mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
srv-rr-gh-researchbt
@@ -0,0 +1,81 @@
|
||||
name: Windows Cached Domain Credentials Reg Query
|
||||
id: 40ccb8e0-1785-466e-901e-6a8b75c04ecd
|
||||
version: 1
|
||||
date: '2022-11-30'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies a process command line related to the discovery of cache domain credential logon count in the registry.
|
||||
This Technique was being abused by several post exploitation tool like Winpeas where it query CachedLogonsCount registry value in
|
||||
Winlogon registry. This value can be good information about the login caching setting on the Windows OS target host.
|
||||
A value of 0 means login caching is disable and values > 50 caches only 50 login attempts. By default all versions of Windows 10 save cached logins except
|
||||
Windows Server 2008.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
||||
where `process_reg` AND Processes.process = "* query *" AND Processes.process = "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Processes.process = "*CACHEDLOGONSCOUNT*"
|
||||
by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid
|
||||
Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user
|
||||
| `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `windows_cached_domain_credentials_reg_query_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
|
||||
- https://learn.microsoft.com/de-de/troubleshoot/windows-server/user-profiles-and-logon/cached-domain-logon-information
|
||||
- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Post-Exploitation
|
||||
- Prestige Ransomware
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 30
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Discovery
|
||||
- Stage:Recon
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
|
||||
impact: 30
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: a process with commandline $process$ tries to retrieve cache domain credential logon count in $dest$
|
||||
mitre_attack_id:
|
||||
- T1003.005
|
||||
- T1003
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process_name
|
||||
- Processes.parent_process
|
||||
- Processes.original_file_name
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_path
|
||||
- Processes.process_path
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_guid
|
||||
- Processes.process_guid
|
||||
risk_score: 9
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,71 @@
|
||||
name: Windows ClipBoard Data via Get-ClipBoard
|
||||
id: ab73289e-2246-4de0-a14b-67006c72a893
|
||||
version: 1
|
||||
date: '2022-11-30'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies a powershell script command to retrieve clipboard data.
|
||||
This technique was seen in several post exploitation tools like WINPEAS to steal sensitive information that was saved in clipboard.
|
||||
Using the Get-Clipboard powershell commandlet, adversaries can be able collect data stored in clipboard that might be a copied user name, password or
|
||||
other sensitive information.
|
||||
search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-Clipboard*"
|
||||
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `windows_clipboard_data_via_get_clipboard_filter`'
|
||||
how_to_implement: To successfully implement this analytic, you will need to enable
|
||||
PowerShell Script Block Logging on some or all endpoints. Additional setup here
|
||||
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
|
||||
known_false_positives: It is possible there will be false positives, filter as needed.
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1115/
|
||||
- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
|
||||
- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Post-Exploitation
|
||||
- Prestige Ransomware
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 50
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Discovery
|
||||
- Stage:Recon
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/powershell/windows-powershell-xml2.log
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: powershell script $ScriptBlockText$ execute Get-Clipboard commandlet in $dest$
|
||||
mitre_attack_id:
|
||||
- T1115
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: Computer
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: UserID
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- ScriptBlockText
|
||||
- Opcode
|
||||
- Computer
|
||||
- UserID
|
||||
- EventCode
|
||||
risk_score: 25
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,79 @@
|
||||
name: Windows Credentials from Password Stores Query
|
||||
id: db02d6b4-5d5b-4c33-8d8f-f0577516a8c7
|
||||
version: 1
|
||||
date: '2022-11-30'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies a process execution of Windows OS cmdkey.exe tool.
|
||||
This tool is being abused or used by several post exploitation tool such as winpeas that being used by ransomware prestige
|
||||
to list stored user names, passwords or credentials in the targeted Windows OS host. This information can be used by the attacker
|
||||
to gain privilege escalation and persistence in the targeted hosts for further attacks.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
||||
where Processes.process_name="cmdkey.exe" OR Processes.original_file_name = "cmdkey.exe" AND Processes.process = "*/list*"
|
||||
by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid
|
||||
Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user
|
||||
| `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `windows_credentials_from_password_stores_query_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
|
||||
known_false_positives: network administrator can use this tool for auditing process.
