From 73dbfd7ba152b21325a7df778f5edde8057255a8 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 18 Feb 2022 13:16:49 +0100 Subject: [PATCH 01/10] mbr_and_more --- ...raw_access_to_master_boot_record_drive.yml | 62 +++++++++++++++++++ ...ccess_to_master_boot_record_drive.test.yml | 12 ++++ 2 files changed, 74 insertions(+) create mode 100644 detections/endpoint/raw_access_to_master_boot_record_drive.yml create mode 100644 tests/endpoint/raw_access_to_master_boot_record_drive.test.yml diff --git a/detections/endpoint/raw_access_to_master_boot_record_drive.yml b/detections/endpoint/raw_access_to_master_boot_record_drive.yml new file mode 100644 index 0000000000..fad78cd5c5 --- /dev/null +++ b/detections/endpoint/raw_access_to_master_boot_record_drive.yml @@ -0,0 +1,62 @@ +name: Raw Access To Master Boot Record Drive +id: 7b83f666-900c-11ec-a2d9-acde48001122 +version: 1 +date: '2022-02-17' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to look for suspicious raw access read to drive where master boot record is place. + This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the master boot record code + as part of their impact payload. This detection is a good indicator that there is a process try to read or write on MBR sector. +search: '`sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*")) + | stats count min(_time) as firstTime max(_time) as lastTime by dest Image Device ProcessGuid ProcessId EventDescription EventCode + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `raw_access_to_master_boot_record_drive_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the raw access read event (like sysmon eventcode 9), process name and process guid from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: This event is really notable but we found minimal number of normal application from system32 folder like + svchost.exe accessing it too. In this case we used 'system32' and 'syswow64' path as a filter for this detection. +references: +- https://www.splunk.com/en_us/blog/security/threat-advisory-strt-ta02-destructive-software.html +- https://www.crowdstrike.com/blog/technical-analysis-of-whispergate-malware/ +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +tags: + analytic_story: + - WhisperGate + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1561.002/mbr_raw_access/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1561.002 + - T1561 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - source:endpoint + - stage:Impact + message: process accessing MBR $device$ in $dest$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/tests/endpoint/raw_access_to_master_boot_record_drive.test.yml b/tests/endpoint/raw_access_to_master_boot_record_drive.test.yml new file mode 100644 index 0000000000..a6db637261 --- /dev/null +++ b/tests/endpoint/raw_access_to_master_boot_record_drive.test.yml @@ -0,0 +1,12 @@ +name: Raw Access To Master Boot Record Drive Unit Test +tests: +- name: Raw Access To Master Boot Record Drive + file: endpoint/raw_access_to_master_boot_record_drive.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1561.002/mbr_raw_access/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 11a2d485d8bf1da2f664955c4dc22c73cd909076 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 18 Feb 2022 15:47:35 +0100 Subject: [PATCH 02/10] Update raw_access_to_master_boot_record_drive.yml --- .../raw_access_to_master_boot_record_drive.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/raw_access_to_master_boot_record_drive.yml b/detections/endpoint/raw_access_to_master_boot_record_drive.yml index fad78cd5c5..8040322cef 100644 --- a/detections/endpoint/raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/raw_access_to_master_boot_record_drive.yml @@ -10,7 +10,7 @@ description: This analytic is to look for suspicious raw access read to drive wh This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the master boot record code as part of their impact payload. This detection is a good indicator that there is a process try to read or write on MBR sector. search: '`sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*")) - | stats count min(_time) as firstTime max(_time) as lastTime by dest Image Device ProcessGuid ProcessId EventDescription EventCode + | stats count min(_time) as firstTime max(_time) as lastTime by Computer Image Device ProcessGuid ProcessId EventDescription EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `raw_access_to_master_boot_record_drive_filter`' @@ -40,6 +40,13 @@ tags: - Splunk Cloud required_fields: - _time + - Computer + - Image + - Device + - ProcessGuid + - ProcessId + - EventDescription + - EventCode security_domain: endpoint impact: 90 confidence: 100 @@ -59,4 +66,4 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16 From 50f7e99150ac2d08ed2e65e43c845ad939f52d02 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 22 Feb 2022 09:18:18 +0100 Subject: [PATCH 03/10] mbr_and_more --- ...l => windows_raw_access_to_master_boot_record_drive.yml} | 6 +++--- ...windows_raw_access_to_master_boot_record_drive.test.yml} | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) rename