mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Michael Haag
73 lines
3.3 KiB
YAML
73 lines
3.3 KiB
YAML
name: Windows Remote Access Software Hunt
|
|
id: 8bd22c9f-05a2-4db1-b131-29271f28cb0a
|
|
version: 1
|
|
date: '2022-08-22'
|
|
author: Michael Haag, Splunk
|
|
type: Hunting
|
|
datamodel:
|
|
- Endpoint
|
|
description: The following hunting analytic is meant to help organizations understand what remote access software is being used in the environment. When reviewing this hunt, confirm the software identified is authorized to be utilized. Based on fidelity, create a new analytic for specific utilities banned within the organization.
|
|
Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown Processes.user!=unknown by Processes.dest Processes.user Processes.process_name Processes.process
|
|
| `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)`
|
|
| `drop_dm_object_name(Processes)`
|
|
| lookup remote_access_software remote_utility AS process_name OUTPUT isutility
|
|
| search isutility = True
|
|
| `windows_remote_access_software_hunt_filter`'
|
|
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
|
|
known_false_positives: False positives will be found. Filter as needed and create higher fidelity analytics based off banned remote access software.
|
|
references:
|
|
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
|
|
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1219/T1219.md
|
|
- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
|
|
tags:
|
|
analytic_story:
|
|
- Insider Threat
|
|
- Command and Control
|
|
- Ransomware
|
|
asset_type: Endpoint
|
|
cis20:
|
|
- CIS 3
|
|
- CIS 5
|
|
- CIS 16
|
|
confidence: 10
|
|
context:
|
|
- Source:Endpoint
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/atomic_red_team/windows-sysmon.log
|
|
impact: 10
|
|
kill_chain_phases:
|
|
- Command & Control
|
|
message: The following Remote Access Software $process_name$ was identified on $dest$.
|
|
mitre_attack_id:
|
|
- T1219
|
|
nist:
|
|
- DE.CM
|
|
observable:
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: process_name
|
|
type: Process
|
|
role:
|
|
- Child Process
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Processes.user
|
|
- Processes.parent_process_name #parent process name
|
|
- Processes.parent_process #parent cmdline
|
|
- Processes.original_file_name
|
|
- Processes.process_name #process name
|
|
- Processes.process #process cmdline
|
|
- Processes.process_id
|
|
- Processes.parent_process_path
|
|
- Processes.process_path
|
|
- Processes.parent_process_id
|
|
risk_score: 1
|
|
security_domain: endpoint |