mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
srv-rr-gh-researchbt
44 lines
1.9 KiB
YAML
44 lines
1.9 KiB
YAML
name: Windows BootLoader Inventory
|
|
id: 4f7e3913-4db3-4ccd-afe4-31198982305d
|
|
version: 1
|
|
date: '2023-04-14'
|
|
author: Michael Haag, Splunk
|
|
status: experimental
|
|
type: Hunting
|
|
data_source: []
|
|
description: The following hunting query utilizes a PowerShell Scripted input that captures the bootloader paths for each Windows endpoint it is deployed to. The template inputs.conf is located in the references link.
|
|
By default, it only captures the path, but may be modified to capture everything that BCDedit provides. It can be verbose, but may be worth it.
|
|
search: '`bootloader_inventory` | stats count min(_time) as firstTime max(_time)
|
|
as lastTime values(_raw) by host | `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)` | `windows_bootloader_inventory_filter`'
|
|
how_to_implement: To implement this analytic, a new stanza will need to be added to a inputs.conf and deployed to all or some Windows endpoints. https://gist.github.com/MHaggis/26518cd2844b0e03de6126660bb45707 provides the stanza. If modifying the sourcetype, be sure to update the Macro for this analytic. Recommend running it daily, or weekly, depending on threat model.
|
|
known_false_positives: No false positives here, only bootloaders. Filter as needed or create a lookup as a baseline.
|
|
references:
|
|
- https://gist.github.com/MHaggis/26518cd2844b0e03de6126660bb45707
|
|
- https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
|
|
tags:
|
|
analytic_story:
|
|
- BlackLotus Campaign
|
|
- Windows BootKits
|
|
asset_type: Endpoint
|
|
atomic_guid: []
|
|
confidence: 90
|
|
impact: 90
|
|
message: A list of BootLoaders are present on $dest$
|
|
mitre_attack_id:
|
|
- T1542.001
|
|
- T1542
|
|
observable:
|
|
- name: host
|
|
type: Endpoint
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- _raw
|
|
risk_score: 81
|
|
security_domain: endpoint |