|
||||
references:
|
||||
- https://ss64.com/nt/cmdkey.html
|
||||
- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
|
||||
- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Post-Exploitation
|
||||
- Prestige Ransomware
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 50
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Discovery
|
||||
- Stage:Recon
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_cmdkeylist/cmdkey-sysmon.log
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: a process $process_name$ was executed in $dest$ to display stored username and credentials.
|
||||
mitre_attack_id:
|
||||
- T1555
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process_name
|
||||
- Processes.parent_process
|
||||
- Processes.original_file_name
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_path
|
||||
- Processes.process_path
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_guid
|
||||
- Processes.process_guid
|
||||
risk_score: 25
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,82 @@
|
||||
name: Windows Credentials in Registry Reg Query
|
||||
id: a8b3124e-2278-4b73-ae9c-585117079fb2
|
||||
version: 1
|
||||
date: '2022-11-30'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies a process command line related to the discovery of possible password or credentials in the registry.
|
||||
This technique is being abused by adversaries or post exploitation tools like winpeas to steal credentials in the registry in the targeted host.
|
||||
Registry can contain several sensitive information like username and credentials that can be used for privilege escalation, persistence or even in lateral movement.
|
||||
This Anomaly detection can be a good pivot to detect a suspicious process querying a registry related to password or private keys.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
||||
where `process_reg` AND Processes.process = "* query *" AND Processes.process IN ("*\\Software\\ORL\\WinVNC3\\Password*",
|
||||
"*\\SOFTWARE\\RealVNC\\WinVNC4 /v password*", "*\\CurrentControlSet\\Services\\SNMP*", "*\\Software\\TightVNC\\Server*",
|
||||
"*\\Software\\SimonTatham\\PuTTY\\Sessions*", "*\\Software\\OpenSSH\\Agent\\Keys*", "*password*")
|
||||
by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid
|
||||
Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user
|
||||
| `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `windows_credentials_in_registry_reg_query_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1552/002/
|
||||
- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
|
||||
- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Post-Exploitation
|
||||
- Prestige Ransomware
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 50
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Discovery
|
||||
- Stage:Recon
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_pwd/query-putty-sysmon.log
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: reg query commandline $process$ in $dest$
|
||||
mitre_attack_id:
|
||||
- T1552.002
|
||||
- T1552
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process_name
|
||||
- Processes.parent_process
|
||||
- Processes.original_file_name
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_path
|
||||
- Processes.process_path
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_guid
|
||||
- Processes.process_guid
|
||||
risk_score: 25
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,80 @@
|
||||
name: Windows Indirect Command Execution Via Series Of Forfiles
|
||||
id: bfdaabe7-3db8-48c5-80c1-220f9b8f22be
|
||||
version: 1
|
||||
date: '2022-11-30'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: This analytic is developed to detect suspicious excessive usage of forfiles.exe process.
|
||||
This event was seen in post exploitation tool WINPEAS that was used by Ransomware Prestige. Forfiles command
|
||||
lets you run a command on or pass arguments to multiple files. This Windows OS built-in tool being abused to list all files in specific
|
||||
directory or drive.
|
||||
search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_guid) as process_guid values(Processes.process_name) as process_name
|
||||
count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
||||
where Processes.process_name = "forfiles.exe" OR Processes.original_file_name = "forfiles.exe"
|
||||
by Processes.parent_process_name Processes.parent_process Processes.dest Processes.user _time span=1m
|
||||
| where count >=20
|
||||
| `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `windows_indirect_command_execution_via_series_of_forfiles_filter`'
|
||||
how_to_implement: To successfully implement this search, you must be ingesting data
|
||||
that records registry activity from your hosts to populate the endpoint data model
|
||||
in the registry node. This is typically populated via endpoint detection-and-response
|
||||
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
|
||||
used for this search is typically generated via logs that report reads and writes
|
||||
to the registry.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles
|
||||
- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
|
||||
- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Post-Exploitation
|
||||
- Prestige Ransomware
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 30
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Discovery
|
||||
- Stage:Recon
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
|
||||
impact: 30
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: excessive forfiles process execution in $dest$
|
||||
mitre_attack_id:
|
||||
- T1202
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process_name
|
||||
- Processes.parent_process
|
||||
- Processes.original_file_name
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_path
|
||||
- Processes.process_path
|
||||
- Processes.parent_process_id
|
||||
risk_score: 9
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,79 @@
|
||||
name: Windows Information Discovery Fsutil
|
||||
id: 2181f261-93e6-4166-a5a9-47deac58feff
|
||||
version: 1
|
||||
date: '2022-11-30'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Hunting
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies a process execution of Windows OS built-in tool FSUTIL to discover file system information.
|
||||
This tool is being abused or used by several adversaries or threat actor to query/list all drives, drive type,
|
||||
volume information or volume statistics by using the FSINFO parameter of this tool. This technique was seen in
|
||||
WINPEAS post exploitation tool that is being used by ransomware prestige to gain privilege and persistence to the targeted host.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
||||
where Processes.process_name="fsutil.exe" OR Processes.original_file_name = "fsutil.exe" AND Processes.process = "*fsinfo*"
|
||||
by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid
|
||||
Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user
|
||||
| `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `windows_information_discovery_fsutil_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil
|
||||
- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
|
||||
- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Post-Exploitation
|
||||
- Prestige Ransomware
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 30
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Discovery
|
||||
- Stage:Recon
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_fsutil/fsutil-fsinfo-sysmon.log
|
||||
impact: 30
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: process $process_name$ with commandline $process$ is executed in $dest$
|
||||
mitre_attack_id:
|
||||
- T1082
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process_name
|
||||
- Processes.parent_process
|
||||
- Processes.original_file_name
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_path
|
||||
- Processes.process_path
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_guid
|
||||
- Processes.process_guid
|
||||
risk_score: 9
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,82 @@
|
||||
name: Windows Password Managers Discovery
|
||||
id: a3b3bc96-1c4f-4eba-8218-027cac739a48
|
||||
version: 1
|
||||
date: '2022-11-30'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Hunting
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies a process command line that retrieves information related to password manager software.
|
||||
This technique was seen in several post exploitation tools like winpeas that are being used by Ransomware Prestige to gather this type of information.
|
||||
Password Managers applications are designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a
|
||||
user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory.
|
||||
These databases can be stored as files on disk. Due to this password manager software designed adversaries may find or look for keywords related to the Password
|
||||
Manager databases that can be stolen or extracted for further attacks.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
||||
where Processes.process = "*dir *" OR Processes.process = "*findstr*"
|
||||
AND Processes.process IN ( "*.kdbx*", "*credential*", "*key3.db*","*pass*", "*cred*", "*key4.db*", "*accessTokens*", "*access_tokens*", "*.htpasswd*", "*Ntds.dit*")
|
||||
by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid
|
||||
Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user
|
||||
| `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `windows_password_managers_discovery_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1555/005/
|
||||
- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
|
||||
- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Post-Exploitation
|
||||
- Prestige Ransomware
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 50
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Discovery
|
||||
- Stage:Recon
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_pwd_db/dir-db-sysmon.log
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: a process with commandline $process$ that can retrieve information related to password manager databases in $dest$
|
||||
mitre_attack_id:
|
||||
- T1555.005
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process_name
|
||||
- Processes.parent_process
|
||||
- Processes.original_file_name
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_path
|
||||
- Processes.process_path
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_guid
|
||||
- Processes.process_guid
|
||||
risk_score: 25
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,82 @@
|
||||
name: Windows Private Keys Discovery
|
||||
id: 5c1c2877-06c0-40ee-a1a2-db71f1372b5b
|
||||
version: 1
|
||||
date: '2022-11-30'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies a process command line that retrieves information related to private keys files.
