admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
4f9691205fb7ffc2cdbcaefcb8cfb5bfaae414cf
splunk-security_content/docs/stories.wiki
T
research bot 02e58a1dfa updating docs and package bits [ci skip]
2021-08-27 21:52:55 +00:00

8733 lines
279 KiB
Plaintext
Raw Blame History

=Splunk Security Content Analytic Story =
----
All the Analytic Stories shipped to different Splunk products. Below is a breakdown by Category.
==Abuse==
===Brand monitoring===
Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Email, Endpoint, Web
* '''ATT&CK''':
* '''Last Updated''': 2017-12-19
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Dnstwist_domain_names|DNSTwist Domain Names]]
* [[Documentation:ESSOC:detections:Detections#Get_email_info|Get Email Info]]
* [[Documentation:ESSOC:detections:Detections#Get_emails_from_specific_sender|Get Emails From Specific Sender]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_process_responsible_for_the_dns_traffic|Get Process Responsible For The DNS Traffic]]
* [[Documentation:ESSOC:detections:Detections#Monitor_email_for_brand_abuse|Monitor Email For Brand Abuse]]
* [[Documentation:ESSOC:detections:Detections#Monitor_web_traffic_for_brand_abuse|Monitor Web Traffic For Brand Abuse]]
====Kill Chain Phase====
* Delivery
====Reference====
* https://www.zerofox.com/blog/what-is-digital-risk-monitoring/
* https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/
* https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/
''version'': 1
</div>
</div>
----
===Dns amplification attacks===
DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it responds to `ANY` queries. This Analytic Story can help you detect attackers who may be abusing your company's DNS infrastructure to launch amplification attacks, causing Denial of Service to other victims.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Network_Resolution
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1498.002/ T1498.002]
* '''Last Updated''': 2016-09-13
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Large_volume_of_dns_any_queries|Large Volume of DNS ANY Queries]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1498.002
| Reflection Amplification
| Impact
|}
====Kill Chain Phase====
* Actions on Objectives
====Reference====
* https://www.us-cert.gov/ncas/alerts/TA13-088A
* https://www.imperva.com/learn/application-security/dns-amplification/
''version'': 1
</div>
</div>
----
===Data protection===
Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint, Network_Resolution, Network_Traffic
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1189/ T1189]
* '''Last Updated''': 2017-09-14
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Detect_hosts_connecting_to_dynamic_domain_providers|Detect hosts connecting to dynamic domain providers]]
* [[Documentation:ESSOC:detections:Detections#Get_dns_server_history_for_a_host|Get DNS Server History for a host]]
* [[Documentation:ESSOC:detections:Detections#Get_dns_traffic_ratio|Get DNS traffic ratio]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_responsible_for_the_dns_traffic|Get Process Responsible For The DNS Traffic]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1189
| Drive-by Compromise
| Initial Access
|}
====Kill Chain Phase====
* Actions on Objectives
* Command and Control
====Reference====
* https://www.cisecurity.org/controls/data-protection/
* https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022
* https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/
''version'': 1
</div>
</div>
----
===Netsh abuse===
Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint, Network_Traffic
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.004/ T1562.004]
* '''Last Updated''': 2017-01-05
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Baseline_of_smb_traffic_-_mltk|Baseline of SMB Traffic - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_command_line_arguments|Previously seen command line arguments]]
* [[Documentation:ESSOC:detections:Detections#Processes_launching_netsh|Processes launching netsh]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1562.004
| Disable or Modify System Firewall
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
====Reference====
* https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)
* https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html
* http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html
''version'': 1
</div>
</div>
----
==Adversary Tactics==
===Active directory password spraying===
Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110.003/ T1110.003]
* '''Last Updated''': 2021-04-07
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos|Multiple Disabled Users Failing To Authenticate From Host Using Kerberos]]
* [[Documentation:ESSOC:detections:Detections#Multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos|Multiple Invalid Users Failing To Authenticate From Host Using Kerberos]]
* [[Documentation:ESSOC:detections:Detections#Multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm|Multiple Invalid Users Failing To Authenticate From Host Using NTLM]]
* [[Documentation:ESSOC:detections:Detections#Multiple_users_attempting_to_authenticate_using_explicit_credentials|Multiple Users Attempting To Authenticate Using Explicit Credentials]]
* [[Documentation:ESSOC:detections:Detections#Multiple_users_failing_to_authenticate_from_host_using_kerberos|Multiple Users Failing To Authenticate From Host Using Kerberos]]
* [[Documentation:ESSOC:detections:Detections#Multiple_users_failing_to_authenticate_from_host_using_ntlm|Multiple Users Failing To Authenticate From Host Using NTLM]]
* [[Documentation:ESSOC:detections:Detections#Multiple_users_failing_to_authenticate_from_process|Multiple Users Failing To Authenticate From Process]]
* [[Documentation:ESSOC:detections:Detections#Multiple_users_remotely_failing_to_authenticate_from_host|Multiple Users Remotely Failing To Authenticate From Host]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1110.003
| Password Spraying
| Credential Access
|}
====Kill Chain Phase====
* Exploitation
====Reference====
* https://attack.mitre.org/techniques/T1110/003/
* https://www.microsoft.com/security/blog/2020/04/23/protecting-organization-password-spray-attacks/
* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn452415(v=ws.11)
''version'': 1
</div>
</div>
----
===Bits jobs===
Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1197/ T1197], [https://attack.mitre.org/techniques/T1105/ T1105]
* '''Last Updated''': 2021-03-26
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Bits_job_persistence|BITS Job Persistence]]
* [[Documentation:ESSOC:detections:Detections#Bitsadmin_download_file|BITSAdmin Download File]]
* [[Documentation:ESSOC:detections:Detections#Powershell_start-bitstransfer|PowerShell Start-BitsTransfer]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1197
| BITS Jobs
| Defense Evasion, Persistence
|-
| T1105
| Ingress Tool Transfer
| Command And Control
|}
====Kill Chain Phase====
* Exploitation
====Reference====
* https://attack.mitre.org/techniques/T1197/
* https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
''version'': 1
</div>
</div>
----
===Baron samedit cve-2021-3156===
Uncover activity consistent with CVE-2021-3156. Discovered by the Qualys Research Team, this vulnerability has been found to affect sudo across multiple Linux distributions (Ubuntu 20.04 and prior, Debian 10 and prior, Fedora 33 and prior). As this vulnerability was committed to code in July 2011, there will be many distributions affected. Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1068/ T1068]
* '''Last Updated''': 2021-01-27
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Detect_baron_samedit_cve-2021-3156|Detect Baron Samedit CVE-2021-3156]]
* [[Documentation:ESSOC:detections:Detections#Detect_baron_samedit_cve-2021-3156_segfault|Detect Baron Samedit CVE-2021-3156 Segfault]]
* [[Documentation:ESSOC:detections:Detections#Detect_baron_samedit_cve-2021-3156_via_osquery|Detect Baron Samedit CVE-2021-3156 via OSQuery]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1068
| Exploitation for Privilege Escalation
| Privilege Escalation
|}
====Kill Chain Phase====
* Exploitation
====Reference====
* https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit
''version'': 1
</div>
</div>
----
===Cobalt strike===
Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560.001/ T1560.001], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1071.002/ T1071.002], [https://attack.mitre.org/techniques/T1218.010/ T1218.010], [https://attack.mitre.org/techniques/T1218.005/ T1218.005], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1027/ T1027], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1203/ T1203], [https://attack.mitre.org/techniques/T1505.003/ T1505.003], [https://attack.mitre.org/techniques/T1127.001/ T1127.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1127/ T1127], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1018/ T1018]
* '''Last Updated''': 2021-02-16
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Anomalous_usage_of_7zip|Anomalous usage of 7zip]]
* [[Documentation:ESSOC:detections:Detections#Cmd_echo_pipe_-_escalation|CMD Echo Pipe - Escalation]]
* [[Documentation:ESSOC:detections:Detections#Cobalt_strike_named_pipes|Cobalt Strike Named Pipes]]
* [[Documentation:ESSOC:detections:Detections#Dllhost_with_no_command_line_arguments_with_network|DLLHost with no Command Line Arguments with Network]]
* [[Documentation:ESSOC:detections:Detections#Detect_regsvr32_application_control_bypass|Detect Regsvr32 Application Control Bypass]]
* [[Documentation:ESSOC:detections:Detections#Gpupdate_with_no_command_line_arguments_with_network|GPUpdate with no Command Line Arguments with Network]]
* [[Documentation:ESSOC:detections:Detections#Rundll32_with_no_command_line_arguments_with_network|Rundll32 with no Command Line Arguments with Network]]
* [[Documentation:ESSOC:detections:Detections#Searchprotocolhost_with_no_command_line_with_network|SearchProtocolHost with no Command Line with Network]]
* [[Documentation:ESSOC:detections:Detections#Services_escalate_exe|Services Escalate Exe]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_dllhost_no_command_line_arguments|Suspicious DLLHost no Command Line Arguments]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_gpupdate_no_command_line_arguments|Suspicious GPUpdate no Command Line Arguments]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_rename|Suspicious MSBuild Rename]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_startw|Suspicious Rundll32 StartW]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_no_command_line_arguments|Suspicious Rundll32 no Command Line Arguments]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_searchprotocolhost_no_command_line_arguments|Suspicious SearchProtocolHost no Command Line Arguments]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_microsoft_workflow_compiler_rename|Suspicious microsoft workflow compiler rename]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_path|Suspicious msbuild path]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1560.001
| Archive via Utility
| Collection
|-
| T1059.003
| Windows Command Shell
| Execution
|-
| T1543.003
| Windows Service
| Persistence, Privilege Escalation
|-
| T1055
| Process Injection
| Defense Evasion, Privilege Escalation
|-
| T1071.002
| File Transfer Protocols
| Command And Control
|-
| T1218.010
| Regsvr32
| Defense Evasion
|-
| T1218.005
| Mshta
| Defense Evasion
|-
| T1569.002
| Service Execution
| Execution
|-
| T1027
| Obfuscated Files or Information
| Defense Evasion
|-
| T1218.011
| Rundll32
| Defense Evasion
|-
| T1053.005
| Scheduled Task
| Execution, Persistence, Privilege Escalation
|-
| T1548
| Abuse Elevation Control Mechanism
| Privilege Escalation, Defense Evasion
|-
| T1203
| Exploitation for Client Execution
| Execution
|-
| T1505.003
| Web Shell
| Persistence
|-
| T1127.001
| MSBuild
| Defense Evasion
|-
| T1036.003
| Rename System Utilities
| Defense Evasion
|-
| T1127
| Trusted Developer Utilities Proxy Execution
| Defense Evasion
|-
| T1071.001
| Web Protocols
| Command And Control
|-
| T1018
| Remote System Discovery
| Discovery
|}
====Kill Chain Phase====
* Actions on Objective
* Actions on Objectives
* Exploitation
* Privilege Escalation
====Reference====
* https://www.cobaltstrike.com/
* https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/
* https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/
* https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html
* https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html
* https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence
* https://github.com/zer0yu/Awesome-CobaltStrike
''version'': 1
</div>
</div>
----
===Collection and staging===
Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint, Network_Traffic
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560.001/ T1560.001], [https://attack.mitre.org/techniques/T1114.001/ T1114.001], [https://attack.mitre.org/techniques/T1114.002/ T1114.002], [https://attack.mitre.org/techniques/T1036/ T1036]
* '''Last Updated''': 2020-02-03
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Detect_renamed_7-zip|Detect Renamed 7-Zip]]
* [[Documentation:ESSOC:detections:Detections#Detect_renamed_winrar|Detect Renamed WinRAR]]
* [[Documentation:ESSOC:detections:Detections#Email_files_written_outside_of_the_outlook_directory|Email files written outside of the Outlook directory]]
* [[Documentation:ESSOC:detections:Detections#Email_servers_sending_high_volume_traffic_to_hosts|Email servers sending high volume traffic to hosts]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Hosts_receiving_high_volume_of_network_traffic_from_email_server|Hosts receiving high volume of network traffic from email server]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_writes_to_windows_recycle_bin|Suspicious writes to windows Recycle Bin]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1560.001
| Archive via Utility
| Collection
|-
| T1114.001
| Local Email Collection
| Collection
|-
| T1114.002
| Remote Email Collection
| Collection
|-
| T1036
| Masquerading
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
* Exfiltration
* Exploitation
====Reference====
* https://attack.mitre.org/wiki/Collection
* https://attack.mitre.org/wiki/Technique/T1074
''version'': 1
</div>
</div>
----
===Command and control===
Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint, Network_Resolution, Network_Traffic
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1071.004/ T1071.004], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1095/ T1095], [https://attack.mitre.org/techniques/T1041/ T1041], [https://attack.mitre.org/techniques/T1189/ T1189], [https://attack.mitre.org/techniques/T1537/ T1537], [https://attack.mitre.org/techniques/T1114.001/ T1114.001], [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114.003/ T1114.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
* '''Last Updated''': 2018-06-01
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_arn|AWS Investigate User Activities By ARN]]
* [[Documentation:ESSOC:detections:Detections#Aws_network_acl_details_from_id|AWS Network ACL Details from ID]]
* [[Documentation:ESSOC:detections:Detections#Aws_network_interface_details_via_resourceid|AWS Network Interface details via resourceId]]
* [[Documentation:ESSOC:detections:Detections#Baseline_of_dns_query_length_-_mltk|Baseline of DNS Query Length - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Baseline_of_blocked_outbound_traffic_from_aws|Baseline of blocked outbound traffic from AWS]]
* [[Documentation:ESSOC:detections:Detections#Dns_exfiltration_using_nslookup_app|DNS Exfiltration Using Nslookup App]]
* [[Documentation:ESSOC:detections:Detections#Dns_query_length_outliers_-_mltk|DNS Query Length Outliers - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Dns_query_length_with_high_standard_deviation|DNS Query Length With High Standard Deviation]]
* [[Documentation:ESSOC:detections:Detections#Detect_large_outbound_icmp_packets|Detect Large Outbound ICMP Packets]]
* [[Documentation:ESSOC:detections:Detections#Detect_spike_in_blocked_outbound_traffic_from_your_aws|Detect Spike in blocked Outbound Traffic from your AWS]]
* [[Documentation:ESSOC:detections:Detections#Detect_hosts_connecting_to_dynamic_domain_providers|Detect hosts connecting to dynamic domain providers]]
* [[Documentation:ESSOC:detections:Detections#Excessive_dns_failures|Excessive DNS Failures]]
* [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_nslookup_app|Excessive Usage of NSLOOKUP App]]
* [[Documentation:ESSOC:detections:Detections#Get_all_aws_activity_from_ip_address|Get All AWS Activity From IP Address]]
* [[Documentation:ESSOC:detections:Detections#Get_dns_server_history_for_a_host|Get DNS Server History for a host]]
* [[Documentation:ESSOC:detections:Detections#Get_dns_traffic_ratio|Get DNS traffic ratio]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
* [[Documentation:ESSOC:detections:Detections#Get_process_responsible_for_the_dns_traffic|Get Process Responsible For The DNS Traffic]]
* [[Documentation:ESSOC:detections:Detections#Multiple_archive_files_http_post_traffic|Multiple Archive Files Http Post Traffic]]
* [[Documentation:ESSOC:detections:Detections#Plain_http_post_exfiltrated_data|Plain HTTP POST Exfiltrated Data]]
* [[Documentation:ESSOC:detections:Detections#Prohibited_network_traffic_allowed|Prohibited Network Traffic Allowed]]
* [[Documentation:ESSOC:detections:Detections#Protocol_or_port_mismatch|Protocol or Port Mismatch]]
* [[Documentation:ESSOC:detections:Detections#Tor_traffic|TOR Traffic]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1048
| Exfiltration Over Alternative Protocol
| Exfiltration
|-
| T1071.004
| DNS
| Command And Control
|-
| T1048.003
| Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
| Exfiltration
|-
| T1095
| Non-Application Layer Protocol
| Command And Control
|-
| T1041
| Exfiltration Over C2 Channel
| Exfiltration
|-
| T1189
| Drive-by Compromise
| Initial Access
|-
| T1537
| Transfer Data to Cloud Account
| Exfiltration
|-
| T1114.001
| Local Email Collection
| Collection
|-
| T1114
| Email Collection
| Collection
|-
| T1114.003
| Email Forwarding Rule
| Collection
|-
| T1071.001
| Web Protocols
| Command And Control
|}
====Kill Chain Phase====
* Actions on Objectives
* Command and Control
* Delivery
* Exfiltration
* Exploitation
====Reference====
* https://attack.mitre.org/wiki/Command_and_Control
* https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware
''version'': 1
</div>
</div>
----
===Credential dumping===
Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Authentication, Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.001/ T1003.001], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1098/ T1098], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1547/ T1547], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1554/ T1554], [https://attack.mitre.org/techniques/T1556/ T1556], [https://attack.mitre.org/techniques/T1558/ T1558], [https://attack.mitre.org/techniques/T1555/ T1555], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1201/ T1201], [https://attack.mitre.org/techniques/T1552/ T1552], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1003.002/ T1003.002], [https://attack.mitre.org/techniques/T1003.003/ T1003.003], [https://attack.mitre.org/techniques/T1558.003/ T1558.003], [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
* '''Last Updated''': 2020-02-04
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Access_lsass_memory_for_dump_creation|Access LSASS Memory for Dump Creation]]
* [[Documentation:ESSOC:detections:Detections#Applying_stolen_credentials_via_mimikatz_modules|Applying Stolen Credentials via Mimikatz modules]]
