mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Michael Haag
88 lines
4.0 KiB
YAML
88 lines
4.0 KiB
YAML
name: Windows Identify Protocol Handlers
|
|
id: bd5c311e-a6ea-48ae-a289-19a3398e3648
|
|
version: 2
|
|
date: '2022-09-13'
|
|
author: Michael Haag, Splunk
|
|
type: Hunting
|
|
datamodel:
|
|
- Endpoint
|
|
description: 'The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings).
|
|
To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell.'
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process_name Processes.process
|
|
| `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)`
|
|
| `drop_dm_object_name(Processes)`
|
|
| lookup windows_protocol_handlers handler AS process OUTPUT handler ishandler | where ishandler="TRUE"
|
|
| `windows_identify_protocol_handlers_filter`'
|
|
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
|
known_false_positives: False positives will be found. https and http is a URL Protocol handler that will trigger this analytic. Tune based on process or command-line.
|
|
references:
|
|
- https://gist.github.com/MHaggis/a0d3edb57d36e0916c94c0a464b2722e
|
|
- https://www.oreilly.com/library/view/learning-java/1565927184/apas02.html
|
|
- https://blogs.windows.com/msedgedev/2022/01/20/getting-started-url-protocol-handlers-microsoft-edge/
|
|
- https://github.com/Mr-Un1k0d3r/PoisonHandler
|
|
- https://www.mdsec.co.uk/2021/03/phishing-users-to-take-a-test/
|
|
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-5---protocolhandlerexe-downloaded-a-suspicious-file
|
|
- https://techcommunity.microsoft.com/t5/windows-it-pro-blog/disabling-the-msix-ms-appinstaller-protocol-handler/ba-p/3119479
|
|
- https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
|
|
- https://parsiya.net/blog/2021-03-17-attack-surface-analysis-part-2-custom-protocol-handlers/
|
|
tags:
|
|
analytic_story:
|
|
- Living Off The Land
|
|
asset_type: Endpoint
|
|
cis20:
|
|
- CIS 3
|
|
- CIS 5
|
|
- CIS 16
|
|
confidence: 20
|
|
context:
|
|
- Source:Endpoint
|
|
- Stage:Defense Evasion
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/protocol_handlers/protocolhandlers.log
|
|
impact: 30
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing a protocol handler.
|
|
mitre_attack_id:
|
|
- T1059
|
|
nist:
|
|
- DE.CM
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: parent_process_name
|
|
type: Process Name
|
|
role:
|
|
- Parent Process
|
|
- name: process_name
|
|
type: Process
|
|
role:
|
|
- Child Process
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Processes.dest
|
|
- Processes.user
|
|
- Processes.parent_process_name #parent process name
|
|
- Processes.parent_process #parent cmdline
|
|
- Processes.original_file_name
|
|
- Processes.process_name #process name
|
|
- Processes.process #process cmdline
|
|
- Processes.process_id
|
|
- Processes.parent_process_path
|
|
- Processes.process_path
|
|
- Processes.parent_process_id
|
|
risk_score: 6
|
|
security_domain: endpoint
|
|
|