mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Michael Haag
64ed5bb1e8
* APT 37 and The No Good Rustonotto ## Updated analytics ``` detections/application/detect_html_help_spawn_child_process.yml — APT37 Rustonotto and FadeStealer detections/endpoint/bitsadmin_download_file.yml — APT37 Rustonotto and FadeStealer detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml — APT37 Rustonotto and FadeStealer detections/endpoint/cobalt_strike_named_pipes.yml — APT37 Rustonotto and FadeStealer detections/endpoint/detect_html_help_renamed.yml — APT37 Rustonotto and FadeStealer detections/endpoint/detect_html_help_url_in_command_line.yml — APT37 Rustonotto and FadeStealer detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml — APT37 Rustonotto and FadeStealer detections/endpoint/detect_mshta_inline_hta_execution.yml — APT37 Rustonotto and FadeStealer detections/endpoint/detect_mshta_renamed.yml — APT37 Rustonotto and FadeStealer detections/endpoint/detect_mshta_url_in_command_line.yml — APT37 Rustonotto and FadeStealer detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml — APT37 Rustonotto and FadeStealer detections/endpoint/detect_rundll32_inline_hta_execution.yml — APT37 Rustonotto and FadeStealer detections/endpoint/executables_or_script_creation_in_temp_path.yml — APT37 Rustonotto and FadeStealer detections/endpoint/icedid_exfiltrated_archived_file_creation.yml — APT37 Rustonotto and FadeStealer detections/endpoint/lolbas_with_network_traffic.yml — APT37 Rustonotto and FadeStealer detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml — APT37 Rustonotto and FadeStealer detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml — APT37 Rustonotto and FadeStealer detections/endpoint/powershell_4104_hunting.yml — APT37 Rustonotto and FadeStealer detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml — APT37 Rustonotto and FadeStealer detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml — APT37 Rustonotto and FadeStealer detections/endpoint/processes_tapping_keyboard_events.yml — APT37 Rustonotto and FadeStealer detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml — APT37 Rustonotto and FadeStealer detections/endpoint/registry_keys_used_for_persistence.yml — APT37 Rustonotto and FadeStealer detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml — APT37 Rustonotto and FadeStealer detections/endpoint/suspicious_curl_network_connection.yml — APT37 Rustonotto and FadeStealer detections/endpoint/suspicious_image_creation_in_appdata_folder.yml — APT37 Rustonotto and FadeStealer detections/endpoint/suspicious_mshta_spawn.yml — APT37 Rustonotto and FadeStealer detections/endpoint/suspicious_process_executed_from_container_file.yml — APT37 Rustonotto and FadeStealer detections/endpoint/suspicious_scheduled_task_from_public_directory.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_alternate_datastream___base64_content.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_archive_collected_data_via_powershell.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_archive_collected_data_via_rar.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_archived_collected_data_in_temp_folder.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_cab_file_on_disk.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_curl_download_to_suspicious_path.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_file_download_via_powershell.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_high_file_deletion_frequency.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_http_network_communication_from_msiexec.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_indicator_removal_via_rmdir.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_input_capture_using_credential_ui_dll.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_iso_lnk_file_creation.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_office_product_spawned_child_process_for_download.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_office_product_spawned_uncommon_process.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_process_executed_from_removable_media.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_process_execution_from_programdata.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_process_injection_into_notepad.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_replication_through_removable_media.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_scheduled_task_with_suspicious_command.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_scheduled_task_with_suspicious_name.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_screen_capture_in_temp_folder.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_screen_capture_via_powershell.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_service_created_with_suspicious_service_path.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_suspicious_driver_loaded_path.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_usbstor_registry_key_modification.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_wpdbusenum_registry_key_modification.yml — APT37 Rustonotto and FadeStealer detections/endpoint/winevent_scheduled_task_created_within_public_path.yml — APT37 Rustonotto and FadeStealer detections/web/multiple_archive_files_http_post_traffic.yml — APT37 Rustonotto and FadeStealer detections/web/plain_http_post_exfiltrated_data.