frequency
 id: 45b125c4-866f-11eb-a95a-acde48001122
 version: 1
 date: '2021-03-16'
@@ -10,12 +10,13 @@ description: This search looks for high frequency of file deletion relative to p
   name and process id. These events usually happen when the ransomware tries to encrypt
   the files with the ransomware file extensions and sysmon treat the original files
   to be deleted as soon it was replace as encrypted data.
-search: '`sysmon` EventCode=23 TargetFilename IN ("*\.cmd", "*\.ini","*\.gif", "*\.jpg",
-  "*\.jpeg", "*\.db", "*\.ps1", "*\.doc*", "*\.xls*", "*\.ppt*", "*\.bmp","*\.zip",
-  "*\.rar", "*\.7z", "*\.chm", "*\.png", "*\.log", "*\.vbs", "*\.js") | stats values(TargetFilename)
+search: '`sysmon` EventCode=23 TargetFilename IN ("*.cmd", "*.ini","*.gif", "*.jpg",
+  "*.jpeg", "*.db", "*.ps1", "*.doc*", "*.xls*", "*.ppt*", "*.bmp","*.zip",
+  "*.rar", "*.7z", "*.chm", "*.png", "*.log", "*.vbs", "*.js", "*.vhd", "*.bak", "*.wbcat", "*.bkf"
+  , "*.backup*", "*.dsk", , "*.win") | stats values(TargetFilename)
   as deleted_files min(_time) as firstTime max(_time) as lastTime count by Computer
   user EventCode Image ProcessID |where count >=100 | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `high_file_deletion_frequency_filter`'
+  | `security_content_ctime(lastTime)` | `windows_high_file_deletion_frequency_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the deleted target file name, process name and process id  from your endpoints.
   If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

detections/endpoint/windows_process_with_namedpipe_commandline.yml

@@ -0,0 +1,75 @@
+name: Windows Process With NamedPipe CommandLine
+id: e64399d4-94a8-11ec-a9da-acde48001122
+version: 1
+date: '2022-02-23'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This analytic is to look for process commandline that contains named pipe. 
+  This technique was seen in some adversaries, threat actor and malware like olympic destroyer to communicate to its other child processes after process 
+  injection that serve as defense evasion and privilege escalation. On the other hand this analytic may catch some normal process that using this technique for example browser 
+  application. In that scenario we include common process path we've seen during testing that cause false positive which is the program files. 
+  False positive may still be arise if the normal application is in other folder path.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process = "*\\\\.\\pipe\\*" NOT (Processes.process_path IN ("*\\program files*"))
+  by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id
+  Processes.parent_process_path Processes.process_guid Processes.parent_process_id Processes.dest Processes.user Processes.process_path
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_process_with_namedpipe_commandline_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Normal browser application may use this technique. Please update the filter macros to remove false positives.
+references:
+-  https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Processes.process_guid 
+  security_domain: endpoint
+  impact: 70
+  confidence: 70 
+  # (impact * confidence)/100
+  risk_score: 49
+  context: 
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: Process with named pipe in $process$ on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16

detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml

@@ -0,0 +1,69 @@
+name: Windows Raw Access To Master Boot Record Drive
+id: 7b83f666-900c-11ec-a2d9-acde48001122
+version: 1
+date: '2022-02-17'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to look for suspicious raw access read to drive where the master boot record is placed.
+  This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the master boot record code 
+  as part of their impact payload. This detection is a good indicator that there is a process try to read or write on MBR sector.
+search: '`sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*")) 
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer Image Device ProcessGuid ProcessId EventDescription EventCode
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_raw_access_to_master_boot_record_drive_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the raw access read event (like sysmon eventcode 9), process name and process guid from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: This event is really notable but we found minimal number of normal application from system32 folder like 
+  svchost.exe accessing it too. In this case we used 'system32' and 'syswow64' path as a filter for this detection.
+references:
+-  https://www.splunk.com/en_us/blog/security/threat-advisory-strt-ta02-destructive-software.html
+-  https://www.crowdstrike.com/blog/technical-analysis-of-whispergate-malware/
+-  https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+tags:
+  analytic_story:
+  - WhisperGate
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1561.002/mbr_raw_access/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1561.002
+  - T1561
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Computer 
+  - Image 
+  - Device 
+  - ProcessGuid 
+  - ProcessId 
+  - EventDescription 
+  - EventCode
+  security_domain: endpoint
+  impact: 90
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 90
+  context: 
+  - Source:Endpoint
+  - Stage:Impact
+  message: process accessing MBR $device$ in $dest$
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16