* [[Documentation:ESSOC:detections:Detections#Applying_stolen_credentials_via_powersploit_modules|Applying Stolen Credentials via PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Assessment_of_credential_strength_via_dsinternals_modules|Assessment of Credential Strength via DSInternals modules]]
* [[Documentation:ESSOC:detections:Detections#Attempted_credential_dump_from_registry_via_reg_exe|Attempted Credential Dump From Registry via Reg exe]]
* [[Documentation:ESSOC:detections:Detections#Create_remote_thread_into_lsass|Create Remote Thread into LSASS]]
* [[Documentation:ESSOC:detections:Detections#Creation_of_shadow_copy|Creation of Shadow Copy]]
* [[Documentation:ESSOC:detections:Detections#Creation_of_shadow_copy_with_wmic_and_powershell|Creation of Shadow Copy with wmic and powershell]]
* [[Documentation:ESSOC:detections:Detections#Creation_of_lsass_dump_with_taskmgr|Creation of lsass Dump with Taskmgr]]
* [[Documentation:ESSOC:detections:Detections#Credential_dumping_via_copy_command_from_shadow_copy|Credential Dumping via Copy Command from Shadow Copy]]
* [[Documentation:ESSOC:detections:Detections#Credential_dumping_via_symlink_to_shadow_copy|Credential Dumping via Symlink to Shadow Copy]]
* [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option|Credential Extraction indicative of FGDump and CacheDump with s option]]
* [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option|Credential Extraction indicative of FGDump and CacheDump with v option]]
* [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_lazagne_command_line_options|Credential Extraction indicative of Lazagne command line options]]
* [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules|Credential Extraction indicative of use of DSInternals credential conversion modules]]
* [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_use_of_dsinternals_modules|Credential Extraction indicative of use of DSInternals modules]]
* [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_use_of_mimikatz_modules|Credential Extraction indicative of use of Mimikatz modules]]
* [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_use_of_powersploit_modules|Credential Extraction indicative of use of PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Credential_extraction_native_microsoft_debuggers_peek_into_the_kernel|Credential Extraction native Microsoft debuggers peek into the kernel]]
* [[Documentation:ESSOC:detections:Detections#Credential_extraction_native_microsoft_debuggers_via_z_command_line_option|Credential Extraction native Microsoft debuggers via z command line option]]
* [[Documentation:ESSOC:detections:Detections#Credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals|Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals]]
* [[Documentation:ESSOC:detections:Detections#Detect_copy_of_shadowcopy_with_script_block_logging|Detect Copy of ShadowCopy with Script Block Logging]]
* [[Documentation:ESSOC:detections:Detections#Detect_credential_dumping_through_lsass_access|Detect Credential Dumping through LSASS access]]
* [[Documentation:ESSOC:detections:Detections#Detect_dump_lsass_memory_using_comsvcs|Detect Dump LSASS Memory using comsvcs]]
* [[Documentation:ESSOC:detections:Detections#Detect_kerberoasting|Detect Kerberoasting]]
* [[Documentation:ESSOC:detections:Detections#Detect_mimikatz_using_loaded_images|Detect Mimikatz Using Loaded Images]]
* [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_comsvcs_dll|Dump LSASS via comsvcs DLL]]
* [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_procdump|Dump LSASS via procdump]]
* [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_procdump_rename|Dump LSASS via procdump Rename]]
* [[Documentation:ESSOC:detections:Detections#Esentutl_sam_copy|Esentutl SAM Copy]]
* [[Documentation:ESSOC:detections:Detections#Extract_sam_from_registry|Extract SAM from Registry]]
* [[Documentation:ESSOC:detections:Detections#Investigate_failed_logins_for_multiple_destinations|Investigate Failed Logins for Multiple Destinations]]
* [[Documentation:ESSOC:detections:Detections#Investigate_pass_the_hash_attempts|Investigate Pass the Hash Attempts]]
* [[Documentation:ESSOC:detections:Detections#Investigate_pass_the_ticket_attempts|Investigate Pass the Ticket Attempts]]
* [[Documentation:ESSOC:detections:Detections#Investigate_previous_unseen_user|Investigate Previous Unseen User]]
* [[Documentation:ESSOC:detections:Detections#Ntdsutil_export_ntds|Ntdsutil Export NTDS]]
* [[Documentation:ESSOC:detections:Detections#Sam_database_file_access_attempt|SAM Database File Access Attempt]]
* [[Documentation:ESSOC:detections:Detections#Secretdumps_offline_ntds_dumping_tool|SecretDumps Offline NTDS Dumping Tool]]
* [[Documentation:ESSOC:detections:Detections#Set_default_powershell_execution_policy_to_unrestricted_or_bypass|Set Default PowerShell Execution Policy To Unrestricted or Bypass]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1003.001
| LSASS Memory
| Credential Access
|-
| T1055
| Process Injection
| Defense Evasion, Privilege Escalation
|-
| T1068
| Exploitation for Privilege Escalation
| Privilege Escalation
|-
| T1078
| Valid Accounts
| Defense Evasion, Persistence, Privilege Escalation, Initial Access
|-
| T1098
| Account Manipulation
| Persistence
|-
| T1134
| Access Token Manipulation
| Defense Evasion, Privilege Escalation
|-
| T1543
| Create or Modify System Process
| Persistence, Privilege Escalation
|-
| T1547
| Boot or Logon Autostart Execution
| Persistence, Privilege Escalation
|-
| T1548
| Abuse Elevation Control Mechanism
| Privilege Escalation, Defense Evasion
|-
| T1554
| Compromise Client Software Binary
| Persistence
|-
| T1556
| Modify Authentication Process
| Credential Access, Defense Evasion, Persistence
|-
| T1558
| Steal or Forge Kerberos Tickets
| Credential Access
|-
| T1555
| Credentials from Password Stores
| Credential Access
|-
| T1087
| Account Discovery
| Discovery
|-
| T1201
| Password Policy Discovery
| Discovery
|-
| T1552
| Unsecured Credentials
| Credential Access
|-
| T1003
| OS Credential Dumping
| Credential Access
|-
| T1003.002
| Security Account Manager
| Credential Access
|-
| T1003.003
| NTDS
| Credential Access
|-
| T1558.003
| Kerberoasting
| Credential Access
|-
| T1059.001
| PowerShell
| Execution
|}
====Kill Chain Phase====
* Actions on Objectives
* Exploitation
* Installation
* Lateral Movement
* Privilege Escalation
====Reference====
* https://attack.mitre.org/wiki/Technique/T1003
* https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html
''version'': 3
</div>
</div>
----
===Dns hijacking===
Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Network_Resolution
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1189/ T1189]
* '''Last Updated''': 2020-02-04
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Detect_hosts_connecting_to_dynamic_domain_providers|Detect hosts connecting to dynamic domain providers]]
* [[Documentation:ESSOC:detections:Detections#Discover_dns_records|Discover DNS records]]
* [[Documentation:ESSOC:detections:Detections#Get_dns_server_history_for_a_host|Get DNS Server History for a host]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1189
| Drive-by Compromise
| Initial Access
|}
====Kill Chain Phase====
* Actions on Objectives
* Command and Control
====Reference====
* https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html
* https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/
* http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/
* https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html
''version'': 1
</div>
</div>
----
===Data exfiltration===
The stealing of data by an adversary.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint, Network_Traffic
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1071.004/ T1071.004], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1095/ T1095], [https://attack.mitre.org/techniques/T1041/ T1041], [https://attack.mitre.org/techniques/T1189/ T1189], [https://attack.mitre.org/techniques/T1537/ T1537], [https://attack.mitre.org/techniques/T1114.001/ T1114.001], [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114.003/ T1114.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
* '''Last Updated''': 2020-10-21
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Dns_exfiltration_using_nslookup_app|DNS Exfiltration Using Nslookup App]]
* [[Documentation:ESSOC:detections:Detections#Detect_snicat_sni_exfiltration|Detect SNICat SNI Exfiltration]]
* [[Documentation:ESSOC:detections:Detections#Detect_shared_ec2_snapshot|Detect shared ec2 snapshot]]
* [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_nslookup_app|Excessive Usage of NSLOOKUP App]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Mailsniper_invoke_functions|Mailsniper Invoke functions]]
* [[Documentation:ESSOC:detections:Detections#Multiple_archive_files_http_post_traffic|Multiple Archive Files Http Post Traffic]]
* [[Documentation:ESSOC:detections:Detections#O365_pst_export_alert|O365 PST export alert]]
* [[Documentation:ESSOC:detections:Detections#O365_suspicious_admin_email_forwarding|O365 Suspicious Admin Email Forwarding]]
* [[Documentation:ESSOC:detections:Detections#O365_suspicious_user_email_forwarding|O365 Suspicious User Email Forwarding]]
* [[Documentation:ESSOC:detections:Detections#Plain_http_post_exfiltrated_data|Plain HTTP POST Exfiltrated Data]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1048
| Exfiltration Over Alternative Protocol
| Exfiltration
|-
| T1071.004
| DNS
| Command And Control
|-
| T1048.003
| Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
| Exfiltration
|-
| T1095
| Non-Application Layer Protocol
| Command And Control
|-
| T1041
| Exfiltration Over C2 Channel
| Exfiltration
|-
| T1189
| Drive-by Compromise
| Initial Access
|-
| T1537
| Transfer Data to Cloud Account
| Exfiltration
|-
| T1114.001
| Local Email Collection
| Collection
|-
| T1114
| Email Collection
| Collection
|-
| T1114.003
| Email Forwarding Rule
| Collection
|-
| T1071.001
| Web Protocols
| Command And Control
|}
====Kill Chain Phase====
* Actions on Objective
* Actions on Objectives
* Exfiltration
* Exploitation
====Reference====
* https://attack.mitre.org/tactics/TA0010/
''version'': 1
</div>
</div>
----
===Deobfuscate-decode files or information===
Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1140/ T1140]
* '''Last Updated''': 2021-03-24
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Certutil_with_decode_argument|CertUtil With Decode Argument]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1140
| Deobfuscate/Decode Files or Information
| Defense Evasion
|}
====Kill Chain Phase====
* Exploitation
====Reference====
* https://attack.mitre.org/techniques/T1140/
''version'': 1
</div>
</div>
----
===Detect zerologon attack===
Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack is attackers can now provide themselves high privileges and take over Domain Controller. The included searches in this Analytic Story are designed to identify attempts to reset Domain Controller Computer Account via exploit code remotely or via the use of tool Mimikatz as payload carrier.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1210/ T1210], [https://attack.mitre.org/techniques/T1003.001/ T1003.001], [https://attack.mitre.org/techniques/T1190/ T1190]
* '''Last Updated''': 2020-09-18
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Detect_computer_changed_with_anonymous_account|Detect Computer Changed with Anonymous Account]]
* [[Documentation:ESSOC:detections:Detections#Detect_credential_dumping_through_lsass_access|Detect Credential Dumping through LSASS access]]
* [[Documentation:ESSOC:detections:Detections#Detect_mimikatz_using_loaded_images|Detect Mimikatz Using Loaded Images]]
* [[Documentation:ESSOC:detections:Detections#Detect_zerologon_via_zeek|Detect Zerologon via Zeek]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1210
| Exploitation of Remote Services
| Lateral Movement
|-
| T1003.001
| LSASS Memory
| Credential Access
|-
| T1190
| Exploit Public-Facing Application
| Initial Access
|}
====Kill Chain Phase====
* Actions on Objectives
* Exploitation
====Reference====
* https://attack.mitre.org/wiki/Technique/T1003
* https://github.com/SecuraBV/CVE-2020-1472
* https://www.secura.com/blog/zero-logon
* https://nvd.nist.gov/vuln/detail/CVE-2020-1472
''version'': 1
</div>
</div>
----
===Disabling security tools===
Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint, Network_Traffic
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1553.004/ T1553.004], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1562.004/ T1562.004], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1112/ T1112]
* '''Last Updated''': 2020-02-04
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Attempt_to_add_certificate_to_untrusted_store|Attempt To Add Certificate To Untrusted Store]]
* [[Documentation:ESSOC:detections:Detections#Attempt_to_stop_security_service|Attempt To Stop Security Service]]
* [[Documentation:ESSOC:detections:Detections#Baseline_of_smb_traffic_-_mltk|Baseline of SMB Traffic - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_command_line_arguments|Previously seen command line arguments]]
* [[Documentation:ESSOC:detections:Detections#Processes_launching_netsh|Processes launching netsh]]
* [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_reg_exe_process|Suspicious Reg exe Process]]
* [[Documentation:ESSOC:detections:Detections#Unload_sysmon_filter_driver|Unload Sysmon Filter Driver]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1553.004
| Install Root Certificate
| Defense Evasion
|-
| T1562.001
| Disable or Modify Tools
| Defense Evasion
|-
| T1562.004
| Disable or Modify System Firewall
| Defense Evasion
|-
| T1543.003
| Windows Service
| Persistence, Privilege Escalation
|-
| T1112
| Modify Registry
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
* Installation
====Reference====
* https://attack.mitre.org/wiki/Technique/T1089
* https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/
* https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf
''version'': 2
</div>
</div>
----
===Domain trust discovery===
Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1018/ T1018]
* '''Last Updated''': 2021-03-25
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Dsquery_domain_discovery|DSQuery Domain Discovery]]
* [[Documentation:ESSOC:detections:Detections#Nltest_domain_trust_discovery|NLTest Domain Trust Discovery]]
* [[Documentation:ESSOC:detections:Detections#Windows_adfind_exe|Windows AdFind Exe]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1482
| Domain Trust Discovery
| Discovery
|-
| T1018
| Remote System Discovery
| Discovery
|}
====Kill Chain Phase====
* Exploitation
====Reference====
* https://attack.mitre.org/techniques/T1482/
''version'': 1
</div>
</div>
----
===F5 tmui rce cve-2020-5902===
Uncover activity consistent with CVE-2020-5902. Discovered by Positive Technologies researchers, this vulnerability affects F5 BIG-IP, BIG-IQ. and Traffix SDC devices (vulnerable versions in F5 support link below). This vulnerability allows unauthenticated users, along with authenticated users, who have access to the configuration utility to execute system commands, create/delete files, disable services, and/or execute Java code. This vulnerability can result in full system compromise.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1190/ T1190]
* '''Last Updated''': 2020-08-02
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Detect_f5_tmui_rce_cve-2020-5902|Detect F5 TMUI RCE CVE-2020-5902]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1190
| Exploit Public-Facing Application
| Initial Access
|}
====Kill Chain Phase====
* Exploitation
====Reference====
* https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/
* https://support.f5.com/csp/article/K52145254
* https://blog.cloudflare.com/cve-2020-5902-helping-to-protect-against-the-f5-tmui-rce-vulnerability/
''version'': 1
</div>
</div>
----
===Hafnium group===
HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVEs in the wild - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint, Network_Traffic
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059.001/ T1059.001], [https://attack.mitre.org/techniques/T1505.003/ T1505.003], [https://attack.mitre.org/techniques/T1136.001/ T1136.001], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1003.001/ T1003.001], [https://attack.mitre.org/techniques/T1114.002/ T1114.002], [https://attack.mitre.org/techniques/T1003.003/ T1003.003], [https://attack.mitre.org/techniques/T1190/ T1190]
* '''Last Updated''': 2021-03-03
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadstring|Any Powershell DownloadString]]
* [[Documentation:ESSOC:detections:Detections#Detect_exchange_web_shell|Detect Exchange Web Shell]]
* [[Documentation:ESSOC:detections:Detections#Detect_new_local_admin_account|Detect New Local Admin account]]
* [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]
* [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]
* [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_comsvcs_dll|Dump LSASS via comsvcs DLL]]
* [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_procdump|Dump LSASS via procdump]]
* [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_procdump_rename|Dump LSASS via procdump Rename]]
* [[Documentation:ESSOC:detections:Detections#Email_servers_sending_high_volume_traffic_to_hosts|Email servers sending high volume traffic to hosts]]
* [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_connect_to_internet_with_hidden_window|Malicious PowerShell Process - Connect To Internet With Hidden Window]]
* [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_execution_policy_bypass|Malicious PowerShell Process - Execution Policy Bypass]]
* [[Documentation:ESSOC:detections:Detections#Nishang_powershelltcponeline|Nishang PowershellTCPOneLine]]
* [[Documentation:ESSOC:detections:Detections#Ntdsutil_export_ntds|Ntdsutil Export NTDS]]
* [[Documentation:ESSOC:detections:Detections#Set_default_powershell_execution_policy_to_unrestricted_or_bypass|Set Default PowerShell Execution Policy To Unrestricted or Bypass]]
* [[Documentation:ESSOC:detections:Detections#Unified_messaging_service_spawning_a_process|Unified Messaging Service Spawning a Process]]
* [[Documentation:ESSOC:detections:Detections#W3wp_spawning_shell|W3WP Spawning Shell]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1059.001
| PowerShell
| Execution
|-
| T1505.003
| Web Shell
| Persistence
|-
| T1136.001
| Local Account
| Persistence
|-
| T1021.002
| SMB/Windows Admin Shares
| Lateral Movement
|-
| T1569.002
| Service Execution
| Execution
|-
| T1003.001
| LSASS Memory
| Credential Access
|-
| T1114.002
| Remote Email Collection
| Collection
|-
| T1003.003
| NTDS
| Credential Access
|-
| T1190
| Exploit Public-Facing Application
| Initial Access
|}
====Kill Chain Phase====
* Actions on Objectives
* Command and Control
* Execution
* Exploitation
* Installation
* Lateral Movement
====Reference====
* https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html
* https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
* https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
* https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/
''version'': 1
</div>
</div>
----
===Ingress tool transfer===
Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059.001/ T1059.001], [https://attack.mitre.org/techniques/T1197/ T1197], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1021/ T1021], [https://attack.mitre.org/techniques/T1113/ T1113], [https://attack.mitre.org/techniques/T1123/ T1123], [https://attack.mitre.org/techniques/T1563/ T1563], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1106/ T1106], [https://attack.mitre.org/techniques/T1569/ T1569], [https://attack.mitre.org/techniques/T1027/ T1027], [https://attack.mitre.org/techniques/T1027.005/ T1027.005], [https://attack.mitre.org/techniques/T1546.015/ T1546.015], [https://attack.mitre.org/techniques/T1140/ T1140], [https://attack.mitre.org/techniques/T1592/ T1592], [https://attack.mitre.org/techniques/T1562/ T1562]