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_expand_cabinet_file_extraction.yml — APT37 Rustonotto and FadeStealer ``` ## New Story ``` stories/apt37_rustonotto_and_fadestealer.yml — APT37 Rustonotto and FadeStealer ``` * Create windows_expand_cabinet_file_extraction.yml * Apply suggestion from @nasbench Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> * Update detections/endpoint/windows_expand_cabinet_file_extraction.yml Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> * Update detections/endpoint/windows_expand_cabinet_file_extraction.yml Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> * Update detections/endpoint/windows_expand_cabinet_file_extraction.yml Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> * updating conflicts --------- Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com> Co-authored-by: Bhavin Patel <bpatel@splunk.com>
97 lines
4.9 KiB
YAML
97 lines
4.9 KiB
YAML
name: Detect HTML Help Spawn Child Process
|
|
id: 723716de-ee55-4cd4-9759-c44e7e55ba4b
|
|
version: 12
|
|
date: '2025-09-18'
|
|
author: Michael Haag, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: The following analytic detects the execution of hh.exe (HTML Help) spawning
|
|
a child process, indicating the use of a Compiled HTML Help (CHM) file to execute
|
|
Windows script code. This detection leverages data from Endpoint Detection and Response
|
|
(EDR) agents, focusing on process creation events where hh.exe is the parent process.
|
|
This activity is significant as it may indicate an attempt to execute malicious
|
|
scripts via CHM files, a known technique for bypassing security controls. If confirmed
|
|
malicious, this could lead to unauthorized code execution, potentially compromising
|
|
the system.
|
|
data_source:
|
|
- Sysmon EventID 1
|
|
- Windows Event Log Security 4688
|
|
- CrowdStrike ProcessRollup2
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
|
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=hh.exe
|
|
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
|
|
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
|
|
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
|
|
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
|
|
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
|
|
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
|
| `detect_html_help_spawn_child_process_filter`'
|
|
how_to_implement: The detection is based on data that originates from Endpoint Detection
|
|
and Response (EDR) agents. These agents are designed to provide security-related
|
|
telemetry from the endpoints where the agent is installed. To implement this search,
|
|
you must ingest logs that contain the process GUID, process name, and parent process.
|
|
Additionally, you must ingest complete command-line executions. These logs must
|
|
be processed using the appropriate Splunk Technology Add-ons that are specific to
|
|
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
|
|
data model. Use the Splunk Common Information Model (CIM) to normalize the field
|
|
names and speed up the data modeling process.
|
|
known_false_positives: Although unlikely, some legitimate applications (ex. web browsers)
|
|
may spawn a child process. Filter as needed.
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1218/001/
|
|
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
|
|
- https://lolbas-project.github.io/lolbas/Binaries/Hh/
|
|
- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
|
|
- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
|
|
drilldown_searches:
|
|
- name: View the detection results for - "$user$" and "$dest$"
|
|
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
|
|
earliest_offset: $info_min_time$
|
|
latest_offset: $info_max_time$
|
|
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
|
|
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
|
|
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
|
|
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
|
|
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
|
|
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
|
|
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
|
|
earliest_offset: $info_min_time$
|
|
latest_offset: $info_max_time$
|
|
rba:
|
|
message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
|
on endpoint $dest$ by user $user$ spawning a child process, typically not normal
|
|
behavior.
|
|
risk_objects:
|
|
- field: user
|
|
type: user
|
|
score: 80
|
|
- field: dest
|
|
type: system
|
|
score: 80
|
|
threat_objects:
|
|
- field: parent_process_name
|
|
type: parent_process_name
|
|
- field: process_name
|
|
type: process_name
|
|
tags:
|
|
analytic_story:
|
|
- Suspicious Compiled HTML Activity
|
|
- AgentTesla
|
|
- Living Off The Land
|
|
- Compromised Windows Host
|
|
- APT37 Rustonotto and FadeStealer
|
|
asset_type: Endpoint
|
|
mitre_attack_id:
|
|
- T1218.001
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log
|
|
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
|
sourcetype: XmlWinEventLog
|