detections/endpoint/windows_service_creation_using_registry_entry.yml

@@ -0,0 +1,83 @@
+name: Windows Service Creation Using Registry Entry
+id: 25212358-948e-11ec-ad47-acde48001122
+version: 1
+date: '2022-02-23'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to look for suspicious modification or creation of registry to have service entry. 
+  This technique is abused by adversaries or threat actor to persist, gain privileges in the machine or even lateral movement. 
+  This technique can be executed using reg.exe application or using windows API like for example the CrashOveride malware. 
+  This detection is a good indicator that a process is trying to create a service entry using registry ImagePath.
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" Registry.registry_value_name = ImagePath
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data 
+  | `windows_service_creation_using_registry_entry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: Third party tools may used this technique to create services but not so common.
+references:
+-  https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  - Suspicious Windows Registry Activities
+  - Windows Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1574.011
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Processes.process_id 
+  - Processes.process_name
+  - Processes.process 
+  - Processes.dest 
+  - Processes.parent_process_name 
+  - Processes.parent_process
+  - Processes.process_guid
+  security_domain: endpoint
+  impact: 80
+  confidence: 80 
+  # (impact * confidence)/100
+  risk_score: 64
+  context: 
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  message: A Windows Service was created on a endpoint from $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16

detections/endpoint/windows_wmi_process_call_create.yml

@@ -0,0 +1,78 @@
+name: Windows WMI Process Call Create
+id: 0661c2de-93de-11ec-9833-acde48001122
+version: 1
+date: '2022-02-22'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic is to look for wmi commandlines to execute or create process. 
+  This technique was used by adversaries or threat actor to execute their malicious payload in local or remote host. 
+  This hunting query is a good pivot to start to look further which process trigger the wmi or what process it execute locally or remotely.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where `process_wmic` Processes.process = "* process *" Processes.process = "* call *" Processes.process = "* create *" 
+  by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id
+  Processes.parent_process_path Processes.process_guid Processes.parent_process_id Processes.dest Processes.user Processes.process_path
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_wmi_process_call_create_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Administrators may execute this command for testing or auditing.
+references:
+-  https://github.com/NVISOsecurity/sigma-public/blob/master/rules/windows/process_creation/win_susp_wmi_execution.yml
+-  https://github.com/redcanaryco/atomic-red-team/blob/2b804d25418004a5f1ba50e9dc637946ab8733c7/atomics/T1047/T1047.md
+tags:
+  analytic_story:
+  - Suspicious WMI Use
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1047
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Processes.process_guid 
+  security_domain: endpoint
+  impact: 50
+  confidence: 50 
+  # (impact * confidence)/100
+  risk_score: 25
+  context: 
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: process with $process$ commandline executed in $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16

tests/endpoint/windows_event_for_service_disabled.test.yml

@@ -0,0 +1,12 @@
+name: Windows Event For Service Disabled Unit Test
+tests:
+- name: Windows Event For Service Disabled
+  file: endpoint/windows_event_for_service_disabled.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/system.log
+    source: WinEventLog:System
+    sourcetype: WinEventLog

tests/endpoint/windows_excessive_disabled_services_event.test.yml

@@ -0,0 +1,12 @@
+name: Windows Excessive Disabled Services Event Unit Test
+tests:
+- name: Windows Excessive Disabled Services Event
+  file: endpoint/windows_excessive_disabled_services_event.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/system.log
+    source: WinEventLog:System
+    sourcetype: WinEventLog

tests/endpoint/windows_high_file_deletion_frequency.test.yml

@@ -1,7 +1,7 @@
-name: High File Deletion Frequency Unit Test
+name: Windows High File Deletion Frequency Unit Test
 tests:
-- name: High File Deletion Frequency
-  file: endpoint/high_file_deletion_frequency.yml
+- name: Windows High File Deletion Frequency
+  file: endpoint/windows_high_file_deletion_frequency.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

tests/endpoint/windows_process_with_namedpipe_commandline.test.yml

@@ -0,0 +1,12 @@
+name: Windows Process With NamedPipe CommandLine Unit Test
+tests:
+- name: Windows Process With NamedPipe CommandLine
+  file: endpoint/windows_process_with_namedpipe_commandline.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_raw_access_to_master_boot_record_drive.test.yml

@@ -0,0 +1,12 @@
+name: Windows Raw Access To Master Boot Record Drive Unit Test
+tests:
+- name: Windows Raw Access To Master Boot Record Drive
+  file: endpoint/windows_raw_access_to_master_boot_record_drive.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1561.002/mbr_raw_access/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_service_creation_using_registry_entry.test.yml

@@ -0,0 +1,12 @@
+name: Windows Service Creation Using Registry Entry Unit Test
+tests:
+- name: Windows Service Creation Using Registry Entry
+  file: endpoint/windows_service_creation_using_registry_entry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/windows_wmi_process_call_create.test.yml

@@ -0,0 +1,12 @@
+name: Windows WMI Process Call Create Unit Test
+tests:
+- name: Windows WMI Process Call Create
+  file: endpoint/windows_wmi_process_call_create.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog