name: ProxyShell ProxyNotShell Behavior Detected
id: c32fab32-6aaf-492d-bfaf-acbed8e50cdf
version: 1
date: '2023-07-10'
author: Michael Haag, Splunk
status: production
type: Correlation
description: The following correlation will identify activity related to Windows Exchange
  being actively exploited by adversaries related to ProxyShell or ProxyNotShell.
  In addition, the analytic correlates post-exploitation Cobalt Strike analytic story.
  Common post-exploitation behavior has been seen in the wild includes adversaries
  running nltest, Cobalt Strike, Mimikatz and adding a new user. The correlation specifically
  looks for 5 distinct analyticstories to trigger. Modify or tune as needed for your
  organization. 5 analytics is an arbitrary number but was chosen to reduce the amount
  of noise but also require the 2 analytic stories or a ProxyShell and CobaltStrike
  to fire. Adversaries will exploit the vulnerable Exchange server, abuse SSRF, drop
  a web shell, utilize the PowerShell Exchange modules and begin post-exploitation.
data_source: []
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
  as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score)
  as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as
  annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id)
  as mitre_tactic_id_count, values(All_Risk.analyticstories) as analyticstories values(All_Risk.annotations.mitre_attack.mitre_technique_id)
  as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id)
  as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source,
  dc(source) as source_count dc(All_Risk.analyticstories) as dc_analyticstories from
  datamodel=Risk.All_Risk where All_Risk.analyticstories IN ("ProxyNotShell","ProxyShell")
  OR (All_Risk.analyticstories IN ("ProxyNotShell","ProxyShell") AND All_Risk.analyticstories="Cobalt
  Strike") All_Risk.risk_object_type="system" by _time span=1h All_Risk.risk_object
  All_Risk.risk_object_type | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`| where source_count >=5 | `proxyshell_proxynotshell_behavior_detected_filter`'
how_to_implement: To implement this correlation, you will need to enable ProxyShell,
  ProxyNotShell and Cobalt Strike analytic stories (the anaytics themselves) and ensure
  proper data is being collected for Web and Endpoint datamodels. Run the correlation
  rule seperately to validate it is not triggering too much or generating incorrectly.
  Validate by running ProxyShell POC code and Cobalt Strike behavior.
known_false_positives: False positives will be limited, however tune or modify the
  query as needed.
references:
- https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html
- https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/
tags:
  analytic_story:
  - ProxyShell
  - BlackByte Ransomware
  - ProxyNotShell
  asset_type: Web Server
  confidence: 90
  impact: 90
  message: ProxyShell or ProxyNotShell activity has been identified on $risk_object$.
  mitre_attack_id:
  - T1190
  - T1133
  observable:
  - name: risk_object
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - All_Risk.analyticstories
  - All_Risk.risk_object_type
  - All_Risk.risk_object
  - All_Risk.annotations.mitre_attack.mitre_tactic
  - source
  risk_score: 81
  security_domain: network
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/proxyshell/proxyshell-risk.log
    source: proxyshell
    sourcetype: stash
    update_timestamp: true