* '''Last Updated''': 2021-03-24
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadfile|Any Powershell DownloadFile]]
* [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadstring|Any Powershell DownloadString]]
* [[Documentation:ESSOC:detections:Detections#Bitsadmin_download_file|BITSAdmin Download File]]
* [[Documentation:ESSOC:detections:Detections#Certutil_download_with_urlcache_and_split_arguments|CertUtil Download With URLCache and Split Arguments]]
* [[Documentation:ESSOC:detections:Detections#Certutil_download_with_verifyctl_and_split_arguments|CertUtil Download With VerifyCtl and Split Arguments]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_curl_network_connection|Suspicious Curl Network Connection]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1059.001
| PowerShell
| Execution
|-
| T1197
| BITS Jobs
| Defense Evasion, Persistence
|-
| T1105
| Ingress Tool Transfer
| Command And Control
|-
| T1003
| OS Credential Dumping
| Credential Access
|-
| T1021
| Remote Services
| Lateral Movement
|-
| T1113
| Screen Capture
| Collection
|-
| T1123
| Audio Capture
| Collection
|-
| T1563
| Remote Service Session Hijacking
| Lateral Movement
|-
| T1053
| Scheduled Task/Job
| Execution, Persistence, Privilege Escalation
|-
| T1134
| Access Token Manipulation
| Defense Evasion, Privilege Escalation
|-
| T1548
| Abuse Elevation Control Mechanism
| Privilege Escalation, Defense Evasion
|-
| T1055
| Process Injection
| Defense Evasion, Privilege Escalation
|-
| T1106
| Native API
| Execution
|-
| T1569
| System Services
| Execution
|-
| T1027
| Obfuscated Files or Information
| Defense Evasion
|-
| T1027.005
| Indicator Removal from Tools
| Defense Evasion
|-
| T1546.015
| Component Object Model Hijacking
| Privilege Escalation, Persistence
|-
| T1140
| Deobfuscate/Decode Files or Information
| Defense Evasion
|-
| T1592
| Gather Victim Host Information
| Reconnaissance
|-
| T1562
| Impair Defenses
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
* Exploitation
====Reference====
* https://attack.mitre.org/techniques/T1105/
''version'': 1
</div>
</div>
----
===Lateral movement===
Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Authentication, Email, Endpoint, Network_Traffic
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1550.002/ T1550.002], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1558.003/ T1558.003], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1053.005/ T1053.005]
* '''Last Updated''': 2020-02-04
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Detect_activity_related_to_pass_the_hash_attacks|Detect Activity Related to Pass the Hash Attacks]]
* [[Documentation:ESSOC:detections:Detections#Detect_pass_the_hash|Detect Pass the Hash]]
* [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]
* [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]
* [[Documentation:ESSOC:detections:Detections#Get_history_of_email_sources|Get History Of Email Sources]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
* [[Documentation:ESSOC:detections:Detections#Investigate_successful_remote_desktop_authentications|Investigate Successful Remote Desktop Authentications]]
* [[Documentation:ESSOC:detections:Detections#Kerberoasting_spn_request_with_rc4_encryption|Kerberoasting spn request with RC4 encryption]]
* [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_traffic|Remote Desktop Network Traffic]]
* [[Documentation:ESSOC:detections:Detections#Remote_desktop_process_running_on_system|Remote Desktop Process Running On System]]
* [[Documentation:ESSOC:detections:Detections#Schtasks_scheduling_job_on_remote_system|Schtasks scheduling job on remote system]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1550.002
| Pass the Hash
| Defense Evasion, Lateral Movement
|-
| T1021.002
| SMB/Windows Admin Shares
| Lateral Movement
|-
| T1569.002
| Service Execution
| Execution
|-
| T1558.003
| Kerberoasting
| Credential Access
|-
| T1021.001
| Remote Desktop Protocol
| Lateral Movement
|-
| T1053.005
| Scheduled Task
| Execution, Persistence, Privilege Escalation
|}
====Kill Chain Phase====
* Actions on Objectives
* Execution
* Exploitation
* Lateral Movement
====Reference====
* https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html
''version'': 2
</div>
</div>
----
===Malicious powershell===
Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Email, Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059.001/ T1059.001], [https://attack.mitre.org/techniques/T1197/ T1197], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1021/ T1021], [https://attack.mitre.org/techniques/T1113/ T1113], [https://attack.mitre.org/techniques/T1123/ T1123], [https://attack.mitre.org/techniques/T1563/ T1563], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1106/ T1106], [https://attack.mitre.org/techniques/T1569/ T1569], [https://attack.mitre.org/techniques/T1027/ T1027], [https://attack.mitre.org/techniques/T1027.005/ T1027.005], [https://attack.mitre.org/techniques/T1546.015/ T1546.015], [https://attack.mitre.org/techniques/T1140/ T1140], [https://attack.mitre.org/techniques/T1592/ T1592], [https://attack.mitre.org/techniques/T1562/ T1562]
* '''Last Updated''': 2017-08-23
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadfile|Any Powershell DownloadFile]]
* [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadstring|Any Powershell DownloadString]]
* [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules|Credential Extraction indicative of use of DSInternals credential conversion modules]]
* [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_use_of_dsinternals_modules|Credential Extraction indicative of use of DSInternals modules]]
* [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_use_of_powersploit_modules|Credential Extraction indicative of use of PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals|Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals]]
* [[Documentation:ESSOC:detections:Detections#Detect_empire_with_powershell_script_block_logging|Detect Empire with PowerShell Script Block Logging]]
* [[Documentation:ESSOC:detections:Detections#Detect_mimikatz_with_powershell_script_block_logging|Detect Mimikatz With PowerShell Script Block Logging]]
* [[Documentation:ESSOC:detections:Detections#Get_history_of_email_sources|Get History Of Email Sources]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Illegal_access_to_user_content_via_powersploit_modules|Illegal Access To User Content via PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Illegal_privilege_elevation_and_persistence_via_powersploit_modules|Illegal Privilege Elevation and Persistence via PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Illegal_service_and_process_control_via_powersploit_modules|Illegal Service and Process Control via PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_connect_to_internet_with_hidden_window|Malicious PowerShell Process - Connect To Internet With Hidden Window]]
* [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_encoded_command|Malicious PowerShell Process - Encoded Command]]
* [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_with_obfuscation_techniques|Malicious PowerShell Process With Obfuscation Techniques]]
* [[Documentation:ESSOC:detections:Detections#Powershell_4104_hunting|PowerShell 4104 Hunting]]
* [[Documentation:ESSOC:detections:Detections#Powershell_domain_enumeration|PowerShell Domain Enumeration]]
* [[Documentation:ESSOC:detections:Detections#Powershell_loading_dotnet_into_memory_via_system_reflection_assembly|PowerShell Loading DotNET into Memory via System Reflection Assembly]]
* [[Documentation:ESSOC:detections:Detections#Powershell_creating_thread_mutex|Powershell Creating Thread Mutex]]
* [[Documentation:ESSOC:detections:Detections#Powershell_enable_smb1protocol_feature|Powershell Enable SMB1Protocol Feature]]
* [[Documentation:ESSOC:detections:Detections#Powershell_execute_com_object|Powershell Execute COM Object]]
* [[Documentation:ESSOC:detections:Detections#Powershell_fileless_process_injection_via_getprocaddress|Powershell Fileless Process Injection via GetProcAddress]]
* [[Documentation:ESSOC:detections:Detections#Powershell_fileless_script_contains_base64_encoded_content|Powershell Fileless Script Contains Base64 Encoded Content]]
* [[Documentation:ESSOC:detections:Detections#Powershell_processing_stream_of_data|Powershell Processing Stream Of Data]]
* [[Documentation:ESSOC:detections:Detections#Powershell_using_memory_as_backing_store|Powershell Using memory As Backing Store]]
* [[Documentation:ESSOC:detections:Detections#Recon_avproduct_through_pwh_or_wmi|Recon AVProduct Through Pwh or WMI]]
* [[Documentation:ESSOC:detections:Detections#Recon_using_wmi_class|Recon Using WMI Class]]
* [[Documentation:ESSOC:detections:Detections#Set_default_powershell_execution_policy_to_unrestricted_or_bypass|Set Default PowerShell Execution Policy To Unrestricted or Bypass]]
* [[Documentation:ESSOC:detections:Detections#Unloading_amsi_via_reflection|Unloading AMSI via Reflection]]
* [[Documentation:ESSOC:detections:Detections#Wmi_recon_running_process_or_services|WMI Recon Running Process Or Services]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1059.001
| PowerShell
| Execution
|-
| T1197
| BITS Jobs
| Defense Evasion, Persistence
|-
| T1105
| Ingress Tool Transfer
| Command And Control
|-
| T1003
| OS Credential Dumping
| Credential Access
|-
| T1021
| Remote Services
| Lateral Movement
|-
| T1113
| Screen Capture
| Collection
|-
| T1123
| Audio Capture
| Collection
|-
| T1563
| Remote Service Session Hijacking
| Lateral Movement
|-
| T1053
| Scheduled Task/Job
| Execution, Persistence, Privilege Escalation
|-
| T1134
| Access Token Manipulation
| Defense Evasion, Privilege Escalation
|-
| T1548
| Abuse Elevation Control Mechanism
| Privilege Escalation, Defense Evasion
|-
| T1055
| Process Injection
| Defense Evasion, Privilege Escalation
|-
| T1106
| Native API
| Execution
|-
| T1569
| System Services
| Execution
|-
| T1027
| Obfuscated Files or Information
| Defense Evasion
|-
| T1027.005
| Indicator Removal from Tools
| Defense Evasion
|-
| T1546.015
| Component Object Model Hijacking
| Privilege Escalation, Persistence
|-
| T1140
| Deobfuscate/Decode Files or Information
| Defense Evasion
|-
| T1592
| Gather Victim Host Information
| Reconnaissance
|-
| T1562
| Impair Defenses
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
* Command and Control
* Exploitation
* Installation
* Privilege Escalation
* Reconnaissance
====Reference====
* https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/
* https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
''version'': 5
</div>
</div>
----
===Masquerading - rename system utilities===
Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1127.001/ T1127.001], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1127/ T1127], [https://attack.mitre.org/techniques/T1036/ T1036]
* '''Last Updated''': 2021-04-26
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Execution_of_file_with_multiple_extensions|Execution of File with Multiple Extensions]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_rename|Suspicious MSBuild Rename]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_rename|Suspicious Rundll32 Rename]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_microsoft_workflow_compiler_rename|Suspicious microsoft workflow compiler rename]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_path|Suspicious msbuild path]]
* [[Documentation:ESSOC:detections:Detections#System_process_running_from_unexpected_location|System Process Running from Unexpected Location]]
* [[Documentation:ESSOC:detections:Detections#System_processes_run_from_unexpected_locations|System Processes Run From Unexpected Locations]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1036.003
| Rename System Utilities
| Defense Evasion
|-
| T1127.001
| MSBuild
| Defense Evasion
|-
| T1218.011
| Rundll32
| Defense Evasion
|-
| T1127
| Trusted Developer Utilities Proxy Execution
| Defense Evasion
|-
| T1036
| Masquerading
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
* Exploitation
====Reference====
* https://attack.mitre.org/techniques/T1036/003/
''version'': 1
</div>
</div>
----
===Meterpreter===
Meterpreter provides red teams, pen testers and threat actors interactive access to a compromised host to run commands, upload payloads, download files, and other actions.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1033/ T1033]
* '''Last Updated''': 2021-06-08
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Excessive_number_of_taskhost_processes|Excessive number of taskhost processes]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1033
| System Owner/User Discovery
| Discovery
|}
====Kill Chain Phase====
* Exploitation
====Reference====
* https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/
* https://doubleoctopus.com/security-wiki/threats-and-tools/meterpreter/
* https://www.rapid7.com/products/metasploit/
''version'': 1
</div>
</div>
----
===Nobelium group===
Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint, Network_Traffic, Web
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560.001/ T1560.001], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1071.002/ T1071.002], [https://attack.mitre.org/techniques/T1218.010/ T1218.010], [https://attack.mitre.org/techniques/T1218.005/ T1218.005], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1027/ T1027], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1203/ T1203], [https://attack.mitre.org/techniques/T1505.003/ T1505.003], [https://attack.mitre.org/techniques/T1127.001/ T1127.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1127/ T1127], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1018/ T1018]
* '''Last Updated''': 2020-12-14
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Anomalous_usage_of_7zip|Anomalous usage of 7zip]]
* [[Documentation:ESSOC:detections:Detections#Detect_outbound_smb_traffic|Detect Outbound SMB Traffic]]
* [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]
* [[Documentation:ESSOC:detections:Detections#Detect_rundll32_inline_hta_execution|Detect Rundll32 Inline HTA Execution]]
* [[Documentation:ESSOC:detections:Detections#First_time_seen_running_windows_service|First Time Seen Running Windows Service]]
* [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_encoded_command|Malicious PowerShell Process - Encoded Command]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_running_windows_services_-_initial|Previously Seen Running Windows Services - Initial]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_running_windows_services_-_update|Previously Seen Running Windows Services - Update]]
* [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]
* [[Documentation:ESSOC:detections:Detections#Scheduled_task_deleted_or_created_via_cmd|Scheduled Task Deleted Or Created via CMD]]
* [[Documentation:ESSOC:detections:Detections#Schtasks_scheduling_job_on_remote_system|Schtasks scheduling job on remote system]]
* [[Documentation:ESSOC:detections:Detections#Sunburst_correlation_dll_and_network_event|Sunburst Correlation DLL and Network Event]]
* [[Documentation:ESSOC:detections:Detections#Supernova_webshell|Supernova Webshell]]
* [[Documentation:ESSOC:detections:Detections#Tor_traffic|TOR Traffic]]
* [[Documentation:ESSOC:detections:Detections#Windows_adfind_exe|Windows AdFind Exe]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1560.001
| Archive via Utility
| Collection
|-
| T1059.003
| Windows Command Shell
| Execution
|-
| T1543.003
| Windows Service
| Persistence, Privilege Escalation
|-
| T1055
| Process Injection
| Defense Evasion, Privilege Escalation
|-
| T1071.002
| File Transfer Protocols
| Command And Control
|-
| T1218.010
| Regsvr32
| Defense Evasion
|-
| T1218.005
| Mshta
| Defense Evasion
|-
| T1569.002
| Service Execution
| Execution
|-
| T1027
| Obfuscated Files or Information
| Defense Evasion
|-
| T1218.011
| Rundll32
| Defense Evasion
|-
| T1053.005
| Scheduled Task
| Execution, Persistence, Privilege Escalation
|-
| T1548
| Abuse Elevation Control Mechanism
| Privilege Escalation, Defense Evasion
|-
| T1203
| Exploitation for Client Execution
| Execution
|-
| T1505.003
| Web Shell
| Persistence
|-
| T1127.001
| MSBuild
| Defense Evasion
|-
| T1036.003
| Rename System Utilities
| Defense Evasion
|-
| T1127
| Trusted Developer Utilities Proxy Execution
| Defense Evasion
|-
| T1071.001
| Web Protocols
| Command And Control
|-
| T1018
| Remote System Discovery
| Discovery
|}
====Kill Chain Phase====
* Actions on Objective
* Actions on Objectives
* Command and Control
* Exfiltration
* Exploitation
* Installation
====Reference====
* https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
* https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
* https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
''version'': 2
</div>
</div>
----
===Possible backdoor activity associated with mudcarp espionage campaigns===
Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Email, Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059.001/ T1059.001], [https://attack.mitre.org/techniques/T1547.001/ T1547.001]
* '''Last Updated''': 2020-01-22
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Baseline_of_command_line_length_-_mltk|Baseline of Command Line Length - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Get_history_of_email_sources|Get History Of Email Sources]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_connect_to_internet_with_hidden_window|Malicious PowerShell Process - Connect To Internet With Hidden Window]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_command_line_arguments|Previously seen command line arguments]]
* [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
* [[Documentation:ESSOC:detections:Detections#Unusually_long_command_line|Unusually Long Command Line]]
* [[Documentation:ESSOC:detections:Detections#Unusually_long_command_line_-_mltk|Unusually Long Command Line - MLTK]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1059.001
| PowerShell
| Execution
|-
| T1547.001
| Registry Run Keys / Startup Folder
| Persistence, Privilege Escalation
|}
====Kill Chain Phase====
* Actions on Objectives
* Command and Control
====Reference====
* https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/
* http://blog.amossys.fr/badflick-is-not-so-bad.html
''version'': 1
</div>
</div>
----
===Sql injection===
Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Web
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1190/ T1190]
* '''Last Updated''': 2017-09-19
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Sql_injection_with_long_urls|SQL Injection with Long URLs]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1190
| Exploit Public-Facing Application
| Initial Access
|}
====Kill Chain Phase====
* Delivery
====Reference====
* https://capec.mitre.org/data/definitions/66.html
* https://www.incapsula.com/web-application-security/sql-injection.html
''version'': 1
</div>
</div>
----
===Silver sparrow===
Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking MacOS (Intel and M1) malicious software downloader utilizing JavaScript for execution and a launchAgent to establish persistence.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1543.001/ T1543.001], [https://attack.mitre.org/techniques/T1074/ T1074]
* '''Last Updated''': 2021-02-24
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Suspicious_curl_network_connection|Suspicious Curl Network Connection]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_plistbuddy_usage|Suspicious PlistBuddy Usage]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_plistbuddy_usage_via_osquery|Suspicious PlistBuddy Usage via OSquery]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_sqlite3_lsquarantine_behavior|Suspicious SQLite3 LSQuarantine Behavior]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1105