detections/endpoint/{raw_access_to_master_boot_record_drive.yml => windows_raw_access_to_master_boot_record_drive.yml} (93%) rename tests/endpoint/{raw_access_to_master_boot_record_drive.test.yml => windows_raw_access_to_master_boot_record_drive.test.yml} (67%) diff --git a/detections/endpoint/raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml similarity index 93% rename from detections/endpoint/raw_access_to_master_boot_record_drive.yml rename to detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index 8040322cef..adfbca6f7a 100644 --- a/detections/endpoint/raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -1,4 +1,4 @@ -name: Raw Access To Master Boot Record Drive +name: Windows Raw Access To Master Boot Record Drive id: 7b83f666-900c-11ec-a2d9-acde48001122 version: 1 date: '2022-02-17' @@ -9,11 +9,11 @@ datamodel: description: This analytic is to look for suspicious raw access read to drive where master boot record is place. This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the master boot record code as part of their impact payload. This detection is a good indicator that there is a process try to read or write on MBR sector. -search: '`sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*")) +search: '`sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by Computer Image Device ProcessGuid ProcessId EventDescription EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `raw_access_to_master_boot_record_drive_filter`' + | `windows_raw_access_to_master_boot_record_drive_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the raw access read event (like sysmon eventcode 9), process name and process guid from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/tests/endpoint/raw_access_to_master_boot_record_drive.test.yml b/tests/endpoint/windows_raw_access_to_master_boot_record_drive.test.yml similarity index 67% rename from tests/endpoint/raw_access_to_master_boot_record_drive.test.yml rename to tests/endpoint/windows_raw_access_to_master_boot_record_drive.test.yml index a6db637261..a207a3e16f 100644 --- a/tests/endpoint/raw_access_to_master_boot_record_drive.test.yml +++ b/tests/endpoint/windows_raw_access_to_master_boot_record_drive.test.yml @@ -1,7 +1,7 @@ -name: Raw Access To Master Boot Record Drive Unit Test +name: Windows Raw Access To Master Boot Record Drive Unit Test tests: -- name: Raw Access To Master Boot Record Drive - file: endpoint/raw_access_to_master_boot_record_drive.yml +- name: Windows Raw Access To Master Boot Record Drive + file: endpoint/windows_raw_access_to_master_boot_record_drive.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From d3b8dcf0e09317cf399910add1468ee6b7c9bd64 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 22 Feb 2022 14:12:27 +0100 Subject: [PATCH 04/10] mbr_and_more --- .../windows_wmi_process_call_create.yml | 77 +++++++++++++++++++ .../windows_wmi_process_call_create.test.yml | 12 +++ 2 files changed, 89 insertions(+) create mode 100644 detections/endpoint/windows_wmi_process_call_create.yml create mode 100644 tests/endpoint/windows_wmi_process_call_create.test.yml diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml new file mode 100644 index 0000000000..0df8077387 --- /dev/null +++ b/detections/endpoint/windows_wmi_process_call_create.yml @@ -0,0 +1,77 @@ +name: Windows WMI Process Call Create +id: 0661c2de-93de-11ec-9833-acde48001122 +version: 1 +date: '2022-02-22' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic is to look for wmi commandline to execute or create process. + This technique was used by adversaries or threat actor to execute their malicious payload in local or remote host. + This hunting query is a good pivot to start to look further which process trigger the wmi or what process it execute locally or remotely. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_wmic` Processes.process = "*process call create*" + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process + Processes.dest Processes.user Processes.process_guid Processes.process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_wmi_process_call_create_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Administrators may execute this command for testing or auditing. +references: +- https://github.com/NVISOsecurity/sigma-public/blob/master/rules/windows/process_creation/win_susp_wmi_execution.yml +- https://github.com/redcanaryco/atomic-red-team/blob/2b804d25418004a5f1ba50e9dc637946ab8733c7/atomics/T1047/T1047.md +tags: + analytic_story: + - Suspicious WMI Use + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1047 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: process with $process$ commandline executed in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/tests/endpoint/windows_wmi_process_call_create.test.yml b/tests/endpoint/windows_wmi_process_call_create.test.yml new file mode 100644 index 0000000000..1c45fb066d --- /dev/null +++ b/tests/endpoint/windows_wmi_process_call_create.test.yml @@ -0,0 +1,12 @@ +name: Windows WMI Process Call Create Unit Test +tests: +- name: Windows WMI Process Call Create + file: endpoint/windows_wmi_process_call_create.