mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
75 lines
2.6 KiB
YAML
75 lines
2.6 KiB
YAML
name: Anomalous usage of 7zip
|
|
id: 9364ee8e-a39a-11eb-8f1d-acde48001122
|
|
version: 1
|
|
date: '2021-04-22'
|
|
author: Michael Haag, Teoderick Contreras, Splunk
|
|
status: production
|
|
type: Anomaly
|
|
description: The following detection identifies a 7z.exe spawned from `Rundll32.exe`
|
|
or `Dllhost.exe`. It is assumed that the adversary has brought in `7z.exe` and `7z.dll`.
|
|
It has been observed where an adversary will rename `7z.exe`. Additional coverage
|
|
may be required to identify the behavior of renamed instances of `7z.exe`. During
|
|
triage, identify the source of injection into `Rundll32.exe` or `Dllhost.exe`. Capture
|
|
any files written to disk and analyze as needed. Review parallel processes for additional
|
|
behaviors. Typically, archiving files will result in exfiltration.
|
|
data_source:
|
|
- Sysmon Event ID 1
|
|
search:
|
|
selection1:
|
|
Image|endswith: '7z.exe'
|
|
ParentImage:
|
|
- rundll32.exe
|
|
- dllhost.exe
|
|
condition: selection1
|
|
how_to_implement: To successfully implement this search you need to be ingesting information
|
|
on process that include the name of the process responsible for the changes from
|
|
your endpoints into the `Endpoint` datamodel in the `Processes` node.
|
|
known_false_positives: False positives should be limited as this behavior is not normal
|
|
for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip.
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1560/001/
|
|
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
|
|
- https://thedfirreport.com/2021/01/31/bazar-no-ryuk/
|
|
tags:
|
|
analytic_story:
|
|
- Cobalt Strike
|
|
- NOBELIUM Group
|
|
asset_type: Endpoint
|
|
confidence: 80
|
|
impact: 80
|
|
message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
|
on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading
|
|
of 7zip.
|
|
mitre_attack_id:
|
|
- T1560.001
|
|
- T1560
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: parent_process_name
|
|
type: Process
|
|
role:
|
|
- Parent Process
|
|
- name: process_name
|
|
type: Process
|
|
role:
|
|
- Child Process
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
risk_score: 64
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
|
|
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
|
sourcetype: xmlwineventlog
|