splunk-security_content/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md

title, excerpt, categories, last_modified_at, toc, toc_label, tags

title	excerpt	categories	last_modified_at	toc	toc_label	tags
Permission Modification using Takeown App	File and Directory Permissions Modification	Endpoint	2021-06-10	true		File and Directory Permissions Modification Defense Evasion Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint

Try in Splunk Security Cloud{: .btn .btn--success}

Description

This search is to detect a modification of file or directory permission using takeown.exe windows app. This technique was seen in some ransomware that take the ownership of a folder or files to encrypt or delete it.

• Type: TTP
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2021-06-10
• Author: Teoderick Contreras, Splunk
• ID: fa7ca5c6-c9d8-11eb-bce9-acde48001122

ATT&CK

ID	Technique	Tactic
T1222	File and Directory Permissions Modification	Defense Evasion

Search

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "takeown.exe" Processes.process = "*/f*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `permission_modification_using_takeown_app_filter`

Associated Analytic Story

• Ransomware

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Required field

• _time
• Processes.parent_process_name
• Processes.parent_process
• Processes.process_name
• Processes.process
• Processes.dest
• Processes.user
• Processes.process_id
• Processes.process_guid

Kill Chain Phase

• Exploitation

Known False Positives

takeown.exe is a normal windows application that may used by network operator.

RBA

Risk Score	Impact	Confidence	Message
56.0	70	80	A suspicious of execution of process_name with process id process_id and commandline process to modify permission of directory or files in host dest

Reference

• https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

• https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log

source | version: 1