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From a35596dfa4bf991c13ba7a9af77b62b8fca3a581 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 23 Feb 2022 11:32:05 +0100 Subject: [PATCH 05/10] mbr_and_more --- ..._service_creation_using_registry_entry.yml | 71 +++++++++++++++++++ .../windows_wmi_process_call_create.yml | 2 +- ...ice_creation_using_registry_entry.test.yml | 12 ++++ 3 files changed, 84 insertions(+), 1 deletion(-) create mode 100644 detections/endpoint/windows_service_creation_using_registry_entry.yml create mode 100644 tests/endpoint/windows_service_creation_using_registry_entry.test.yml diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml new file mode 100644 index 0000000000..c3af2078c6 --- /dev/null +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -0,0 +1,71 @@ +name: Windows Service Creation Using Registry Entry +id: 25212358-948e-11ec-ad47-acde48001122 +version: 1 +date: '2022-02-23' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic is to look for suspicious modification or creation of registry to have service entry. + This technique is abused by adversaries or threat actor to persist, gain privileges in the machine or even lateral movement. + This technique can be executed using reg.exe application or using windows API like for example the CrashOveride malware. + This detection is a good indicator that a process is trying to create a service entry using registry ImagePath. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" Registry.registry_value_name = ImagePath + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name + Processes.process Processes.dest Processes.parent_process_name Processes.parent_process + Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as + proc_guid | fields _time dest user parent_process_name parent_process process_name + process_path process proc_guid registry_path registry_value_name registry_value_data] + | table _time dest user parent_process_name parent_process process_name process_path + process proc_guid registry_path registry_value_name registry_value_data + | `windows_service_creation_using_registry_entry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: Third party tools may used this technique to create services but not so common. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md +tags: + analytic_story: + - Active Directory Lateral Movement + - Suspicious Windows Registry Activities + - Windows Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1574.011 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - source:Endpoint + - stage:Lateral Movement + - stage:Persistence + - Privilege Escalation + message: A Windows Service was created on a endpoint from $dest + observable: + - name: dest + type: Endpoint + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml index 0df8077387..cecd19c2b1 100644 --- a/detections/endpoint/windows_wmi_process_call_create.yml +++ b/detections/endpoint/windows_wmi_process_call_create.yml @@ -10,7 +10,7 @@ description: This analytic is to look for wmi commandline to execute or create p This technique was used by adversaries or threat actor to execute their malicious payload in local or remote host. This hunting query is a good pivot to start to look further which process trigger the wmi or what process it execute locally or remotely. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_wmic` Processes.process = "*process call create*" + where `process_wmic` Processes.process = "* process *" Processes.process = "* call *" Processes.process = "* create *" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_guid Processes.process_id | `drop_dm_object_name(Processes)` diff --git a/tests/endpoint/windows_service_creation_using_registry_entry.test.yml b/tests/endpoint/windows_service_creation_using_registry_entry.test.yml new file mode 100644 index 0000000000..8231c0a49d --- /dev/null +++ b/tests/endpoint/windows_service_creation_using_registry_entry.test.yml @@ -0,0 +1,12 @@ +name: Windows Service Creation Using Registry Entry Unit Test +tests: +- name: Windows Service Creation Using Registry Entry + file: endpoint/windows_service_creation_using_registry_entry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From cbb60f2e0717402ff0d27e5242d5cf5e2a48be2a Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 23 Feb 2022 14:18:07 +0100 Subject: [PATCH 06/10] mbr_and_more --- .../windows_event_for_service_disabled.yml | 63 ++++++++++++++++ ...dows_excessive_disabled_services_event.yml | 65 ++++++++++++++++ ...ows_process_with_namedpipe_commandline.yml | 75 +++++++++++++++++++ ..._service_creation_using_registry_entry.yml | 5 ++ .../windows_wmi_process_call_create.yml | 5 +- ...indows_event_for_service_disabled.test.yml | 12 +++ ...excessive_disabled_services_event.test.yml | 12 +++ ...rocess_with_namedpipe_commandline.test.yml | 12 +++ 8 files changed, 247 insertions(+), 2 deletions(-) create mode 100644 detections/endpoint/windows_event_for_service_disabled.yml create mode 100644 detections/endpoint/windows_excessive_disabled_services_event.yml create mode 100644 detections/endpoint/windows_process_with_namedpipe_commandline.yml create mode 100644 