mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Michael Haag
81 lines
3.1 KiB
YAML
81 lines
3.1 KiB
YAML
name: Windows Ngrok Reverse Proxy Usage
|
|
id: e2549f2c-0aef-408a-b0c1-e0f270623436
|
|
version: 2
|
|
date: '2023-01-12'
|
|
author: Michael Haag, Splunk
|
|
type: Anomaly
|
|
datamodel:
|
|
- Endpoint
|
|
description: The following analytic identifies the use of ngrok.exe being utilized on the Windows operating system. Unfortunately, there is no original file name for Ngrok, so it may be worth an additional hunt to identify any command-line arguments.
|
|
The sign of someone using Ngrok is not malicious, however, more recently it has become an adversary tool.
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
|
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=ngrok.exe
|
|
Processes.process IN ("*start*", "*--config*","*http*","*authtoken*", "*http*", "*tcp*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
|
|
Processes.process Processes.process_id Processes.parent_process_id
|
|
| `drop_dm_object_name(Processes)`
|
|
| `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)`| `windows_ngrok_reverse_proxy_usage_filter`'
|
|
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
|
known_false_positives: False positives will be present based on organizations that allow the use of Ngrok. Filter or monitor as needed.
|
|
references:
|
|
- https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf
|
|
tags:
|
|
analytic_story:
|
|
- Reverse Network Proxy
|
|
- CISA AA22-320A
|
|
asset_type: Endpoint
|
|
cis20:
|
|
- CIS 3
|
|
- CIS 5
|
|
- CIS 16
|
|
confidence: 100
|
|
context:
|
|
- Source:Endpoint
|
|
- Stage:Defense Evasion
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/ngrok/windows-sysmon.log
|
|
impact: 50
|
|
kill_chain_phases:
|
|
- Command & Control
|
|
message: A reverse proxy was identified spawning from $parent_process_name$ - $process_name$ on endpoint $dest$ by user $user$.
|
|
mitre_attack_id:
|
|
- T1572
|
|
- T1090
|
|
- T1102
|
|
nist:
|
|
- DE.CM
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: parent_process_name
|
|
type: Process
|
|
role:
|
|
- Parent Process
|
|
- name: process_name
|
|
type: Process
|
|
role:
|
|
- Child Process
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- Processes.dest
|
|
- Processes.user
|
|
- Processes.parent_process_name
|
|
- Processes.parent_process
|
|
- Processes.original_file_name
|
|
- Processes.process_name
|
|
- Processes.process
|
|
- Processes.process_id
|
|
- Processes.parent_process_path
|
|
- Processes.process_path
|
|
- Processes.parent_process_id
|
|
risk_score: 50
|
|
security_domain: endpoint |