|
||||
This technique was seen in several post exploitation tools like winpeas that are being used by Ransomware Prestige to
|
||||
search for private key certificates on the compromised host for insecurely stored credentials. This files can be used by adversaries to gain privileges,
|
||||
persistence or remote service authentication to collect more sensitive information. Some private keys required password for operation, so in this case adversaries
|
||||
may need to have that passphrase either via keylogging or brute force attack.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
||||
where Processes.process = "*dir *" OR Processes.process = "*findstr*"
|
||||
AND Processes.process IN ( "*.rdg*", "*.gpg*", "*.pgp*", "*.p12*", "*.der*", "*.csr*", "*.cer*", "*.ovpn*", "*.key*", "*.ppk*", "*.p12*", "*.pem*", "*.pfx*", "*.p7b*", "*.asc*")
|
||||
by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid
|
||||
Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user
|
||||
| `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `windows_private_keys_discovery_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1552/004/
|
||||
- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
|
||||
- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Post-Exploitation
|
||||
- Prestige Ransomware
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 50
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Discovery
|
||||
- Stage:Recon
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_private_key/dir-private-sysmon.log
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: a process with commandline $process$ that can retrieve information related to private keys in $dest$
|
||||
mitre_attack_id:
|
||||
- T1552.004
|
||||
- T1552
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process_name
|
||||
- Processes.parent_process
|
||||
- Processes.original_file_name
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_path
|
||||
- Processes.process_path
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_guid
|
||||
- Processes.process_guid
|
||||
risk_score: 25
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,81 @@
|
||||
name: Windows Security Support Provider Reg Query
|
||||
id: 31302468-93c9-4eca-9ae3-2d41f53a4e2b
|
||||
version: 1
|
||||
date: '2022-11-30'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies a process command line related to the discovery of possible Security Support Providers in the registry.
|
||||
This technique is being abused by adversaries or post exploitation tools like winpeas to gather LSA protection and configuration in the registry in the targeted host.
|
||||
This registry entry can contain several information related to LSA that validates users for local and remote sign-ins and enforces local security policies.
|
||||
Understanding LSA protection may give a good information in accessing LSA content in memory which is commonly attack by adversaries and tool like mimikatz to
|
||||
scrape password hashes or clear plain text passwords.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
||||
where `process_reg` AND Processes.process = "* query *" AND Processes.process = "*\\SYSTEM\\CurrentControlSet\\Control\\LSA*" Processes.process IN ("*RunAsPPL*" , "*LsaCfgFlags*")
|
||||
by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid
|
||||
Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user
|
||||
| `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `windows_security_support_provider_reg_query_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://blog.netwrix.com/2022/01/11/understanding-lsa-protection/
|
||||
- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
|
||||
- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Post-Exploitation
|
||||
- Prestige Ransomware
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 30
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Discovery
|
||||
- Stage:Recon
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
|
||||
impact: 30
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: process with reg query command line $process$ in $dest$
|
||||
mitre_attack_id:
|
||||
- T1547.005
|
||||
- T1547
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process_name
|
||||
- Processes.parent_process
|
||||
- Processes.original_file_name
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_path
|
||||
- Processes.process_path
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_guid
|
||||
- Processes.process_guid
|
||||
risk_score: 9
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,78 @@
|
||||
name: Windows Steal or Forge Kerberos Tickets Klist
|
||||
id: 09d88404-1e29-46cb-806c-1eedbc85ad5d
|
||||
version: 1
|
||||
date: '2022-11-30'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Hunting
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies a process execution of Windows OS klist.exe tool.