tests/endpoint/windows_event_for_service_disabled.test.yml create mode 100644 tests/endpoint/windows_excessive_disabled_services_event.test.yml create mode 100644 tests/endpoint/windows_process_with_namedpipe_commandline.test.yml diff --git a/detections/endpoint/windows_event_for_service_disabled.yml b/detections/endpoint/windows_event_for_service_disabled.yml new file mode 100644 index 0000000000..0adbe738e6 --- /dev/null +++ b/detections/endpoint/windows_event_for_service_disabled.yml @@ -0,0 +1,63 @@ +name: Windows Event For Service Disabled +id: 9c2620a8-94a1-11ec-b40c-acde48001122 +version: 1 +date: '2022-02-23' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic will identify suspicious system Event of services that was modified from start to disabled. + This technique is seen where the adversary attempts to disable security app services, other malware services oer serve as an destructive impact + to complete the objective on the compromised system. +search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from demand start to disabled." + | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Message User Sid + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_event_for_service_disabled_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the Service name, Service File Name Service Start type, and Service Type + from your endpoints. +known_false_positives: windows service update may cause this event. In that scenario filtering is needed. +references: +- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/system.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - ComputerName + - EventCode + - Message + - User + - Sid + security_domain: endpoint + impact: 60 + confidence: 60 + # (impact * confidence)/100 + risk_score: 36 + context: + - source:Endpoint + - stage:Defense Evasion + message: Service was disabled in $Computer$ + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/windows_excessive_disabled_services_event.yml b/detections/endpoint/windows_excessive_disabled_services_event.yml new file mode 100644 index 0000000000..cea80a8a31 --- /dev/null +++ b/detections/endpoint/windows_excessive_disabled_services_event.yml @@ -0,0 +1,65 @@ +name: Windows Excessive Disabled Services Event +id: c3f85976-94a5-11ec-9a58-acde48001122 +version: 1 +date: '2022-02-23' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic will identify suspicious excessive number of system events of services that was modified from start to disabled. + This technique is seen where the adversary attempts to disable security app services, other malware services oer serve as an destructive impact + to complete the objective on the compromised system. One good example for this scenario is Olympic destroyer where it disable all active services + in the compromised host as part of its destructive impact and defense evasion. +search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from demand start to disabled." + | stats count values(Message) as MessageList dc(Message) as MessageCount min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode User Sid + | where MessageCount >=10 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_excessive_disabled_services_event_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the Service name, Service File Name Service Start type, and Service Type + from your endpoints. +known_false_positives: unknown +references: +- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/system.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - ComputerName + - EventCode + - Message + - User + - Sid + security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - source:Endpoint + - stage:Defense Evasion + message: Service was disabled in $Computer$ + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml new file mode 100644 index 0000000000..f7e945d26f --- /dev/null +++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml @@ -0,0 +1,75 @@ +name: Windows Process With NamedPipe CommandLine +id: e64399d4-94a8-11ec-a9da-acde48001122 +version: 1 +date: '2022-02-23' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to look for process commandline that contains named pipe. + This technique was seen in some adversaries, threat actor and malware like olympic destroyer to communicate to its other child processes after process + injection that serve as defense evasion and privilege escalation. On the other hand this analytic may catch some normal process that using this technique for example browser + application. In that scenario we include common process path we've seen during testing that cause false positive which is the program files. + False positive may still be arise if the normal application is in other folder path. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process = "*\\\\.