| Ingress Tool Transfer
| Command And Control
|-
| T1543.001
| Launch Agent
| Persistence, Privilege Escalation
|-
| T1074
| Data Staged
| Collection
|}
====Kill Chain Phase====
* Actions on Objectives
====Reference====
* https://redcanary.com/blog/clipping-silver-sparrows-wings/
* https://www.sentinelone.com/blog/5-things-you-need-to-know-about-silver-sparrow/
''version'': 1
</div>
</div>
----
===Spearphishing attachments===
Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566.001/ T1566.001], [https://attack.mitre.org/techniques/T1003.002/ T1003.002], [https://attack.mitre.org/techniques/T1566.002/ T1566.002]
* '''Last Updated''': 2019-04-29
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Detect_outlook_exe_writing_a_zip_file|Detect Outlook exe writing a zip file]]
* [[Documentation:ESSOC:detections:Detections#Excel_spawning_powershell|Excel Spawning PowerShell]]
* [[Documentation:ESSOC:detections:Detections#Excel_spawning_windows_script_host|Excel Spawning Windows Script Host]]
* [[Documentation:ESSOC:detections:Detections#Office_application_spawn_rundll32_process|Office Application Spawn rundll32 process]]
* [[Documentation:ESSOC:detections:Detections#Office_document_creating_schedule_task|Office Document Creating Schedule Task]]
* [[Documentation:ESSOC:detections:Detections#Office_document_executing_macro_code|Office Document Executing Macro Code]]
* [[Documentation:ESSOC:detections:Detections#Office_document_spawned_child_process_to_download|Office Document Spawned Child Process To Download]]
* [[Documentation:ESSOC:detections:Detections#Office_product_spawning_bitsadmin|Office Product Spawning BITSAdmin]]
* [[Documentation:ESSOC:detections:Detections#Office_product_spawning_certutil|Office Product Spawning CertUtil]]
* [[Documentation:ESSOC:detections:Detections#Office_product_spawning_mshta|Office Product Spawning MSHTA]]
* [[Documentation:ESSOC:detections:Detections#Office_product_spawning_rundll32_with_no_dll|Office Product Spawning Rundll32 with no DLL]]
* [[Documentation:ESSOC:detections:Detections#Office_product_spawning_wmic|Office Product Spawning Wmic]]
* [[Documentation:ESSOC:detections:Detections#Process_creating_lnk_file_in_suspicious_location|Process Creating LNK file in Suspicious Location]]
* [[Documentation:ESSOC:detections:Detections#Winword_spawning_cmd|Winword Spawning Cmd]]
* [[Documentation:ESSOC:detections:Detections#Winword_spawning_powershell|Winword Spawning PowerShell]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1566.001
| Spearphishing Attachment
| Initial Access
|-
| T1003.002
| Security Account Manager
| Credential Access
|-
| T1566.002
| Spearphishing Link
| Initial Access
|}
====Kill Chain Phase====
* Actions on Objectives
* Exploitation
* Installation
====Reference====
* https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html
''version'': 1
</div>
</div>
----
===Suspicious command-line executions===
Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1036.003/ T1036.003]
* '''Last Updated''': 2020-02-03
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Baseline_of_command_line_length_-_mltk|Baseline of Command Line Length - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]
* [[Documentation:ESSOC:detections:Detections#Detect_use_of_cmd_exe_to_launch_script_interpreters|Detect Use of cmd exe to Launch Script Interpreters]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_command_line_arguments|Previously seen command line arguments]]
* [[Documentation:ESSOC:detections:Detections#System_processes_run_from_unexpected_locations|System Processes Run From Unexpected Locations]]
* [[Documentation:ESSOC:detections:Detections#Unusually_long_command_line|Unusually Long Command Line]]
* [[Documentation:ESSOC:detections:Detections#Unusually_long_command_line_-_mltk|Unusually Long Command Line - MLTK]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1059.003
| Windows Command Shell
| Execution
|-
| T1059
| Command and Scripting Interpreter
| Execution
|-
| T1068
| Exploitation for Privilege Escalation
| Privilege Escalation
|-
| T1036.003
| Rename System Utilities
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
* Exploitation
====Reference====
* https://attack.mitre.org/wiki/Technique/T1059
* https://www.microsoft.com/en-us/wdsi/threats/macro-malware
* https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
''version'': 2
</div>
</div>
----
===Suspicious compiled html activity===
Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218.001/ T1218.001]
* '''Last Updated''': 2021-02-11
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Detect_html_help_renamed|Detect HTML Help Renamed]]
* [[Documentation:ESSOC:detections:Detections#Detect_html_help_spawn_child_process|Detect HTML Help Spawn Child Process]]
* [[Documentation:ESSOC:detections:Detections#Detect_html_help_url_in_command_line|Detect HTML Help URL in Command Line]]
* [[Documentation:ESSOC:detections:Detections#Detect_html_help_using_infotech_storage_handlers|Detect HTML Help Using InfoTech Storage Handlers]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1218.001
| Compiled HTML File
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
====Reference====
* https://redcanary.com/blog/introducing-atomictestharnesses/
* https://attack.mitre.org/techniques/T1218/001/
* https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa
''version'': 1
</div>
</div>
----
===Suspicious dns traffic===
Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint, Network_Resolution, Network_Traffic
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1071.004/ T1071.004], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1095/ T1095], [https://attack.mitre.org/techniques/T1041/ T1041], [https://attack.mitre.org/techniques/T1189/ T1189], [https://attack.mitre.org/techniques/T1537/ T1537], [https://attack.mitre.org/techniques/T1114.001/ T1114.001], [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114.003/ T1114.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
* '''Last Updated''': 2017-09-18
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Baseline_of_dns_query_length_-_mltk|Baseline of DNS Query Length - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Dns_exfiltration_using_nslookup_app|DNS Exfiltration Using Nslookup App]]
* [[Documentation:ESSOC:detections:Detections#Dns_query_length_outliers_-_mltk|DNS Query Length Outliers - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Dns_query_length_with_high_standard_deviation|DNS Query Length With High Standard Deviation]]
* [[Documentation:ESSOC:detections:Detections#Detect_hosts_connecting_to_dynamic_domain_providers|Detect hosts connecting to dynamic domain providers]]
* [[Documentation:ESSOC:detections:Detections#Excessive_dns_failures|Excessive DNS Failures]]
* [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_nslookup_app|Excessive Usage of NSLOOKUP App]]
* [[Documentation:ESSOC:detections:Detections#Get_dns_server_history_for_a_host|Get DNS Server History for a host]]
* [[Documentation:ESSOC:detections:Detections#Get_dns_traffic_ratio|Get DNS traffic ratio]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_responsible_for_the_dns_traffic|Get Process Responsible For The DNS Traffic]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1048
| Exfiltration Over Alternative Protocol
| Exfiltration
|-
| T1071.004
| DNS
| Command And Control
|-
| T1048.003
| Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
| Exfiltration
|-
| T1095
| Non-Application Layer Protocol
| Command And Control
|-
| T1041
| Exfiltration Over C2 Channel
| Exfiltration
|-
| T1189
| Drive-by Compromise
| Initial Access
|-
| T1537
| Transfer Data to Cloud Account
| Exfiltration
|-
| T1114.001
| Local Email Collection
| Collection
|-
| T1114
| Email Collection
| Collection
|-
| T1114.003
| Email Forwarding Rule
| Collection
|-
| T1071.001
| Web Protocols
| Command And Control
|}
====Kill Chain Phase====
* Actions on Objectives
* Command and Control
* Exploitation
====Reference====
* http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/
* http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680
* https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454
''version'': 1
</div>
</div>
----
===Suspicious emails===
Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Email
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
* '''Last Updated''': 2020-01-27
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Dnstwist_domain_names|DNSTwist Domain Names]]
* [[Documentation:ESSOC:detections:Detections#Email_attachments_with_lots_of_spaces|Email Attachments With Lots Of Spaces]]
* [[Documentation:ESSOC:detections:Detections#Get_email_info|Get Email Info]]
* [[Documentation:ESSOC:detections:Detections#Get_emails_from_specific_sender|Get Emails From Specific Sender]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Monitor_email_for_brand_abuse|Monitor Email For Brand Abuse]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_email_attachment_extensions|Suspicious Email Attachment Extensions]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1566.001
| Spearphishing Attachment
| Initial Access
|}
====Kill Chain Phase====
* Delivery
====Reference====
* https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/
''version'': 1
</div>
</div>
----
===Suspicious mshta activity===
Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218.005/ T1218.005], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1547.001/ T1547.001]
* '''Last Updated''': 2021-01-20
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Baseline_of_command_line_length_-_mltk|Baseline of Command Line Length - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Detect_mshta_url_in_command_line|Detect MSHTA Url in Command Line]]
* [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]
* [[Documentation:ESSOC:detections:Detections#Detect_rundll32_inline_hta_execution|Detect Rundll32 Inline HTA Execution]]
* [[Documentation:ESSOC:detections:Detections#Detect_mshta_inline_hta_execution|Detect mshta inline hta execution]]
* [[Documentation:ESSOC:detections:Detections#Detect_mshta_renamed|Detect mshta renamed]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_command_line_arguments|Previously seen command line arguments]]
* [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_mshta_child_process|Suspicious mshta child process]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_mshta_spawn|Suspicious mshta spawn]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1218.005
| Mshta
| Defense Evasion
|-
| T1059.003
| Windows Command Shell
| Execution
|-
| T1059
| Command and Scripting Interpreter
| Execution
|-
| T1547.001
| Registry Run Keys / Startup Folder
| Persistence, Privilege Escalation
|}
====Kill Chain Phase====
* Actions on Objectives
* Exploitation
====Reference====
* https://redcanary.com/blog/introducing-atomictestharnesses/
* https://redcanary.com/blog/windows-registry-attacks-threat-detection/
* https://attack.mitre.org/techniques/T1218/005/
* https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5
''version'': 2
</div>
</div>
----
===Suspicious okta activity===
Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.001/ T1078.001]
* '''Last Updated''': 2020-04-02
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Investigate_okta_activity_by_ip_address|Investigate Okta Activity by IP Address]]
* [[Documentation:ESSOC:detections:Detections#Investigate_okta_activity_by_app|Investigate Okta Activity by app]]
* [[Documentation:ESSOC:detections:Detections#Investigate_user_activities_in_okta|Investigate User Activities In Okta]]
* [[Documentation:ESSOC:detections:Detections#Multiple_okta_users_with_invalid_credentials_from_the_same_ip|Multiple Okta Users With Invalid Credentials From The Same IP]]
* [[Documentation:ESSOC:detections:Detections#Okta_account_lockout_events|Okta Account Lockout Events]]
* [[Documentation:ESSOC:detections:Detections#Okta_failed_sso_attempts|Okta Failed SSO Attempts]]
* [[Documentation:ESSOC:detections:Detections#Okta_user_logins_from_multiple_cities|Okta User Logins From Multiple Cities]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1078.001
| Default Accounts
| Defense Evasion, Persistence, Privilege Escalation, Initial Access
|}
====Kill Chain Phase====
====Reference====
* https://attack.mitre.org/wiki/Technique/T1078
* https://owasp.org/www-community/attacks/Credential_stuffing
* https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work
''version'': 1
</div>
</div>
----
===Suspicious regsvcs regasm activity===
Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218.009/ T1218.009]
* '''Last Updated''': 2021-02-11
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Detect_regasm_spawning_a_process|Detect Regasm Spawning a Process]]
* [[Documentation:ESSOC:detections:Detections#Detect_regasm_with_network_connection|Detect Regasm with Network Connection]]
* [[Documentation:ESSOC:detections:Detections#Detect_regasm_with_no_command_line_arguments|Detect Regasm with no Command Line Arguments]]
* [[Documentation:ESSOC:detections:Detections#Detect_regsvcs_spawning_a_process|Detect Regsvcs Spawning a Process]]
* [[Documentation:ESSOC:detections:Detections#Detect_regsvcs_with_network_connection|Detect Regsvcs with Network Connection]]
* [[Documentation:ESSOC:detections:Detections#Detect_regsvcs_with_no_command_line_arguments|Detect Regsvcs with No Command Line Arguments]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1218.009
| Regsvcs/Regasm
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
====Reference====
* https://attack.mitre.org/techniques/T1218/009/
* https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/evasion/windows/applocker_evasion_regasm_regsvcs.md
* https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
''version'': 1
</div>
</div>
----
===Suspicious regsvr32 activity===
Monitor and detect techniques used by attackers who leverage the regsvr32.exe process to execute malicious code.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218.010/ T1218.010]
* '''Last Updated''': 2021-01-29
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Detect_regsvr32_application_control_bypass|Detect Regsvr32 Application Control Bypass]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_regsvr32_register_suspicious_path|Suspicious Regsvr32 Register Suspicious Path]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1218.010
| Regsvr32
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
====Reference====
* https://attack.mitre.org/techniques/T1218/010/
* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md
* https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
''version'': 1
</div>
</div>
----
===Suspicious rundll32 activity===
Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1003.001/ T1003.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003]
* '''Last Updated''': 2021-02-03
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Detect_rundll32_application_control_bypass_-_advpack|Detect Rundll32 Application Control Bypass - advpack]]
* [[Documentation:ESSOC:detections:Detections#Detect_rundll32_application_control_bypass_-_setupapi|Detect Rundll32 Application Control Bypass - setupapi]]
* [[Documentation:ESSOC:detections:Detections#Detect_rundll32_application_control_bypass_-_syssetup|Detect Rundll32 Application Control Bypass - syssetup]]
* [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_comsvcs_dll|Dump LSASS via comsvcs DLL]]
* [[Documentation:ESSOC:detections:Detections#Rundll32_with_no_command_line_arguments_with_network|Rundll32 with no Command Line Arguments with Network]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_rename|Suspicious Rundll32 Rename]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_startw|Suspicious Rundll32 StartW]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_dllregisterserver|Suspicious Rundll32 dllregisterserver]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_no_command_line_arguments|Suspicious Rundll32 no Command Line Arguments]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1218.011
| Rundll32
| Defense Evasion
|-
| T1003.001
| LSASS Memory
| Credential Access
|-
| T1036.003
| Rename System Utilities
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
* Exploitation
====Reference====
* https://attack.mitre.org/techniques/T1218/011/
* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
* https://lolbas-project.github.io/lolbas/Binaries/Rundll32
''version'': 1
</div>
</div>
----
===Suspicious wmi use===
Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1546.003/ T1546.003], [https://attack.mitre.org/techniques/T1047/ T1047]
* '''Last Updated''': 2018-10-23
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Detect_wmi_event_subscription_persistence|Detect WMI Event Subscription Persistence]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_sysmon_wmi_activity_for_host|Get Sysmon WMI Activity for Host]]
* [[Documentation:ESSOC:detections:Detections#Process_execution_via_wmi|Process Execution via WMI]]
* [[Documentation:ESSOC:detections:Detections#Remote_process_instantiation_via_wmi|Remote Process Instantiation via WMI]]
* [[Documentation:ESSOC:detections:Detections#Remote_wmi_command_attempt|Remote WMI Command Attempt]]
* [[Documentation:ESSOC:detections:Detections#Script_execution_via_wmi|Script Execution via WMI]]
* [[Documentation:ESSOC:detections:Detections#Wmi_permanent_event_subscription|WMI Permanent Event Subscription]]
* [[Documentation:ESSOC:detections:Detections#Wmi_permanent_event_subscription_-_sysmon|WMI Permanent Event Subscription - Sysmon]]
* [[Documentation:ESSOC:detections:Detections#Wmi_temporary_event_subscription|WMI Temporary Event Subscription]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1546.003
| Windows Management Instrumentation Event Subscription
| Privilege Escalation, Persistence
|-
| T1047
| Windows Management Instrumentation
| Execution
|}
====Kill Chain Phase====
* Actions on Objectives
* Exploitation
====Reference====
* https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf
* https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html
''version'': 2
</div>
</div>
----
===Suspicious windows registry activities===
Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548.002/ T1548.002], [https://attack.mitre.org/techniques/T1547.010/ T1547.010], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1546.012/ T1546.012], [https://attack.mitre.org/techniques/T1546.011/ T1546.011]
* '''Last Updated''': 2018-05-31
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Disabling_remote_user_account_control|Disabling Remote User Account Control]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Monitor_registry_keys_for_print_monitors|Monitor Registry Keys for Print Monitors]]
* [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
* [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_privilege_escalation|Registry Keys Used For Privilege Escalation]]
* [[Documentation:ESSOC:detections:Detections#Registry_keys_for_creating_shim_databases|Registry Keys for Creating SHIM Databases]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1548.002
| Bypass User Account Control
| Privilege Escalation, Defense Evasion
|-
| T1547.010
| Port Monitors
| Persistence, Privilege Escalation
|-
| T1547.001
| Registry Run Keys / Startup Folder
| Persistence, Privilege Escalation
|-
| T1546.012
| Image File Execution Options Injection
| Privilege Escalation, Persistence
|-
| T1546.011
| Application Shimming
| Privilege Escalation, Persistence
|}
====Kill Chain Phase====
* Actions on Objectives
====Reference====
* https://redcanary.com/blog/windows-registry-attacks-threat-detection/
* https://attack.mitre.org/wiki/Technique/T1112
''version'': 1
</div>
</div>
----
===Suspicious zoom child processes===
Attackers are using Zoom as an vector to increase privileges on a sytems. This story detects new child processes of zoom and provides investigative actions for this detection.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1036.003/ T1036.003]
* '''Last Updated''': 2020-04-13
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]
* [[Documentation:ESSOC:detections:Detections#First_time_seen_child_process_of_zoom|First Time Seen Child Process of Zoom]]
* [[Documentation:ESSOC:detections:Detections#Get_process_file_activity|Get Process File Activity]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_zoom_child_processes_-_initial|Previously Seen Zoom Child Processes - Initial]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_zoom_child_processes_-_update|Previously Seen Zoom Child Processes - Update]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1059.003
| Windows Command Shell
| Execution
|-
| T1059
| Command and Scripting Interpreter
| Execution
|-
| T1068
| Exploitation for Privilege Escalation
| Privilege Escalation
|-
| T1036.003
| Rename System Utilities
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
* Exploitation
====Reference====
* https://blog.rapid7.com/2020/04/02/dispelling-zoom-bugbears-what-you-need-to-know-about-the-latest-zoom-vulnerabilities/
* https://threatpost.com/two-zoom-zero-day-flaws-uncovered/154337/
''version'': 1
</div>
</div>
----
===Trusted developer utilities proxy execution===
Monitor and detect behaviors used by attackers who leverage trusted developer utilities to execute malicious code.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1127/ T1127], [https://attack.mitre.org/techniques/T1036.003/ T1036.003]
* '''Last Updated''': 2021-01-12
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Suspicious_microsoft_workflow_compiler_rename|Suspicious microsoft workflow compiler rename]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_microsoft_workflow_compiler_usage|Suspicious microsoft workflow compiler usage]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1127
| Trusted Developer Utilities Proxy Execution
| Defense Evasion
|-
| T1036.003
| Rename System Utilities
| Defense Evasion
|}
====Kill Chain Phase====
* Exploitation
====Reference====
* https://attack.mitre.org/techniques/T1127/
* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md
* https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/
''version'': 1
</div>
</div>
----
===Trusted developer utilities proxy execution msbuild===
Monitor and detect techniques used by attackers who leverage the msbuild.exe process to execute malicious code.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1127.001/ T1127.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003]
* '''Last Updated''': 2021-01-21
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_rename|Suspicious MSBuild Rename]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_spawn|Suspicious MSBuild Spawn]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_path|Suspicious msbuild path]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1127.001
| MSBuild
| Defense Evasion
|-
| T1036.003
| Rename System Utilities
| Defense Evasion
|}
====Kill Chain Phase====
* Exploitation
====Reference====
* https://attack.mitre.org/techniques/T1127/001/
* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
* https://github.com/infosecn1nja/MaliciousMacroMSBuild
* https://github.com/xorrior/RandomPS-Scripts/blob/master/Invoke-ExecuteMSBuild.ps1
* https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
* https://github.com/MHaggis/CBR-Queries/blob/master/msbuild.md
''version'': 1
</div>
</div>
----
===Windows dns sigred cve-2020-1350===
Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). An attacker can use the malicious payload to cause a buffer overflow on the vulnerable system, leading to compromise. The included searches in this Analytic Story are designed to identify the large response payload for SIG and KEY DNS records which can be used for the exploit.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Network_Resolution
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1203/ T1203]
* '''Last Updated''': 2020-07-28
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Detect_windows_dns_sigred_via_splunk_stream|Detect Windows DNS SIGRed via Splunk Stream]]
* [[Documentation:ESSOC:detections:Detections#Detect_windows_dns_sigred_via_zeek|Detect Windows DNS SIGRed via Zeek]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1203
| Exploitation for Client Execution
| Execution
|}
====Kill Chain Phase====
* Exploitation
====Reference====
* https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
* https://support.microsoft.com/en-au/help/4569509/windows-dns-server-remote-code-execution-vulnerability
''version'': 1
</div>
</div>
----
===Windows defense evasion tactics===
Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1564.001/ T1564.001], [https://attack.mitre.org/techniques/T1548.002/ T1548.002], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1222.001/ T1222.001], [https://attack.mitre.org/techniques/T1036/ T1036]
* '''Last Updated''': 2018-05-31
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Disable_registry_tool|Disable Registry Tool]]
* [[Documentation:ESSOC:detections:Detections#Disable_show_hidden_files|Disable Show Hidden Files]]
* [[Documentation:ESSOC:detections:Detections#Disable_windows_behavior_monitoring|Disable Windows Behavior Monitoring]]
* [[Documentation:ESSOC:detections:Detections#Disable_windows_smartscreen_protection|Disable Windows SmartScreen Protection]]
* [[Documentation:ESSOC:detections:Detections#Disabling_cmd_application|Disabling CMD Application]]
* [[Documentation:ESSOC:detections:Detections#Disabling_controlpanel|Disabling ControlPanel]]
* [[Documentation:ESSOC:detections:Detections#Disabling_firewall_with_netsh|Disabling Firewall with Netsh]]
* [[Documentation:ESSOC:detections:Detections#Disabling_folderoptions_windows_feature|Disabling FolderOptions Windows Feature]]
* [[Documentation:ESSOC:detections:Detections#Disabling_norun_windows_app|Disabling NoRun Windows App]]
* [[Documentation:ESSOC:detections:Detections#Disabling_remote_user_account_control|Disabling Remote User Account Control]]
* [[Documentation:ESSOC:detections:Detections#Disabling_systemrestore_in_registry|Disabling SystemRestore In Registry]]
* [[Documentation:ESSOC:detections:Detections#Disabling_task_manager|Disabling Task Manager]]
* [[Documentation:ESSOC:detections:Detections#Eventvwr_uac_bypass|Eventvwr UAC Bypass]]
* [[Documentation:ESSOC:detections:Detections#Excessive_number_of_service_control_start_as_disabled|Excessive number of service control start as disabled]]
* [[Documentation:ESSOC:detections:Detections#Fodhelper_uac_bypass|FodHelper UAC Bypass]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Hiding_files_and_directories_with_attrib_exe|Hiding Files And Directories With Attrib exe]]
* [[Documentation:ESSOC:detections:Detections#Net_profiler_uac_bypass|NET Profiler UAC bypass]]
* [[Documentation:ESSOC:detections:Detections#Slui_runas_elevated|SLUI RunAs Elevated]]
* [[Documentation:ESSOC:detections:Detections#Slui_spawning_a_process|SLUI Spawning a Process]]
* [[Documentation:ESSOC:detections:Detections#Sdclt_uac_bypass|Sdclt UAC Bypass]]
* [[Documentation:ESSOC:detections:Detections#Silentcleanup_uac_bypass|SilentCleanup UAC Bypass]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_reg_exe_process|Suspicious Reg exe Process]]
* [[Documentation:ESSOC:detections:Detections#System_process_running_from_unexpected_location|System Process Running from Unexpected Location]]
* [[Documentation:ESSOC:detections:Detections#Uac_bypass_mmc_load_unsigned_dll|UAC Bypass MMC Load Unsigned Dll]]
* [[Documentation:ESSOC:detections:Detections#Wsreset_uac_bypass|WSReset UAC Bypass]]
* [[Documentation:ESSOC:detections:Detections#Windows_disableantispyware_registry|Windows DisableAntiSpyware Registry]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1562.001
| Disable or Modify Tools
| Defense Evasion
|-
| T1564.001
| Hidden Files and Directories
| Defense Evasion
|-
| T1548.002
| Bypass User Account Control
| Privilege Escalation, Defense Evasion
|-
| T1112
| Modify Registry
| Defense Evasion
|-
| T1222.001
| Windows File and Directory Permissions Modification
| Defense Evasion
|-
| T1036
| Masquerading
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
* Delivery
* Exploitation
* Privilege Escalation
====Reference====
* https://attack.mitre.org/wiki/Defense_Evasion
''version'': 1
</div>
</div>
----
===Windows discovery techniques===
Monitors for behaviors associated with adversaries discovering objects in the environment that can be leveraged in the progression of the attack.
* '''Product''': Splunk Behavioral Analytics, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1484/ T1484], [https://attack.mitre.org/techniques/T1199/ T1199], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1590/ T1590], [https://attack.mitre.org/techniques/T1591/ T1591], [https://attack.mitre.org/techniques/T1595/ T1595], [https://attack.mitre.org/techniques/T1592/ T1592], [https://attack.mitre.org/techniques/T1007/ T1007], [https://attack.mitre.org/techniques/T1012/ T1012], [https://attack.mitre.org/techniques/T1046/ T1046], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1057/ T1057], [https://attack.mitre.org/techniques/T1083/ T1083], [https://attack.mitre.org/techniques/T1518/ T1518], [https://attack.mitre.org/techniques/T1592.002/ T1592.002], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1135/ T1135], [https://attack.mitre.org/techniques/T1039/ T1039], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1547/ T1547], [https://attack.mitre.org/techniques/T1574/ T1574], [https://attack.mitre.org/techniques/T1589.001/ T1589.001], [https://attack.mitre.org/techniques/T1590.001/ T1590.001], [https://attack.mitre.org/techniques/T1590.003/ T1590.003], [https://attack.mitre.org/techniques/T1098/ T1098], [https://attack.mitre.org/techniques/T1595.002/ T1595.002], [https://attack.mitre.org/techniques/T1055/ T1055]
* '''Last Updated''': 2021-03-04
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules|Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules|Reconnaissance and Access to Accounts and Groups via Mimikatz modules]]
* [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules|Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules|Reconnaissance and Access to Computers and Domains via PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_computers_via_mimikatz_modules|Reconnaissance and Access to Computers via Mimikatz modules]]
* [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules|Reconnaissance and Access to Operating System Elements via PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules|Reconnaissance and Access to Processes and Services via Mimikatz modules]]
* [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_shared_resources_via_mimikatz_modules|Reconnaissance and Access to Shared Resources via Mimikatz modules]]
* [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_shared_resources_via_powersploit_modules|Reconnaissance and Access to Shared Resources via PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules|Reconnaissance of Access and Persistence Opportunities via PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Reconnaissance_of_connectivity_via_powersploit_modules|Reconnaissance of Connectivity via PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Reconnaissance_of_credential_stores_and_services_via_mimikatz_modules|Reconnaissance of Credential Stores and Services via Mimikatz modules]]
* [[Documentation:ESSOC:detections:Detections#Reconnaissance_of_defensive_tools_via_powersploit_modules|Reconnaissance of Defensive Tools via PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules|Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules|Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1078
| Valid Accounts
| Defense Evasion, Persistence, Privilege Escalation, Initial Access
|-
| T1087
| Account Discovery
| Discovery
|-
| T1484
| Domain Policy Modification
| Defense Evasion, Privilege Escalation
|-
| T1199
| Trusted Relationship
| Initial Access
|-
| T1482
| Domain Trust Discovery
| Discovery
|-
| T1590
| Gather Victim Network Information
| Reconnaissance
|-
| T1591
| Gather Victim Org Information
| Reconnaissance
|-
| T1595
| Active Scanning
| Reconnaissance
|-
| T1592
| Gather Victim Host Information
| Reconnaissance
|-
| T1007
| System Service Discovery
| Discovery
|-
| T1012
| Query Registry
| Discovery
|-
| T1046
| Network Service Scanning
| Discovery
|-
| T1047
| Windows Management Instrumentation
| Execution
|-
| T1057
| Process Discovery
| Discovery
|-
| T1083
| File and Directory Discovery
| Discovery
|-
| T1518
| Software Discovery
| Discovery
|-
| T1592.002
| Software
| Reconnaissance
|-
| T1021.002
| SMB/Windows Admin Shares
| Lateral Movement
|-
| T1135
| Network Share Discovery
| Discovery
|-
| T1039
| Data from Network Shared Drive
| Collection
|-
| T1053
| Scheduled Task/Job
| Execution, Persistence, Privilege Escalation
|-
| T1068
| Exploitation for Privilege Escalation
| Privilege Escalation
|-
| T1543
| Create or Modify System Process
| Persistence, Privilege Escalation
|-
| T1547
| Boot or Logon Autostart Execution
| Persistence, Privilege Escalation
|-
| T1574
| Hijack Execution Flow
| Persistence, Privilege Escalation, Defense Evasion
|-
| T1589.001
| Credentials
| Reconnaissance
|-
| T1590.001
| Domain Properties
| Reconnaissance
|-
| T1590.003
| Network Trust Dependencies
| Reconnaissance
|-
| T1098
| Account Manipulation
| Persistence
|-
| T1595.002
| Vulnerability Scanning
| Reconnaissance
|-
| T1055
| Process Injection
| Defense Evasion, Privilege Escalation
|}
====Kill Chain Phase====
* Actions on Objectives
====Reference====
* https://attack.mitre.org/tactics/TA0007/
* https://cyberd.us/penetration-testing
* https://attack.mitre.org/software/S0521/
''version'': 1
</div>
</div>
----
===Windows log manipulation===
Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
* '''Last Updated''': 2017-09-12
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Deleting_shadow_copies|Deleting Shadow Copies]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Illegal_deletion_of_logs_via_mimikatz_modules|Illegal Deletion of Logs via Mimikatz modules]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_event_log_service_behavior|Suspicious Event Log Service Behavior]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_wevtutil_usage|Suspicious wevtutil Usage]]
* [[Documentation:ESSOC:detections:Detections#Usn_journal_deletion|USN Journal Deletion]]
* [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_clear_logs|WevtUtil Usage To Clear Logs]]
* [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_disable_logs|Wevtutil Usage To Disable Logs]]
* [[Documentation:ESSOC:detections:Detections#Windows_event_log_cleared|Windows Event Log Cleared]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1490
| Inhibit System Recovery
| Impact
|-
| T1070
| Indicator Removal on Host
| Defense Evasion
|-
| T1070.001
| Clear Windows Event Logs
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
* Exploitation
====Reference====
* https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
* https://zeltser.com/security-incident-log-review-checklist/
* http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html
''version'': 2
</div>
</div>
----
===Windows persistence techniques===
Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1574.009/ T1574.009], [https://attack.mitre.org/techniques/T1222.001/ T1222.001], [https://attack.mitre.org/techniques/T1585/ T1585], [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1098/ T1098], [https://attack.mitre.org/techniques/T1207/ T1207], [https://attack.mitre.org/techniques/T1484/ T1484], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1547.010/ T1547.010], [https://attack.mitre.org/techniques/T1574.011/ T1574.011], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1546.011/ T1546.011], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1068/ T1068]
* '''Last Updated''': 2018-05-31
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Certutil_exe_certificate_extraction|Certutil exe certificate extraction]]
* [[Documentation:ESSOC:detections:Detections#Detect_path_interception_by_creation_of_program_exe|Detect Path Interception By Creation Of program exe]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Hiding_files_and_directories_with_attrib_exe|Hiding Files And Directories With Attrib exe]]
* [[Documentation:ESSOC:detections:Detections#Illegal_account_creation_via_powersploit_modules|Illegal Account Creation via PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules|Illegal Enabling or Disabling of Accounts via DSInternals modules]]
* [[Documentation:ESSOC:detections:Detections#Illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules|Illegal Management of Active Directory Elements and Policies via DSInternals modules]]
* [[Documentation:ESSOC:detections:Detections#Illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules|Illegal Management of Computers and Active Directory Elements via PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Illegal_privilege_elevation_and_persistence_via_powersploit_modules|Illegal Privilege Elevation and Persistence via PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Monitor_registry_keys_for_print_monitors|Monitor Registry Keys for Print Monitors]]
* [[Documentation:ESSOC:detections:Detections#Reg_exe_manipulating_windows_services_registry_keys|Reg exe Manipulating Windows Services Registry Keys]]
* [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
* [[Documentation:ESSOC:detections:Detections#Registry_keys_for_creating_shim_databases|Registry Keys for Creating SHIM Databases]]
* [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]
* [[Documentation:ESSOC:detections:Detections#Schedule_task_with_http_command_arguments|Schedule Task with HTTP Command Arguments]]
* [[Documentation:ESSOC:detections:Detections#Schedule_task_with_rundll32_command_trigger|Schedule Task with Rundll32 Command Trigger]]
* [[Documentation:ESSOC:detections:Detections#Schtasks_used_for_forcing_a_reboot|Schtasks used for forcing a reboot]]
* [[Documentation:ESSOC:detections:Detections#Setting_credentials_via_dsinternals_modules|Setting Credentials via DSInternals modules]]
* [[Documentation:ESSOC:detections:Detections#Setting_credentials_via_mimikatz_modules|Setting Credentials via Mimikatz modules]]
* [[Documentation:ESSOC:detections:Detections#Setting_credentials_via_powersploit_modules|Setting Credentials via PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Shim_database_file_creation|Shim Database File Creation]]
* [[Documentation:ESSOC:detections:Detections#Shim_database_installation_with_suspicious_parameters|Shim Database Installation With Suspicious Parameters]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_scheduled_task_from_public_directory|Suspicious Scheduled Task from Public Directory]]
* [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_within_public_path|WinEvent Scheduled Task Created Within Public Path]]
* [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_to_spawn_shell|WinEvent Scheduled Task Created to Spawn Shell]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1574.009
| Path Interception by Unquoted Path
| Persistence, Privilege Escalation, Defense Evasion
|-
| T1222.001
| Windows File and Directory Permissions Modification
| Defense Evasion
|-
| T1585
| Establish Accounts
| Resource Development
|-
| T1078
| Valid Accounts
| Defense Evasion, Persistence, Privilege Escalation, Initial Access
|-
| T1098
| Account Manipulation
| Persistence
|-
| T1207
| Rogue Domain Controller
| Defense Evasion
|-
| T1484
| Domain Policy Modification
| Defense Evasion, Privilege Escalation
|-
| T1053
| Scheduled Task/Job
| Execution, Persistence, Privilege Escalation