|
||||
This tool is being abused or used by several post exploitation tool such as winpeas that being used by ransomware prestige
|
||||
to display or gather list of currently cached kerberos ticket. This cahced data can be used for lateral movement or even privilege escalation on the targeted
|
||||
host. This hunting query can be a good pivot in possible kerberos attack or pass the hash technique.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
||||
where Processes.process_name="klist.exe" OR Processes.original_file_name = "klist.exe" Processes.parent_process_name IN ("cmd.exe", "powershell*")
|
||||
by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid
|
||||
Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user
|
||||
| `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `windows_steal_or_forge_kerberos_tickets_klist_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
|
||||
- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Post-Exploitation
|
||||
- Prestige Ransomware
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 30
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Discovery
|
||||
- Stage:Recon
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
|
||||
impact: 30
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: process klist.exe executed in $dest$
|
||||
mitre_attack_id:
|
||||
- T1558
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process_name
|
||||
- Processes.parent_process
|
||||
- Processes.original_file_name
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_path
|
||||
- Processes.process_path
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_guid
|
||||
- Processes.process_guid
|
||||
risk_score: 9
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,80 @@
|
||||
name: Windows System Network Config Discovery Display DNS
|
||||
id: e24f0a0e-41a9-419f-9999-eacab15efc36
|
||||
version: 1
|
||||
date: '2022-11-30'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Hunting
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies a process command line that retrieves dns reply information using Windows OS built-in tool IPConfig.
|
||||
This technique is being abused by threat actors, adversaries and post exploitation tools like WINPEAS to retrieve DNS information for the targeted host.
|
||||
This IPConfig parameter (/displaydns) can show dns server resource record, record name, record type, time to live data length and dns reply.
|
||||
This hunting detection can be a good pivot to check which process is executing this command line in specific host system that may lead to malware or adversaries
|
||||
gathering network information.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
||||
where Processes.process_name="ipconfig.exe" OR Processes.original_file_name = "ipconfig.exe" AND Processes.process = "*/displaydns*"
|
||||
by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid
|
||||
Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user
|
||||
| `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `windows_system_network_config_discovery_display_dns_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://superuser.com/questions/230308/explain-output-of-ipconfig-displaydns
|
||||
- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
|
||||
- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Post-Exploitation
|
||||
- Prestige Ransomware
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 30
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Discovery
|
||||
- Stage:Recon
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
|
||||
impact: 30
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: process $process_name$ with commandline $process$ is executed in $dest$
|
||||
mitre_attack_id:
|
||||
- T1016
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process_name
|
||||
- Processes.parent_process
|
||||
- Processes.original_file_name
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_path
|
||||
- Processes.process_path
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_guid
|
||||
- Processes.process_guid
|
||||
risk_score: 9
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,80 @@
|
||||
name: Windows System Network Connections Discovery Netsh
|
||||
id: abfb7cc5-c275-4a97-9029-62cd8d4ffeca
|
||||
version: 1
|
||||
date: '2022-11-30'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Hunting
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies a process execution of Windows OS built-in tool netsh.exe to show state, configuration and profile of host firewall.
|
||||
This tool is being used or abused by several adversaries or even post exploitation tool to bypass firewall rules or to discover firewall settings.
|
||||
This hunting detection can help to detect a possible suspicious usage of netsh.exe to retrieve firewall settings or even firewall wlan profile.
|
||||
We recommend checking which parent process and process name execute this command. Also check the process file path for verification that may lead to further
|
||||
TTP's threat behavior.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
||||
where `process_netsh`AND Processes.process = "* show *" Processes.process IN ("*state*", "*config*", "*wlan*", "*profile*")
|
||||
by Process.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid
|
||||
Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user
|
||||
| `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `windows_system_network_connections_discovery_netsh_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
|
||||
known_false_positives: network administrator can use this tool for auditing process.
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1049/
|
||||
- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
|
||||
- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Post-Exploitation
|
||||
- Prestige Ransomware
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 30
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Discovery
|
||||
- Stage:Recon
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
|
||||
impact: 30
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: netsh process with command line $process$ in $dest$
|
||||
mitre_attack_id:
|
||||
- T1049
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process_name
|
||||
- Processes.parent_process
|
||||
- Processes.original_file_name
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_path
|
||||
- Processes.process_path
|
||||
- Processes.parent_process_id
|
||||
- Processes.parent_process_guid
|
||||
- Processes.process_guid
|
||||
risk_score: 9
|
||||
security_domain: endpoint
|
||||
+2
-2
@@ -1,8 +1,8 @@
|
||||
attackcti==0.3.7
|
||||
attackcti==0.3.8
|
||||
docker==6.0.0
|
||||
GitPython==3.1.29
|
||||
Jinja2==3.1.2
|
||||
jsonschema==4.17.0
|
||||
jsonschema==4.17.3
|
||||
mock==4.0.3
|
||||
psutil==5.9.4
|
||||
pycvesearch==1.2
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
name: Windows Post-Exploitation
|
||||
id: 992899b7-a5cf-4bcd-bb0d-cf81762188ba
|
||||
version: 1
|
||||
date: '2022-11-30'
|
||||
author: Teoderick Contreras, Splunk
|
||||
description: This analytic story identifies popular Windows post exploitation tools for example winpeas.bat, winpeas.exe, WinPrivCheck.bat and many more.