\\pipe\\*" NOT (Processes.process_path IN ("*\\program files*")) + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id + Processes.parent_process_path Processes.process_guid Processes.parent_process_id Processes.dest Processes.user Processes.process_path + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_process_with_namedpipe_commandline_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: normal browser application may use this technique. Please update the filter macros to remove false positives. +references: +- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html +tags: + analytic_story: + - Windows Defense Evasion Tactics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + - Processes.process_guid + security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - source:Endpoint + - stage:Defense Evasion + message: process with named pipe in $process$ in $dest$ + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + nist: + - DE.CM + cis20: + - CIS 3 + - CIS 5 + - CIS 16 \ No newline at end of file diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index c3af2078c6..e540401960 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -47,6 +47,11 @@ tags: - Splunk Cloud required_fields: - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name security_domain: endpoint impact: 80 confidence: 80 diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml index cecd19c2b1..8ecc1aa723 100644 --- a/detections/endpoint/windows_wmi_process_call_create.yml +++ b/detections/endpoint/windows_wmi_process_call_create.yml @@ -11,8 +11,8 @@ description: This analytic is to look for wmi commandline to execute or create p This hunting query is a good pivot to start to look further which process trigger the wmi or what process it execute locally or remotely. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process = "* process *" Processes.process = "* call *" Processes.process = "* create *" - by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process - Processes.dest Processes.user Processes.process_guid Processes.process_id + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id + Processes.parent_process_path Processes.process_guid Processes.parent_process_id Processes.dest Processes.user Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -51,6 +51,7 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id + - Processes.process_guid security_domain: endpoint impact: 50 confidence: 50 diff --git a/tests/endpoint/windows_event_for_service_disabled.test.yml b/tests/endpoint/windows_event_for_service_disabled.test.yml new file mode 100644 index 0000000000..d24280ad75 --- /dev/null +++ b/tests/endpoint/windows_event_for_service_disabled.test.yml @@ -0,0 +1,12 @@ +name: Windows Event For Service Disabled Unit Test +tests: +- name: Windows Event For Service Disabled + file: endpoint/windows_event_for_service_disabled.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/system.log + source: WinEventLog:System + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/windows_excessive_disabled_services_event.test.yml b/tests/endpoint/windows_excessive_disabled_services_event.test.yml new file mode 100644 index 0000000000..f4437ee9b7 --- /dev/null +++ b/tests/endpoint/windows_excessive_disabled_services_event.test.yml @@ -0,0 +1,12 @@ +name: Windows Excessive Disabled Services Event Unit Test +tests: +- name: Windows Excessive Disabled Services Event + file: endpoint/windows_excessive_disabled_services_event.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/system.log + source: WinEventLog:System + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/windows_process_with_namedpipe_commandline.test.yml b/tests/endpoint/windows_process_with_namedpipe_commandline.test.yml new file mode 100644 index 0000000000..653307c907 --- /dev/null +++ b/tests/endpoint/windows_process_with_namedpipe_commandline.test.yml @@ -0,0 +1,12 @@ +name: Windows Process With NamedPipe CommandLine Unit Test +tests: +- name: Windows Process With NamedPipe CommandLine + file: endpoint/windows_process_with_namedpipe_commandline.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 8ffb45d68bff436c4498b21d8862971eab03f0a4 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 23 Feb 2022 15:43:24 +0100 Subject: [PATCH 07/10] mbr_and_more --- ...y.yml => windows_high_file_deletion_frequency.yml} | 11 ++++++----- ... => windows_high_file_deletion_frequency.test.yml} | 6 +++--- 2 files changed, 9 insertions(+), 8 deletions(-) rename detections/endpoint/{high_file_deletion_frequency.yml => windows_high_file_deletion_frequency.yml} (82%) rename tests/endpoint/{high_file_deletion_frequency.test.yml => windows_high_file_deletion_frequency.test.yml} (70%) diff --git a/detections/endpoint/high_file_deletion_frequency.yml b/detections/endpoint/windows_high_file_deletion_frequency.yml similarity index 82% rename from detections/endpoint/high_file_deletion_frequency.yml rename to detections/endpoint/windows_high_file_deletion_frequency.yml index 0a10071263..079fa9a3cb 100644 --- a/detections/endpoint/high_file_deletion_frequency.yml +++ b/detections/endpoint/windows_high_file_deletion_frequency.yml @@ -1,4 +1,4 @@ -name: High File Deletion Frequency +name: Windows High File Deletion Frequency id: 45b125c4-866f-11eb-a95a-acde48001122 version: 1 date: '2021-03-16' @@ -10,12 +10,13 @@ description: This search looks for high frequency of file deletion relative to p name and process id. These events usually happen when the ransomware tries to encrypt the files