mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Teoderick Contreras
73 lines
3.0 KiB
YAML
73 lines
3.0 KiB
YAML
name: Windows Alternate DataStream - Executable Content
|
|
id: a258bf2a-34fd-4986-8086-78f506e00206
|
|
version: 2
|
|
date: '2024-02-15'
|
|
author: Steven Dick, Teoderick Contreras, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: This analytic is designed to detect when data, possessing an IMPHASH value, is written to an Alternate Data Stream (ADS) in the NTFS file system. The presence of an IMPHASH value suggests that the written data has a Portable Executable (PE) structure, indicating its potential to be executed. Such behavior could be a sign of a threat actor staging malicious code within hard-to-detect areas of the file system for future use or persistence. It's important to note that for this analytic to function correctly, import hashing/imphash must be enabled within Sysmon. This allows the capture of the IMPHASH value, a unique identifier for the imported functions of a PE, providing a robust mechanism for detecting hidden malicious activity leveraging ADS.
|
|
data_source:
|
|
- Sysmon Event ID 15
|
|
search: '`sysmon` EventCode=15 IMPHASH!=00000000000000000000000000000000
|
|
| regex TargetFilename="(?<!\/)\b\w+(\.\w+)?:\w+(\.\w+)?$"
|
|
| eval file_name = replace(TargetFilename,"(.*\\\)",""), process = Image , file_path = TargetFilename, file_hash = coalesce(SHA256,SHA1,MD5,Hash)
|
|
| stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by dest, process, process_guid, file_name, file_path, file_hash, IMPHASH
|
|
| `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)`
|
|
| `windows_alternate_datastream___executable_content_filter`'
|
|
how_to_implement: Target environment must ingest Sysmon data, specifically Event ID 15, and import hashing/imphash must be enabled within Sysmon.
|
|
known_false_positives: Unknown
|
|
references:
|
|
- https://car.mitre.org/analytics/CAR-2020-08-001/
|
|
- https://blogs.juniper.net/en-us/threat-research/bitpaymer-ransomware-hides-behind-windows-alternate-data-streams
|
|
- https://twitter.com/0xrawsec/status/1002478725605273600?s=21
|
|
tags:
|
|
analytic_story:
|
|
- Windows Defense Evasion Tactics
|
|
asset_type: Endpoint
|
|
confidence: 80
|
|
impact: 100
|
|
message: Base64 content written to an NTFS alternate data stream by $user$, see command field for details.
|
|
mitre_attack_id:
|
|
- T1564
|
|
- T1564.004
|
|
observable:
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: user
|
|
type: User Name
|
|
role:
|
|
- Victim
|
|
|
|
- name: file_name
|
|
type: File Name
|
|
role:
|
|
- Attacker
|
|
- name: file_hash
|
|
type: File Hash
|
|
role:
|
|
- Attacker
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- dest
|
|
- TargetFilename
|
|
- Image
|
|
- Contents
|
|
- file_hash
|
|
- process_guid
|
|
- IMPHASH
|
|
risk_score: 80
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564.004/ads_abuse/ads_abuse_sysmon.log
|
|
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
|
sourcetype: XmlWinEventLog
|
|
update_timestamp: true |