|
||||
narrative: These tools allow operators to find possible exploits or paths for privilege escalation and persistence on a targeted host.
|
||||
Ransomware operator like the "Prestige ransomware" also used or abuses these post exploitation tools such as winPEAS to scan for possible avenue to gain privileges and persistence to a targeted
|
||||
Windows Operating System.
|
||||
references:
|
||||
- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
|
||||
tags:
|
||||
analytic_story: Windows Post-Exploitation
|
||||
category:
|
||||
- Adversary Tactics
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
usecase: Security Monitoring
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Cached Domain Credentials Reg Query Unit Test
|
||||
tests:
|
||||
- name: Windows Cached Domain Credentials Reg Query
|
||||
file: endpoint/windows_cached_domain_credentials_reg_query.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows ClipBoard Data via Get-ClipBoard Unit Test
|
||||
tests:
|
||||
- name: Windows ClipBoard Data via Get-ClipBoard
|
||||
file: endpoint/windows_clipboard_data_via_get_clipboard.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-powershell-xml2.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/powershell/windows-powershell-xml2.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Credentials from Password Stores Query Unit Test
|
||||
tests:
|
||||
- name: Windows Credentials from Password Stores Query
|
||||
file: endpoint/windows_credentials_from_password_stores_query.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: cmdkey-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_cmdkeylist/cmdkey-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Credentials in Registry Reg Query Unit Test
|
||||
tests:
|
||||
- name: Windows Credentials in Registry Reg Query
|
||||
file: endpoint/windows_credentials_in_registry_reg_query.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: query-putty-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_pwd/query-putty-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Indirect Command Execution Via Series Of Forfiles Unit Test
|
||||
tests:
|
||||
- name: Windows Indirect Command Execution Via Series Of Forfiles
|
||||
file: endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Information Discovery Fsutil Unit Test
|
||||
tests:
|
||||
- name: Windows Information Discovery Fsutil
|
||||
file: endpoint/windows_information_discovery_fsutil.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: fsutil-fsinfo-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_fsutil/fsutil-fsinfo-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Password Managers Discovery Unit Test
|
||||
tests:
|
||||
- name: Windows Password Managers Discovery
|
||||
file: endpoint/windows_password_managers_discovery.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: dir-db-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_pwd_db/dir-db-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Private Keys Discovery Unit Test
|
||||
tests:
|
||||
- name: Windows Private Keys Discovery
|
||||
file: endpoint/windows_private_keys_discovery.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: dir-private-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_private_key/dir-private-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Security Support Provider Reg Query Unit Test
|
||||
tests:
|
||||
- name: Windows Security Support Provider Reg Query
|
||||
file: endpoint/windows_security_support_provider_reg_query.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows Steal or Forge Kerberos Tickets Klist Unit Test
|
||||
tests:
|
||||
- name: Windows Steal or Forge Kerberos Tickets Klist
|
||||
file: endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows System Network Config Discovery Display DNS Unit Test
|
||||
tests:
|
||||
- name: Windows System Network Config Discovery Display DNS
|
||||
file: endpoint/windows_system_network_config_discovery_display_dns.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Windows System Network Connections Discovery Netsh Unit Test
|
||||
tests:
|
||||
- name: Windows System Network Connections Discovery Netsh
|
||||
file: endpoint/windows_system_network_connections_discovery_netsh.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
Reference in New Issue
Block a user