with the ransomware file extensions and sysmon treat the original files to be deleted as soon it was replace as encrypted data. -search: '`sysmon` EventCode=23 TargetFilename IN ("*\.cmd", "*\.ini","*\.gif", "*\.jpg", - "*\.jpeg", "*\.db", "*\.ps1", "*\.doc*", "*\.xls*", "*\.ppt*", "*\.bmp","*\.zip", - "*\.rar", "*\.7z", "*\.chm", "*\.png", "*\.log", "*\.vbs", "*\.js") | stats values(TargetFilename) +search: '`sysmon` EventCode=23 TargetFilename IN ("*.cmd", "*.ini","*.gif", "*.jpg", + "*.jpeg", "*.db", "*.ps1", "*.doc*", "*.xls*", "*.ppt*", "*.bmp","*.zip", + "*.rar", "*.7z", "*.chm", "*.png", "*.log", "*.vbs", "*.js", "*.vhd", "*.bak", "*.wbcat", "*.bkf" + , "*.backup*", "*.dsk", , "*.win") | stats values(TargetFilename) as deleted_files min(_time) as firstTime max(_time) as lastTime count by Computer user EventCode Image ProcessID |where count >=100 | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `high_file_deletion_frequency_filter`' + | `security_content_ctime(lastTime)` | `windows_high_file_deletion_frequency_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the deleted target file name, process name and process id from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. diff --git a/tests/endpoint/high_file_deletion_frequency.test.yml b/tests/endpoint/windows_high_file_deletion_frequency.test.yml similarity index 70% rename from tests/endpoint/high_file_deletion_frequency.test.yml rename to tests/endpoint/windows_high_file_deletion_frequency.test.yml index 0e569e5830..896e942cb8 100644 --- a/tests/endpoint/high_file_deletion_frequency.test.yml +++ b/tests/endpoint/windows_high_file_deletion_frequency.test.yml @@ -1,7 +1,7 @@ -name: High File Deletion Frequency Unit Test +name: Windows High File Deletion Frequency Unit Test tests: -- name: High File Deletion Frequency - file: endpoint/high_file_deletion_frequency.yml +- name: Windows High File Deletion Frequency + file: endpoint/windows_high_file_deletion_frequency.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 3255b012efcc005c52f2e9496819b06a167e50da Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 25 Feb 2022 15:23:46 +0100 Subject: [PATCH 08/10] Update windows_raw_access_to_master_boot_record_drive.yml --- .../endpoint/windows_raw_access_to_master_boot_record_drive.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index adfbca6f7a..762844f608 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to look for suspicious raw access read to drive where master boot record is place. +description: This analytic is to look for suspicious raw access read to drive where the master boot record is placed. This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the master boot record code as part of their impact payload. This detection is a good indicator that there is a process try to read or write on MBR sector. search: '`sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*")) From 756956ad393cbf3fab2bcdd4746bd4a587693687 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 1 Mar 2022 12:11:43 -0800 Subject: [PATCH 09/10] updates to ymls --- .../windows_event_for_service_disabled.yml | 10 +++++----- ...indows_excessive_disabled_services_event.yml | 6 +++--- ...ndows_process_with_namedpipe_commandline.yml | 10 +++++----- ...s_raw_access_to_master_boot_record_drive.yml | 6 +++--- ...ws_service_creation_using_registry_entry.yml | 17 ++++++++++++----- .../windows_wmi_process_call_create.yml | 2 +- 6 files changed, 29 insertions(+), 22 deletions(-) diff --git a/detections/endpoint/windows_event_for_service_disabled.yml b/detections/endpoint/windows_event_for_service_disabled.yml index 0adbe738e6..b78d31c76d 100644 --- a/detections/endpoint/windows_event_for_service_disabled.yml +++ b/detections/endpoint/windows_event_for_service_disabled.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytic will identify suspicious system Event of services that was modified from start to disabled. +description: This analytic will identify suspicious system event of services that was modified from start to disabled. This technique is seen where the adversary attempts to disable security app services, other malware services oer serve as an destructive impact to complete the objective on the compromised system. search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from demand start to disabled." @@ -17,7 +17,7 @@ search: '`wineventlog_system` EventCode=7040 Message = "*service was changed fro how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. -known_false_positives: windows service update may cause this event. In that scenario filtering is needed. +known_false_positives: Windows service update may cause this event. In that scenario, filtering is needed. references: - https://blog.talosintelligence.com/2018/02/olympic-destroyer.html tags: @@ -47,9 +47,9 @@ tags: # (impact * confidence)/100 risk_score: 36 context: - - source:Endpoint - - stage:Defense Evasion - message: Service was disabled in $Computer$ + - Source:Endpoint + - Stage:Defense Evasion + message: Service was disabled on $Computer$ observable: - name: ComputerName type: Endpoint diff --git a/detections/endpoint/windows_excessive_disabled_services_event.yml b/detections/endpoint/windows_excessive_disabled_services_event.yml index cea80a8a31..9942d3e9b4 100644 --- a/detections/endpoint/windows_excessive_disabled_services_event.yml +++ b/detections/endpoint/windows_excessive_disabled_services_event.yml @@ -19,7 +19,7 @@ search: '`wineventlog_system` EventCode=7040 Message = "*service was changed fro how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. -known_false_positives: unknown +known_false_positives: Unknown references: - https://blog.talosintelligence.com/2018/02/olympic-destroyer.html tags: @@ -49,8 +49,8 @@ tags: # (impact * confidence)/100 risk_score: 81 context: - - source:Endpoint - - stage:Defense Evasion + - Source:Endpoint + - Stage:Defense Evasion message: Service was disabled in $Computer$ observable: - name: ComputerName diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml index f7e945d26f..c3ded4b5d9 100644 --- a/detections/endpoint/windows_process_with_namedpipe_commandline.yml +++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml @@ -23,7 +23,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: normal browser application may use this technique. Please update the filter macros to remove false positives. +known_false_positives: Normal browser application may use this technique. Please update the filter macros to remove false positives. references: - https://blog.talosintelligence.com/2018/02/olympic-destroyer.html tags: @@ -59,11 +59,11 @@ tags: # (impact * confidence)/100 risk_score: 49 context: - - source:Endpoint - - stage:Defense Evasion - message: process with named pipe in $process$ in $dest$ + - Source:Endpoint + - Stage:Defense Evasion + message: Process with named pipe in $process$ on $dest$ observable: - - name: ComputerName + - name: dest type: Endpoint role: - Victim diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index 762844f608..30f88fdb60 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -53,11 +53,11 @@ tags: # (impact * confidence)/100 risk_score: 90 context: - - source:endpoint - - stage:Impact + - Source:Endpoint + - Stage:Impact message: process accessing MBR $device$ in $dest$ observable: - - name: ComputerName + - name: Computer type: Hostname role: - Victim diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index e540401960..a0893d7a3c 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -52,17 +52,24 @@ tags: - Registry.user - Registry.dest - Registry.registry_value_name + - Processes.process_id + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_guid security_domain: endpoint impact: 80 confidence: 80 # (impact * confidence)/100 risk_score: 64 context: - - source:Endpoint - - stage:Lateral Movement - - stage:Persistence - - Privilege Escalation - message: A Windows Service was created on a endpoint from $dest + - Source:Endpoint + - Stage:Lateral Movement + - Stage:Persistence + - Stage:Privilege Escalation + message: A Windows Service was created on a endpoint from $dest$ observable: - name: dest type: Endpoint diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml index 8ecc1aa723..a83eb1b469 100644 --- a/detections/endpoint/windows_wmi_process_call_create.yml +++ b/detections/endpoint/windows_wmi_process_call_create.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytic is to look for wmi commandline to execute or create process. +description: This analytic is to look for wmi commandlines to execute or create process. This technique was used by adversaries or threat actor to execute their malicious payload in local or remote host. This hunting query is a good pivot to start to look further which process trigger the wmi or what process it execute locally or remotely. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes From d5040840188f424af8ee3b7b0d211dc3eea1d6f6 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 1 Mar 2022 12:40:11 -0800 Subject: [PATCH 10/10] Update windows_event_for_service_disabled.yml --- detections/endpoint/windows_event_for_service_disabled.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_event_for_service_disabled.yml b/detections/endpoint/windows_event_for_service_disabled.yml index b78d31c76d..6209ad2f6a 100644 --- a/detections/endpoint/windows_event_for_service_disabled.yml +++ b/detections/endpoint/windows_event_for_service_disabled.yml @@ -7,8 +7,7 @@ type: Hunting datamodel: - Endpoint description: This analytic will identify suspicious system event of services that was modified from start to disabled. - This technique is seen where the adversary attempts to disable security app services, other malware services oer serve as an destructive impact - to complete the objective on the compromised system. + This technique is seen where the adversary attempts to disable security app services, other malware services to evade the defense systems on the compromised host search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from demand start to disabled." | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Message User Sid | `security_content_ctime(firstTime)` @@ -60,4 +59,4 @@ tags: cis20: - CIS 3 - CIS 5 - - CIS 16 \ No newline at end of file + - CIS 16