|-
| T1134
| Access Token Manipulation
| Defense Evasion, Privilege Escalation
|-
| T1548
| Abuse Elevation Control Mechanism
| Privilege Escalation, Defense Evasion
|-
| T1547.010
| Port Monitors
| Persistence, Privilege Escalation
|-
| T1574.011
| Services Registry Permissions Weakness
| Persistence, Privilege Escalation, Defense Evasion
|-
| T1547.001
| Registry Run Keys / Startup Folder
| Persistence, Privilege Escalation
|-
| T1546.011
| Application Shimming
| Privilege Escalation, Persistence
|-
| T1543.003
| Windows Service
| Persistence, Privilege Escalation
|-
| T1053.005
| Scheduled Task
| Execution, Persistence, Privilege Escalation
|-
| T1068
| Exploitation for Privilege Escalation
| Privilege Escalation
|}
====Kill Chain Phase====
* Actions on Objectives
* Exploitation
* Installation
* Privilege Escalation
====Reference====
* http://www.fuzzysecurity.com/tutorials/19.html
* https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html
* http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/
* https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
* https://www.youtube.com/watch?v=dq2Hv7J9fvk
''version'': 2
</div>
</div>
----
===Windows privilege escalation===
Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1546.008/ T1546.008], [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1098/ T1098], [https://attack.mitre.org/techniques/T1546.012/ T1546.012]
* '''Last Updated''': 2020-02-04
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Child_processes_of_spoolsv_exe|Child Processes of Spoolsv exe]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Illegal_privilege_elevation_via_mimikatz_modules|Illegal Privilege Elevation via Mimikatz modules]]
* [[Documentation:ESSOC:detections:Detections#Overwriting_accessibility_binaries|Overwriting Accessibility Binaries]]
* [[Documentation:ESSOC:detections:Detections#Probing_access_with_stolen_credentials_via_powersploit_modules|Probing Access with Stolen Credentials via PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_privilege_escalation|Registry Keys Used For Privilege Escalation]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1068
| Exploitation for Privilege Escalation
| Privilege Escalation
|-
| T1134
| Access Token Manipulation
| Defense Evasion, Privilege Escalation
|-
| T1548
| Abuse Elevation Control Mechanism
| Privilege Escalation, Defense Evasion
|-
| T1546.008
| Accessibility Features
| Privilege Escalation, Persistence
|-
| T1078
| Valid Accounts
| Defense Evasion, Persistence, Privilege Escalation, Initial Access
|-
| T1098
| Account Manipulation
| Persistence
|-
| T1546.012
| Image File Execution Options Injection
| Privilege Escalation, Persistence
|}
====Kill Chain Phase====
* Actions on Objectives
* Exploitation
====Reference====
* https://attack.mitre.org/tactics/TA0004/
''version'': 2
</div>
</div>
----
==Best Practices==
===Asset tracking===
Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Network_Sessions
* '''ATT&CK''':
* '''Last Updated''': 2017-09-13
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Count_of_assets_by_category|Count of assets by category]]
* [[Documentation:ESSOC:detections:Detections#Detect_unauthorized_assets_by_mac_address|Detect Unauthorized Assets by MAC address]]
* [[Documentation:ESSOC:detections:Detections#Get_first_occurrence_and_last_occurrence_of_a_mac_address|Get First Occurrence and Last Occurrence of a MAC Address]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
====Kill Chain Phase====
* Actions on Objectives
* Delivery
* Reconnaissance
====Reference====
* https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/
''version'': 1
</div>
</div>
----
===Monitor for updates===
Monitor your enterprise to ensure that your endpoints are being patched and updated. Adversaries notoriously exploit known vulnerabilities that could be mitigated by applying routine security patches.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Updates
* '''ATT&CK''':
* '''Last Updated''': 2017-09-15
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#No_windows_updates_in_a_time_frame|No Windows Updates in a time frame]]
====Kill Chain Phase====
====Reference====
* https://learn.cisecurity.org/20-controls-download
''version'': 1
</div>
</div>
----
===Prohibited traffic allowed or protocol mismatch===
Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint, Network_Resolution, Network_Traffic
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1189/ T1189], [https://attack.mitre.org/techniques/T1021/ T1021], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
* '''Last Updated''': 2017-09-11
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Allow_inbound_traffic_by_firewall_rule_registry|Allow Inbound Traffic By Firewall Rule Registry]]
* [[Documentation:ESSOC:detections:Detections#Allow_inbound_traffic_in_firewall_rule|Allow Inbound Traffic In Firewall Rule]]
* [[Documentation:ESSOC:detections:Detections#Detect_hosts_connecting_to_dynamic_domain_providers|Detect hosts connecting to dynamic domain providers]]
* [[Documentation:ESSOC:detections:Detections#Enable_rdp_in_other_port_number|Enable RDP In Other Port Number]]
* [[Documentation:ESSOC:detections:Detections#Get_dns_server_history_for_a_host|Get DNS Server History for a host]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
* [[Documentation:ESSOC:detections:Detections#Prohibited_network_traffic_allowed|Prohibited Network Traffic Allowed]]
* [[Documentation:ESSOC:detections:Detections#Protocol_or_port_mismatch|Protocol or Port Mismatch]]
* [[Documentation:ESSOC:detections:Detections#Tor_traffic|TOR Traffic]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1021.001
| Remote Desktop Protocol
| Lateral Movement
|-
| T1189
| Drive-by Compromise
| Initial Access
|-
| T1021
| Remote Services
| Lateral Movement
|-
| T1048
| Exfiltration Over Alternative Protocol
| Exfiltration
|-
| T1048.003
| Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
| Exfiltration
|-
| T1071.001
| Web Protocols
| Command And Control
|}
====Kill Chain Phase====
* Actions on Objectives
* Command and Control
* Delivery
* Exploitation
====Reference====
* http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/
''version'': 1
</div>
</div>
----
===Router and infrastructure security===
Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Authentication, Network_Traffic
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1200/ T1200], [https://attack.mitre.org/techniques/T1498/ T1498], [https://attack.mitre.org/techniques/T1557.002/ T1557.002], [https://attack.mitre.org/techniques/T1557/ T1557], [https://attack.mitre.org/techniques/T1542.005/ T1542.005], [https://attack.mitre.org/techniques/T1020.001/ T1020.001]
* '''Last Updated''': 2017-09-12
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Detect_arp_poisoning|Detect ARP Poisoning]]
* [[Documentation:ESSOC:detections:Detections#Detect_ipv6_network_infrastructure_threats|Detect IPv6 Network Infrastructure Threats]]
* [[Documentation:ESSOC:detections:Detections#Detect_new_login_attempts_to_routers|Detect New Login Attempts to Routers]]
* [[Documentation:ESSOC:detections:Detections#Detect_port_security_violation|Detect Port Security Violation]]
* [[Documentation:ESSOC:detections:Detections#Detect_rogue_dhcp_server|Detect Rogue DHCP Server]]
* [[Documentation:ESSOC:detections:Detections#Detect_software_download_to_network_device|Detect Software Download To Network Device]]
* [[Documentation:ESSOC:detections:Detections#Detect_traffic_mirroring|Detect Traffic Mirroring]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1200
| Hardware Additions
| Initial Access
|-
| T1498
| Network Denial of Service
| Impact
|-
| T1557.002
| ARP Cache Poisoning
| Credential Access, Collection
|-
| T1557
| Man-in-the-Middle
| Credential Access, Collection
|-
| T1542.005
| TFTP Boot
| Defense Evasion, Persistence
|-
| T1020.001
| Traffic Duplication
| Exfiltration
|}
====Kill Chain Phase====
* Actions on Objectives
* Delivery
* Exploitation
* Reconnaissance
====Reference====
* https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html
* https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html
''version'': 1
</div>
</div>
----
===Use of cleartext protocols===
Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint, Network_Traffic
* '''ATT&CK''':
* '''Last Updated''': 2017-09-15
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
* [[Documentation:ESSOC:detections:Detections#Protocols_passing_authentication_in_cleartext|Protocols passing authentication in cleartext]]
====Kill Chain Phase====
* Actions on Objectives
* Reconnaissance
====Reference====
* https://www.monkey.org/~dugsong/dsniff/
''version'': 1
</div>
</div>
----
==Cloud Security==
===Aws cross account activity===
Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1550/ T1550]
* '''Last Updated''': 2018-06-04
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_accesskeyid|AWS Investigate User Activities By AccessKeyId]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_aws_cross_account_activity|Previously Seen AWS Cross Account Activity]]
* [[Documentation:ESSOC:detections:Detections#Aws_detect_attach_to_role_policy|aws detect attach to role policy]]
* [[Documentation:ESSOC:detections:Detections#Aws_detect_permanent_key_creation|aws detect permanent key creation]]
* [[Documentation:ESSOC:detections:Detections#Aws_detect_role_creation|aws detect role creation]]
* [[Documentation:ESSOC:detections:Detections#Aws_detect_sts_assume_role_abuse|aws detect sts assume role abuse]]
* [[Documentation:ESSOC:detections:Detections#Aws_detect_sts_get_session_token_abuse|aws detect sts get session token abuse]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1078
| Valid Accounts
| Defense Evasion, Persistence, Privilege Escalation, Initial Access
|-
| T1550
| Use Alternate Authentication Material
| Defense Evasion, Lateral Movement
|}
====Kill Chain Phase====
* Lateral Movement
====Reference====
* https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/
''version'': 1
</div>
</div>
----
===Aws iam privilege escalation===
This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation.
* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004], [https://attack.mitre.org/techniques/T1136.003/ T1136.003], [https://attack.mitre.org/techniques/T1580/ T1580], [https://attack.mitre.org/techniques/T1110/ T1110], [https://attack.mitre.org/techniques/T1098/ T1098], [https://attack.mitre.org/techniques/T1069.003/ T1069.003]
* '''Last Updated''': 2021-03-08
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Aws_create_policy_version_to_allow_all_resources|AWS Create Policy Version to allow all resources]]
* [[Documentation:ESSOC:detections:Detections#Aws_createaccesskey|AWS CreateAccessKey]]
* [[Documentation:ESSOC:detections:Detections#Aws_createloginprofile|AWS CreateLoginProfile]]
* [[Documentation:ESSOC:detections:Detections#Aws_iam_assume_role_policy_brute_force|AWS IAM Assume Role Policy Brute Force]]
* [[Documentation:ESSOC:detections:Detections#Aws_iam_delete_policy|AWS IAM Delete Policy]]
* [[Documentation:ESSOC:detections:Detections#Aws_iam_failure_group_deletion|AWS IAM Failure Group Deletion]]
* [[Documentation:ESSOC:detections:Detections#Aws_iam_successful_group_deletion|AWS IAM Successful Group Deletion]]
* [[Documentation:ESSOC:detections:Detections#Aws_setdefaultpolicyversion|AWS SetDefaultPolicyVersion]]
* [[Documentation:ESSOC:detections:Detections#Aws_updateloginprofile|AWS UpdateLoginProfile]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1078.004
| Cloud Accounts
| Defense Evasion, Persistence, Privilege Escalation, Initial Access
|-
| T1136.003
| Cloud Account
| Persistence
|-
| T1580
| Cloud Infrastructure Discovery
| Discovery
|-
| T1110
| Brute Force
| Credential Access
|-
| T1098
| Account Manipulation
| Persistence
|-
| T1069.003
| Cloud Groups
| Discovery
|}
====Kill Chain Phase====
* Actions on Objectives
* Reconnaissance
====Reference====
* https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
* https://www.cyberark.com/resources/threat-research-blog/the-cloud-shadow-admin-threat-10-permissions-to-protect
* https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
''version'': 1
</div>
</div>
----
===Aws network acl activity===
Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint, Network_Traffic
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.007/ T1562.007]
* '''Last Updated''': 2018-05-21
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_arn|AWS Investigate User Activities By ARN]]
* [[Documentation:ESSOC:detections:Detections#Aws_network_acl_details_from_id|AWS Network ACL Details from ID]]
* [[Documentation:ESSOC:detections:Detections#Aws_network_access_control_list_created_with_all_open_ports|AWS Network Access Control List Created with All Open Ports]]
* [[Documentation:ESSOC:detections:Detections#Aws_network_access_control_list_deleted|AWS Network Access Control List Deleted]]
* [[Documentation:ESSOC:detections:Detections#Aws_network_interface_details_via_resourceid|AWS Network Interface details via resourceId]]
* [[Documentation:ESSOC:detections:Detections#Baseline_of_network_acl_activity_by_arn|Baseline of Network ACL Activity by ARN]]
* [[Documentation:ESSOC:detections:Detections#Baseline_of_blocked_outbound_traffic_from_aws|Baseline of blocked outbound traffic from AWS]]
* [[Documentation:ESSOC:detections:Detections#Detect_spike_in_blocked_outbound_traffic_from_your_aws|Detect Spike in blocked Outbound Traffic from your AWS]]
* [[Documentation:ESSOC:detections:Detections#Get_all_aws_activity_from_ip_address|Get All AWS Activity From IP Address]]
* [[Documentation:ESSOC:detections:Detections#Get_dns_server_history_for_a_host|Get DNS Server History for a host]]
* [[Documentation:ESSOC:detections:Detections#Get_dns_traffic_ratio|Get DNS traffic ratio]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
* [[Documentation:ESSOC:detections:Detections#Get_process_responsible_for_the_dns_traffic|Get Process Responsible For The DNS Traffic]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1562.007
| Disable or Modify Cloud Firewall
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
* Command and Control
====Reference====
* https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html
* https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/
''version'': 2
</div>
</div>
----
===Aws security hub alerts===
This story is focused around detecting Security Hub alerts generated from AWS
* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''ATT&CK''':
* '''Last Updated''': 2020-08-04
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_arn|AWS Investigate User Activities By ARN]]
* [[Documentation:ESSOC:detections:Detections#Detect_spike_in_aws_security_hub_alerts_for_ec2_instance|Detect Spike in AWS Security Hub Alerts for EC2 Instance]]
* [[Documentation:ESSOC:detections:Detections#Detect_spike_in_aws_security_hub_alerts_for_user|Detect Spike in AWS Security Hub Alerts for User]]
* [[Documentation:ESSOC:detections:Detections#Get_ec2_instance_details_by_instanceid|Get EC2 Instance Details by instanceId]]
* [[Documentation:ESSOC:detections:Detections#Get_ec2_launch_details|Get EC2 Launch Details]]
====Kill Chain Phase====
====Reference====
* https://aws.amazon.com/security-hub/features/
''version'': 1
</div>
</div>
----
===Aws user monitoring===
Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1526/ T1526]
* '''Last Updated''': 2018-03-12
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Aws_excessive_security_scanning|AWS Excessive Security Scanning]]
* [[Documentation:ESSOC:detections:Detections#Baseline_of_api_calls_per_user_arn|Baseline of API Calls per User ARN]]
* [[Documentation:ESSOC:detections:Detections#Baseline_of_security_group_activity_by_arn|Baseline of Security Group Activity by ARN]]
* [[Documentation:ESSOC:detections:Detections#Create_a_list_of_approved_aws_service_accounts|Create a list of approved AWS service accounts]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Investigate_aws_user_activities_by_user_field|Investigate AWS User Activities by user field]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_api_call_per_user_roles_in_cloudtrail|Previously seen API call per user roles in CloudTrail]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1526
| Cloud Service Discovery
| Discovery
|}
====Kill Chain Phase====
* Actions on Objectives
====Reference====
* https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
* https://redlock.io/blog/cryptojacking-tesla
''version'': 1
</div>
</div>
----
===Cloud cryptomining===
Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Change
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004], [https://attack.mitre.org/techniques/T1535/ T1535]
* '''Last Updated''': 2019-10-02
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Aws_investigate_security_hub_alerts_by_dest|AWS Investigate Security Hub alerts by dest]]
* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_arn|AWS Investigate User Activities By ARN]]
* [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_instances_launched|Abnormally High Number Of Cloud Instances Launched]]
* [[Documentation:ESSOC:detections:Detections#Baseline_of_cloud_instances_destroyed|Baseline Of Cloud Instances Destroyed]]
* [[Documentation:ESSOC:detections:Detections#Baseline_of_cloud_instances_launched|Baseline Of Cloud Instances Launched]]
* [[Documentation:ESSOC:detections:Detections#Cloud_compute_instance_created_by_previously_unseen_user|Cloud Compute Instance Created By Previously Unseen User]]
* [[Documentation:ESSOC:detections:Detections#Cloud_compute_instance_created_in_previously_unused_region|Cloud Compute Instance Created In Previously Unused Region]]
* [[Documentation:ESSOC:detections:Detections#Cloud_compute_instance_created_with_previously_unseen_image|Cloud Compute Instance Created With Previously Unseen Image]]
* [[Documentation:ESSOC:detections:Detections#Cloud_compute_instance_created_with_previously_unseen_instance_type|Cloud Compute Instance Created With Previously Unseen Instance Type]]
* [[Documentation:ESSOC:detections:Detections#Get_ec2_instance_details_by_instanceid|Get EC2 Instance Details by instanceId]]
* [[Documentation:ESSOC:detections:Detections#Get_ec2_launch_details|Get EC2 Launch Details]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Investigate_aws_activities_via_region_name|Investigate AWS activities via region name]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_compute_creations_by_user_-_initial|Previously Seen Cloud Compute Creations By User - Initial]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_compute_creations_by_user_-_update|Previously Seen Cloud Compute Creations By User - Update]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_compute_images_-_initial|Previously Seen Cloud Compute Images - Initial]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_compute_images_-_update|Previously Seen Cloud Compute Images - Update]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_compute_instance_types_-_initial|Previously Seen Cloud Compute Instance Types - Initial]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_compute_instance_types_-_update|Previously Seen Cloud Compute Instance Types - Update]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_regions_-_initial|Previously Seen Cloud Regions - Initial]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_regions_-_update|Previously Seen Cloud Regions - Update]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1078.004
| Cloud Accounts
| Defense Evasion, Persistence, Privilege Escalation, Initial Access
|-
| T1535
| Unused/Unsupported Cloud Regions
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
====Reference====
* https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
''version'': 1
</div>
</div>
----
===Cloud federated credential abuse===
This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements.
* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1003.001/ T1003.001], [https://attack.mitre.org/techniques/T1136.003/ T1136.003], [https://attack.mitre.org/techniques/T1556/ T1556], [https://attack.mitre.org/techniques/T1546.012/ T1546.012]
* '''Last Updated''': 2021-01-26
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Aws_saml_access_by_provider_user_and_principal|AWS SAML Access by Provider User and Principal]]
* [[Documentation:ESSOC:detections:Detections#Aws_saml_update_identity_provider|AWS SAML Update identity provider]]
* [[Documentation:ESSOC:detections:Detections#Certutil_exe_certificate_extraction|Certutil exe certificate extraction]]
* [[Documentation:ESSOC:detections:Detections#Detect_mimikatz_using_loaded_images|Detect Mimikatz Using Loaded Images]]
* [[Documentation:ESSOC:detections:Detections#Detect_rare_executables|Detect Rare Executables]]
* [[Documentation:ESSOC:detections:Detections#O365_add_app_role_assignment_grant_user|O365 Add App Role Assignment Grant User]]
* [[Documentation:ESSOC:detections:Detections#O365_added_service_principal|O365 Added Service Principal]]
* [[Documentation:ESSOC:detections:Detections#O365_excessive_sso_logon_errors|O365 Excessive SSO logon errors]]
* [[Documentation:ESSOC:detections:Detections#O365_new_federated_domain_added|O365 New Federated Domain Added]]
* [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_privilege_escalation|Registry Keys Used For Privilege Escalation]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1078
| Valid Accounts
| Defense Evasion, Persistence, Privilege Escalation, Initial Access
|-
| T1003.001
| LSASS Memory
| Credential Access
|-
| T1136.003
| Cloud Account
| Persistence
|-
| T1556
| Modify Authentication Process
| Credential Access, Defense Evasion, Persistence
|-
| T1546.012
| Image File Execution Options Injection
| Privilege Escalation, Persistence
|}
====Kill Chain Phase====
* Actions on Objective
* Actions on Objectives
* Command and Control
* Installation
====Reference====
* https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
* https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
* https://us-cert.cisa.gov/ncas/alerts/aa21-008a
''version'': 1
</div>
</div>
----
===Container implantation monitoring and investigation===
Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company's repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1525/ T1525]
* '''Last Updated''': 2020-02-20
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#New_container_uploaded_to_aws_ecr|New container uploaded to AWS ECR]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1525
| Implant Internal Image
| Persistence
|}
====Kill Chain Phase====
====Reference====
* https://github.com/splunk/cloud-datamodel-security-research
''version'': 1
</div>
</div>
----
===Dev sec ops===
This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204.003/ T1204.003], [https://attack.mitre.org/techniques/T1212/ T1212], [https://attack.mitre.org/techniques/T1526/ T1526]
* '''Last Updated''': 2021-08-18
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_scanning_findings_high|AWS ECR Container Scanning Findings High]]
* [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_scanning_findings_low_informational_unknown|AWS ECR Container Scanning Findings Low Informational Unknown]]
* [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_scanning_findings_medium|AWS ECR Container Scanning Findings Medium]]
* [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_upload_outside_business_hours|AWS ECR Container Upload Outside Business Hours]]
* [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_upload_unknown_user|AWS ECR Container Upload Unknown User]]
* [[Documentation:ESSOC:detections:Detections#Kubernetes_nginx_ingress_lfi|Kubernetes Nginx Ingress LFI]]
* [[Documentation:ESSOC:detections:Detections#Kubernetes_nginx_ingress_rfi|Kubernetes Nginx Ingress RFI]]
* [[Documentation:ESSOC:detections:Detections#Kubernetes_scanner_image_pulling|Kubernetes Scanner Image Pulling]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1204.003
| Malicious Image
| Execution
|-
| T1212
| Exploitation for Credential Access
| Credential Access
|-
| T1526
| Cloud Service Discovery
| Discovery
|}
====Kill Chain Phase====
* Actions on Objectives
====Reference====
* https://www.redhat.com/en/topics/devops/what-is-devsecops
''version'': 1
</div>
</div>
----
===Gcp cross account activity===
Track when a user assumes an IAM role in another GCP account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078]
* '''Last Updated''': 2020-09-01
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Gcp_detect_gcploit_framework|GCP Detect gcploit framework]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1078
| Valid Accounts
| Defense Evasion, Persistence, Privilege Escalation, Initial Access
|}
====Kill Chain Phase====
* Lateral Movement
====Reference====
* https://cloud.google.com/iam/docs/understanding-service-accounts
''version'': 1
</div>
</div>
----
===Kubernetes scanning activity===
This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1526/ T1526]
* '''Last Updated''': 2020-04-15
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Amazon_eks_kubernetes_pod_scan_detection|Amazon EKS Kubernetes Pod scan detection]]
* [[Documentation:ESSOC:detections:Detections#Amazon_eks_kubernetes_activity_by_src_ip|Amazon EKS Kubernetes activity by src ip]]
* [[Documentation:ESSOC:detections:Detections#Amazon_eks_kubernetes_cluster_scan_detection|Amazon EKS Kubernetes cluster scan detection]]
* [[Documentation:ESSOC:detections:Detections#Gcp_kubernetes_activity_by_src_ip|GCP Kubernetes activity by src ip]]
* [[Documentation:ESSOC:detections:Detections#Gcp_kubernetes_cluster_pod_scan_detection|GCP Kubernetes cluster pod scan detection]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1526
| Cloud Service Discovery
| Discovery
|}
====Kill Chain Phase====
* Reconnaissance
====Reference====
* https://github.com/splunk/cloud-datamodel-security-research
''version'': 1
</div>
</div>
----
===Kubernetes sensitive object access activity===
This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''ATT&CK''':
* '''Last Updated''': 2020-05-20
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Kubernetes_aws_detect_suspicious_kubectl_calls|Kubernetes AWS detect suspicious kubectl calls]]
====Kill Chain Phase====
* Lateral Movement
====Reference====
* https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html
''version'': 1
</div>
</div>
----
===Office 365 detections===
This story is focused around detecting Office 365 Attacks.
* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110.001/ T1110.001], [https://attack.mitre.org/techniques/T1136.003/ T1136.003], [https://attack.mitre.org/techniques/T1562.007/ T1562.007], [https://attack.mitre.org/techniques/T1556/ T1556], [https://attack.mitre.org/techniques/T1110/ T1110], [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114.003/ T1114.003], [https://attack.mitre.org/techniques/T1114.002/ T1114.002]
* '''Last Updated''': 2020-12-16
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#High_number_of_login_failures_from_a_single_source|High Number of Login Failures from a single source]]
* [[Documentation:ESSOC:detections:Detections#O365_add_app_role_assignment_grant_user|O365 Add App Role Assignment Grant User]]
* [[Documentation:ESSOC:detections:Detections#O365_added_service_principal|O365 Added Service Principal]]
* [[Documentation:ESSOC:detections:Detections#O365_bypass_mfa_via_trusted_ip|O365 Bypass MFA via Trusted IP]]
* [[Documentation:ESSOC:detections:Detections#O365_disable_mfa|O365 Disable MFA]]
* [[Documentation:ESSOC:detections:Detections#O365_excessive_authentication_failures_alert|O365 Excessive Authentication Failures Alert]]
* [[Documentation:ESSOC:detections:Detections#O365_excessive_sso_logon_errors|O365 Excessive SSO logon errors]]
* [[Documentation:ESSOC:detections:Detections#O365_new_federated_domain_added|O365 New Federated Domain Added]]
* [[Documentation:ESSOC:detections:Detections#O365_pst_export_alert|O365 PST export alert]]
* [[Documentation:ESSOC:detections:Detections#O365_suspicious_admin_email_forwarding|O365 Suspicious Admin Email Forwarding]]
* [[Documentation:ESSOC:detections:Detections#O365_suspicious_rights_delegation|O365 Suspicious Rights Delegation]]
* [[Documentation:ESSOC:detections:Detections#O365_suspicious_user_email_forwarding|O365 Suspicious User Email Forwarding]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1110.001
| Password Guessing
| Credential Access
|-
| T1136.003
| Cloud Account
| Persistence
|-
| T1562.007
| Disable or Modify Cloud Firewall
| Defense Evasion
|-
| T1556
| Modify Authentication Process
| Credential Access, Defense Evasion, Persistence
|-
| T1110
| Brute Force
| Credential Access
|-
| T1114
| Email Collection
| Collection
|-
| T1114.003
| Email Forwarding Rule
| Collection
|-
| T1114.002
| Remote Email Collection
| Collection
|}
====Kill Chain Phase====
* Actions on Objective
* Actions on Objectives
* Not Applicable
====Reference====
* https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf
''version'': 1
</div>
</div>
----
===Suspicious aws login activities===
Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins.
* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Authentication
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1535/ T1535]
* '''Last Updated''': 2019-05-01
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_arn|AWS Investigate User Activities By ARN]]
* [[Documentation:ESSOC:detections:Detections#Detect_aws_console_login_by_user_from_new_city|Detect AWS Console Login by User from New City]]
* [[Documentation:ESSOC:detections:Detections#Detect_aws_console_login_by_user_from_new_country|Detect AWS Console Login by User from New Country]]
* [[Documentation:ESSOC:detections:Detections#Detect_aws_console_login_by_user_from_new_region|Detect AWS Console Login by User from New Region]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_users_in_cloudtrail|Previously seen users in CloudTrail]]
* [[Documentation:ESSOC:detections:Detections#Update_previously_seen_users_in_cloudtrail|Update previously seen users in CloudTrail]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1535
| Unused/Unsupported Cloud Regions
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
====Reference====
* https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html
''version'': 1
</div>
</div>
----
===Suspicious aws s3 activities===
Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1530/ T1530]
* '''Last Updated''': 2018-07-24
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_arn|AWS Investigate User Activities By ARN]]
* [[Documentation:ESSOC:detections:Detections#Aws_s3_bucket_details_via_bucketname|AWS S3 Bucket details via bucketName]]
* [[Documentation:ESSOC:detections:Detections#Baseline_of_s3_bucket_deletion_activity_by_arn|Baseline of S3 Bucket deletion activity by ARN]]
* [[Documentation:ESSOC:detections:Detections#Detect_new_open_s3_buckets_over_aws_cli|Detect New Open S3 Buckets over AWS CLI]]
* [[Documentation:ESSOC:detections:Detections#Detect_new_open_s3_buckets|Detect New Open S3 buckets]]
* [[Documentation:ESSOC:detections:Detections#Detect_s3_access_from_a_new_ip|Detect S3 access from a new IP]]
* [[Documentation:ESSOC:detections:Detections#Detect_spike_in_s3_bucket_deletion|Detect Spike in S3 Bucket deletion]]
* [[Documentation:ESSOC:detections:Detections#Get_all_aws_activity_from_ip_address|Get All AWS Activity From IP Address]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Investigate_aws_activities_via_region_name|Investigate AWS activities via region name]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_s3_bucket_access_by_remote_ip|Previously seen S3 bucket access by remote IP]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1530
| Data from Cloud Storage Object
| Collection
|}
====Kill Chain Phase====
* Actions on Objectives
====Reference====
* https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
* https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/
''version'': 2
</div>
</div>
----
===Suspicious aws traffic===
Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC).
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint, Network_Traffic
* '''ATT&CK''':
* '''Last Updated''': 2018-05-07
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_arn|AWS Investigate User Activities By ARN]]
* [[Documentation:ESSOC:detections:Detections#Aws_network_acl_details_from_id|AWS Network ACL Details from ID]]
* [[Documentation:ESSOC:detections:Detections#Aws_network_interface_details_via_resourceid|AWS Network Interface details via resourceId]]
* [[Documentation:ESSOC:detections:Detections#Baseline_of_blocked_outbound_traffic_from_aws|Baseline of blocked outbound traffic from AWS]]
* [[Documentation:ESSOC:detections:Detections#Detect_spike_in_blocked_outbound_traffic_from_your_aws|Detect Spike in blocked Outbound Traffic from your AWS]]
* [[Documentation:ESSOC:detections:Detections#Get_all_aws_activity_from_ip_address|Get All AWS Activity From IP Address]]
* [[Documentation:ESSOC:detections:Detections#Get_dns_server_history_for_a_host|Get DNS Server History for a host]]
* [[Documentation:ESSOC:detections:Detections#Get_dns_traffic_ratio|Get DNS traffic ratio]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
* [[Documentation:ESSOC:detections:Detections#Get_process_responsible_for_the_dns_traffic|Get Process Responsible For The DNS Traffic]]
====Kill Chain Phase====
* Actions on Objectives
* Command and Control
====Reference====
* https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/
''version'': 1
</div>
</div>
----
===Suspicious cloud authentication activities===
Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity.
* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Authentication
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1535/ T1535]
* '''Last Updated''': 2020-06-04
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Aws_cross_account_activity_from_previously_unseen_account|AWS Cross Account Activity From Previously Unseen Account]]
* [[Documentation:ESSOC:detections:Detections#Detect_aws_console_login_by_new_user|Detect AWS Console Login by New User]]
* [[Documentation:ESSOC:detections:Detections#Detect_aws_console_login_by_user_from_new_city|Detect AWS Console Login by User from New City]]
* [[Documentation:ESSOC:detections:Detections#Detect_aws_console_login_by_user_from_new_country|Detect AWS Console Login by User from New Country]]
* [[Documentation:ESSOC:detections:Detections#Detect_aws_console_login_by_user_from_new_region|Detect AWS Console Login by User from New Region]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Investigate_aws_user_activities_by_user_field|Investigate AWS User Activities by user field]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_aws_cross_account_activity_-_initial|Previously Seen AWS Cross Account Activity - Initial]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_aws_cross_account_activity_-_update|Previously Seen AWS Cross Account Activity - Update]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_users_in_cloudtrail_-_update|Previously Seen Users In CloudTrail - Update]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_users_in_cloudtrail_-_initial|Previously Seen Users in CloudTrail - Initial]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1535
| Unused/Unsupported Cloud Regions
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
====Reference====
* https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/
* https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html
''version'': 1
</div>
</div>
----
===Suspicious cloud instance activities===
Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Change
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004], [https://attack.mitre.org/techniques/T1537/ T1537]
* '''Last Updated''': 2020-08-25
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_arn|AWS Investigate User Activities By ARN]]
* [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_instances_destroyed|Abnormally High Number Of Cloud Instances Destroyed]]
* [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_instances_launched|Abnormally High Number Of Cloud Instances Launched]]
* [[Documentation:ESSOC:detections:Detections#Baseline_of_cloud_instances_destroyed|Baseline Of Cloud Instances Destroyed]]
* [[Documentation:ESSOC:detections:Detections#Baseline_of_cloud_instances_launched|Baseline Of Cloud Instances Launched]]
* [[Documentation:ESSOC:detections:Detections#Cloud_instance_modified_by_previously_unseen_user|Cloud Instance Modified By Previously Unseen User]]
* [[Documentation:ESSOC:detections:Detections#Detect_shared_ec2_snapshot|Detect shared ec2 snapshot]]
* [[Documentation:ESSOC:detections:Detections#Get_all_aws_activity_from_ip_address|Get All AWS Activity From IP Address]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_instance_modifications_by_user_-_initial|Previously Seen Cloud Instance Modifications By User - Initial]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_instance_modifications_by_user_-_update|Previously Seen Cloud Instance Modifications By User - Update]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1078.004
| Cloud Accounts
| Defense Evasion, Persistence, Privilege Escalation, Initial Access
|-
| T1537
| Transfer Data to Cloud Account
| Exfiltration
|}
====Kill Chain Phase====
* Actions on Objectives
====Reference====
* https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
''version'': 1
</div>
</div>
----
===Suspicious cloud provisioning activities===
Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Change
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078]
* '''Last Updated''': 2018-08-20
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Cloud_provisioning_activity_from_previously_unseen_city|Cloud Provisioning Activity From Previously Unseen City]]
* [[Documentation:ESSOC:detections:Detections#Cloud_provisioning_activity_from_previously_unseen_country|Cloud Provisioning Activity From Previously Unseen Country]]
* [[Documentation:ESSOC:detections:Detections#Cloud_provisioning_activity_from_previously_unseen_ip_address|Cloud Provisioning Activity From Previously Unseen IP Address]]
* [[Documentation:ESSOC:detections:Detections#Cloud_provisioning_activity_from_previously_unseen_region|Cloud Provisioning Activity From Previously Unseen Region]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_provisioning_activity_sources_-_initial|Previously Seen Cloud Provisioning Activity Sources - Initial]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_provisioning_activity_sources_-_update|Previously Seen Cloud Provisioning Activity Sources - Update]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1078
| Valid Accounts
| Defense Evasion, Persistence, Privilege Escalation, Initial Access
|}
====Kill Chain Phase====
====Reference====
* https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
''version'': 1
</div>
</div>
----
===Suspicious cloud user activities===
Detect and investigate suspicious activities by users and roles in your cloud environments.
* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Change
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1580/ T1580], [https://attack.mitre.org/techniques/T1078.004/ T1078.004], [https://attack.mitre.org/techniques/T1078/ T1078]
* '''Last Updated''': 2020-09-04
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Aws_iam_accessdenied_discovery_events|AWS IAM AccessDenied Discovery Events]]
* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_arn|AWS Investigate User Activities By ARN]]
* [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_infrastructure_api_calls|Abnormally High Number Of Cloud Infrastructure API Calls]]
* [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_security_group_api_calls|Abnormally High Number Of Cloud Security Group API Calls]]
* [[Documentation:ESSOC:detections:Detections#Baseline_of_cloud_infrastructure_api_calls_per_user|Baseline Of Cloud Infrastructure API Calls Per User]]
* [[Documentation:ESSOC:detections:Detections#Baseline_of_cloud_security_group_api_calls_per_user|Baseline Of Cloud Security Group API Calls Per User]]
* [[Documentation:ESSOC:detections:Detections#Cloud_api_calls_from_previously_unseen_user_roles|Cloud API Calls From Previously Unseen User Roles]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_api_calls_per_user_role_-_initial|Previously Seen Cloud API Calls Per User Role - Initial]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_api_calls_per_user_role_-_update|Previously Seen Cloud API Calls Per User Role - Update]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1580
| Cloud Infrastructure Discovery
| Discovery
|-
| T1078.004
| Cloud Accounts
| Defense Evasion, Persistence, Privilege Escalation, Initial Access
|-
| T1078
| Valid Accounts
| Defense Evasion, Persistence, Privilege Escalation, Initial Access
|}
====Kill Chain Phase====
* Actions on Objectives
* Reconnaissance
====Reference====
* https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
* https://redlock.io/blog/cryptojacking-tesla
''version'': 1
</div>
</div>
----
===Suspicious gcp storage activities===
Use the searches in this Analytic Story to monitor your GCP Storage buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open storage buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1530/ T1530]
* '''Last Updated''': 2020-08-05
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Detect_gcp_storage_access_from_a_new_ip|Detect GCP Storage access from a new IP]]
* [[Documentation:ESSOC:detections:Detections#Detect_new_open_gcp_storage_buckets|Detect New Open GCP Storage Buckets]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1530
| Data from Cloud Storage Object
| Collection
|}
====Kill Chain Phase====
* Actions on Objectives
====Reference====
* https://cloud.google.com/blog/product/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security
* https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/
''version'': 1
</div>
</div>
----
==Lateral Movement==
===Printnightmare cve-2021-34527===
The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-34527 previously known as (CVE-2021-1675), to gain privilege escalation on the vulnerable machine.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547.012/ T1547.012], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1068/ T1068]
* '''Last Updated''': 2021-07-01
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Print_spooler_adding_a_printer_driver|Print Spooler Adding A Printer Driver]]
* [[Documentation:ESSOC:detections:Detections#Print_spooler_failed_to_load_a_plug-in|Print Spooler Failed to Load a Plug-in]]
* [[Documentation:ESSOC:detections:Detections#Rundll32_with_no_command_line_arguments_with_network|Rundll32 with no Command Line Arguments with Network]]
* [[Documentation:ESSOC:detections:Detections#Spoolsv_spawning_rundll32|Spoolsv Spawning Rundll32]]
* [[Documentation:ESSOC:detections:Detections#Spoolsv_suspicious_loaded_modules|Spoolsv Suspicious Loaded Modules]]
* [[Documentation:ESSOC:detections:Detections#Spoolsv_suspicious_process_access|Spoolsv Suspicious Process Access]]
* [[Documentation:ESSOC:detections:Detections#Spoolsv_writing_a_dll|Spoolsv Writing a DLL]]
* [[Documentation:ESSOC:detections:Detections#Spoolsv_writing_a_dll_-_sysmon|Spoolsv Writing a DLL - Sysmon]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_no_command_line_arguments|Suspicious Rundll32 no Command Line Arguments]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1547.012
| Print Processors
| Persistence, Privilege Escalation
|-
| T1218.011
| Rundll32
| Defense Evasion
|-
| T1068
| Exploitation for Privilege Escalation
| Privilege Escalation
|}
====Kill Chain Phase====
* Actions on Objectives
* Exploitation
====Reference====
* https://github.com/cube0x0/CVE-2021-1675/
* https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
* https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
* https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
''version'': 1
</div>
</div>
----
==Malware==
===Clop ransomware===
Leverage searches that allow you to detect and investigate unusual activities that might relate to the Clop ransomware, including looking for file writes associated with Clope, encrypting network shares, deleting and resizing shadow volume storage, registry key modification, deleting of security logs, and more.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1003.002/ T1003.002], [https://attack.mitre.org/techniques/T1489/ T1489], [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
* '''Last Updated''': 2021-03-17
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Clop_common_exec_parameter|Clop Common Exec Parameter]]
* [[Documentation:ESSOC:detections:Detections#Clop_ransomware_known_service_name|Clop Ransomware Known Service Name]]
* [[Documentation:ESSOC:detections:Detections#Common_ransomware_extensions|Common Ransomware Extensions]]
* [[Documentation:ESSOC:detections:Detections#Common_ransomware_notes|Common Ransomware Notes]]
* [[Documentation:ESSOC:detections:Detections#Create_service_in_suspicious_file_path|Create Service In Suspicious File Path]]
* [[Documentation:ESSOC:detections:Detections#Deleting_shadow_copies|Deleting Shadow Copies]]
* [[Documentation:ESSOC:detections:Detections#High_file_deletion_frequency|High File Deletion Frequency]]
* [[Documentation:ESSOC:detections:Detections#High_process_termination_frequency|High Process Termination Frequency]]
* [[Documentation:ESSOC:detections:Detections#Process_deleting_its_process_file_path|Process Deleting Its Process File Path]]
* [[Documentation:ESSOC:detections:Detections#Ransomware_notes_bulk_creation|Ransomware Notes bulk creation]]
* [[Documentation:ESSOC:detections:Detections#Resize_shadowstorage_volume|Resize ShadowStorage volume]]
* [[Documentation:ESSOC:detections:Detections#Resize_shadowstorage_volume|Resize Shadowstorage Volume]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_event_log_service_behavior|Suspicious Event Log Service Behavior]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_wevtutil_usage|Suspicious wevtutil Usage]]
* [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_clear_logs|WevtUtil Usage To Clear Logs]]
* [[Documentation:ESSOC:detections:Detections#Windows_event_log_cleared|Windows Event Log Cleared]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1204
| User Execution
| Execution
|-
| T1543
| Create or Modify System Process
| Persistence, Privilege Escalation
|-
| T1485
| Data Destruction
| Impact
|-
| T1569.002
| Service Execution
| Execution
|-
| T1490
| Inhibit System Recovery
| Impact
|-
| T1486
| Data Encrypted for Impact
| Impact
|-
| T1003.002
| Security Account Manager
| Credential Access
|-
| T1489
| Service Stop
| Impact
|-
| T1070.001
| Clear Windows Event Logs
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
* Exploitation
* Obfuscation
* Privilege Escalation
====Reference====
* https://www.hhs.gov/sites/default/files/analyst-note-cl0p-tlp-white.pdf
* https://securityaffairs.co/wordpress/115250/data-breach/qualys-clop-ransomware.html
* https://www.darkreading.com/attacks-breaches/qualys-is-the-latest-victim-of-accellion-data-breach/d/d-id/1340323
''version'': 1
</div>
</div>
----
===Coldroot macos rat===
Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Network_Traffic
* '''ATT&CK''':
* '''Last Updated''': 2019-01-09
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Investigate_network_traffic_from_src_ip|Investigate Network Traffic From src ip]]
* [[Documentation:ESSOC:detections:Detections#Processes_tapping_keyboard_events|Processes Tapping Keyboard Events]]
====Kill Chain Phase====
* Command and Control
====Reference====
* https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/
* https://objective-see.com/blog/blog_0x2A.html
* https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/
''version'': 1
</div>
</div>
----
===Dhs report ta18-074a===
Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint, Network_Traffic
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136.001/ T1136.001], [https://attack.mitre.org/techniques/T1071.002/ T1071.002], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1059.001/ T1059.001], [https://attack.mitre.org/techniques/T1562.004/ T1562.004], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1204.002/ T1204.002], [https://attack.mitre.org/techniques/T1112/ T1112]
* '''Last Updated''': 2020-01-22
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Baseline_of_smb_traffic_-_mltk|Baseline of SMB Traffic - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Create_local_admin_accounts_using_net_exe|Create local admin accounts using net exe]]
* [[Documentation:ESSOC:detections:Detections#Detect_new_local_admin_account|Detect New Local Admin account]]
* [[Documentation:ESSOC:detections:Detections#Detect_outbound_smb_traffic|Detect Outbound SMB Traffic]]
* [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]
* [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_file_activity|Get Process File Activity]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
* [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_execution_policy_bypass|Malicious PowerShell Process - Execution Policy Bypass]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_command_line_arguments|Previously seen command line arguments]]
* [[Documentation:ESSOC:detections:Detections#Processes_launching_netsh|Processes launching netsh]]
* [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
* [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike|SMB Traffic Spike]]
* [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike_-_mltk|SMB Traffic Spike - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]
* [[Documentation:ESSOC:detections:Detections#Scheduled_task_deleted_or_created_via_cmd|Scheduled Task Deleted Or Created via CMD]]
* [[Documentation:ESSOC:detections:Detections#Single_letter_process_on_endpoint|Single Letter Process On Endpoint]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_reg_exe_process|Suspicious Reg exe Process]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1136.001
| Local Account
| Persistence
|-
| T1071.002
| File Transfer Protocols
| Command And Control
|-
| T1021.002
| SMB/Windows Admin Shares
| Lateral Movement
|-
| T1569.002
| Service Execution
| Execution
|-
| T1059.001
| PowerShell
| Execution
|-
| T1562.004
| Disable or Modify System Firewall
| Defense Evasion
|-
| T1547.001
| Registry Run Keys / Startup Folder
| Persistence, Privilege Escalation
|-
| T1543.003
| Windows Service
| Persistence, Privilege Escalation
|-
| T1053.005
| Scheduled Task
| Execution, Persistence, Privilege Escalation
|-
| T1204.002
| Malicious File
| Execution
|-
| T1112
| Modify Registry
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
* Command and Control
* Execution
* Exploitation
* Installation
* Lateral Movement
====Reference====
* https://www.us-cert.gov/ncas/alerts/TA18-074A
''version'': 2
</div>
</div>
----
===Darkside ransomware===
Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.002/ T1003.002], [https://attack.mitre.org/techniques/T1197/ T1197], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1218.003/ T1218.003], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1003.001/ T1003.001], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1548.002/ T1548.002]
* '''Last Updated''': 2021-05-12
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Attempted_credential_dump_from_registry_via_reg_exe|Attempted Credential Dump From Registry via Reg exe]]
* [[Documentation:ESSOC:detections:Detections#Bitsadmin_download_file|BITSAdmin Download File]]
* [[Documentation:ESSOC:detections:Detections#Cmlua_or_cmstplua_uac_bypass|CMLUA Or CMSTPLUA UAC Bypass]]
* [[Documentation:ESSOC:detections:Detections#Certutil_download_with_urlcache_and_split_arguments|CertUtil Download With URLCache and Split Arguments]]
* [[Documentation:ESSOC:detections:Detections#Certutil_download_with_verifyctl_and_split_arguments|CertUtil Download With VerifyCtl and Split Arguments]]
* [[Documentation:ESSOC:detections:Detections#Cobalt_strike_named_pipes|Cobalt Strike Named Pipes]]
* [[Documentation:ESSOC:detections:Detections#Delete_shadowcopy_with_powershell|Delete ShadowCopy With PowerShell]]
* [[Documentation:ESSOC:detections:Detections#Detect_mimikatz_using_loaded_images|Detect Mimikatz Using Loaded Images]]
* [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]
* [[Documentation:ESSOC:detections:Detections#Detect_rclone_command-line_usage|Detect RClone Command-Line Usage]]
* [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]
* [[Documentation:ESSOC:detections:Detections#Detect_renamed_rclone|Detect Renamed RClone]]
* [[Documentation:ESSOC:detections:Detections#Extract_sam_from_registry|Extract SAM from Registry]]
* [[Documentation:ESSOC:detections:Detections#Ransomware_notes_bulk_creation|Ransomware Notes bulk creation]]
* [[Documentation:ESSOC:detections:Detections#Slui_runas_elevated|SLUI RunAs Elevated]]
* [[Documentation:ESSOC:detections:Detections#Slui_spawning_a_process|SLUI Spawning a Process]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1003.002
| Security Account Manager
| Credential Access
|-
| T1197
| BITS Jobs
| Defense Evasion, Persistence
|-
| T1105
| Ingress Tool Transfer
| Command And Control
|-
| T1218.003
| CMSTP
| Defense Evasion
|-
| T1055
| Process Injection
| Defense Evasion, Privilege Escalation
|-
| T1490
| Inhibit System Recovery
| Impact
|-
| T1003.001
| LSASS Memory
| Credential Access
|-
| T1021.002
| SMB/Windows Admin Shares
| Lateral Movement
|-
| T1020
| Automated Exfiltration
| Exfiltration
|-
| T1569.002
| Service Execution
| Execution
|-
| T1486
| Data Encrypted for Impact
| Impact
|-
| T1548.002
| Bypass User Account Control
| Privilege Escalation, Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
* Execution
* Exfiltration
* Exploitation
* Lateral Movement
* Obfuscation
====Reference====
* https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/
* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
''version'': 1
</div>
</div>
----
===Dynamic dns===
Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint, Network_Resolution, Network_Traffic
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1071.004/ T1071.004], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1095/ T1095], [https://attack.mitre.org/techniques/T1041/ T1041], [https://attack.mitre.org/techniques/T1189/ T1189], [https://attack.mitre.org/techniques/T1537/ T1537], [https://attack.mitre.org/techniques/T1114.001/ T1114.001], [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114.003/ T1114.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
* '''Last Updated''': 2018-09-06
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Dns_exfiltration_using_nslookup_app|DNS Exfiltration Using Nslookup App]]
* [[Documentation:ESSOC:detections:Detections#Detect_hosts_connecting_to_dynamic_domain_providers|Detect hosts connecting to dynamic domain providers]]
* [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_nslookup_app|Excessive Usage of NSLOOKUP App]]
* [[Documentation:ESSOC:detections:Detections#Get_dns_server_history_for_a_host|Get DNS Server History for a host]]
* [[Documentation:ESSOC:detections:Detections#Get_dns_traffic_ratio|Get DNS traffic ratio]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_process_responsible_for_the_dns_traffic|Get Process Responsible For The DNS Traffic]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1048
| Exfiltration Over Alternative Protocol
| Exfiltration
|-
| T1071.004
| DNS
| Command And Control
|-
| T1048.003
| Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
| Exfiltration
|-
| T1095
| Non-Application Layer Protocol
| Command And Control
|-
| T1041
| Exfiltration Over C2 Channel
| Exfiltration
|-
| T1189
| Drive-by Compromise
| Initial Access
|-
| T1537
| Transfer Data to Cloud Account
| Exfiltration
|-
| T1114.001
| Local Email Collection
| Collection
|-
| T1114
| Email Collection
| Collection
|-
| T1114.003
| Email Forwarding Rule
| Collection
|-
| T1071.001
| Web Protocols
| Command And Control
|}
====Kill Chain Phase====
* Actions on Objectives
* Command and Control
* Exploitation
====Reference====
* https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html
* https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/
* http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/
* https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html
''version'': 2
</div>
</div>
----
===Emotet malware dhs report ta18-201a ===
Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Email, Endpoint, Network_Traffic
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1072/ T1072], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
* '''Last Updated''': 2020-01-27
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Baseline_of_smb_traffic_-_mltk|Baseline of SMB Traffic - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Detect_rare_executables|Detect Rare Executables]]
* [[Documentation:ESSOC:detections:Detections#Detect_use_of_cmd_exe_to_launch_script_interpreters|Detect Use of cmd exe to Launch Script Interpreters]]
* [[Documentation:ESSOC:detections:Detections#Detection_of_tools_built_by_nirsoft|Detection of tools built by NirSoft]]
* [[Documentation:ESSOC:detections:Detections#Email_attachments_with_lots_of_spaces|Email Attachments With Lots Of Spaces]]
* [[Documentation:ESSOC:detections:Detections#Get_history_of_email_sources|Get History Of Email Sources]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
* [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
* [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike|SMB Traffic Spike]]
* [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike_-_mltk|SMB Traffic Spike - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_email_attachment_extensions|Suspicious Email Attachment Extensions]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1059.003
| Windows Command Shell
| Execution
|-
| T1072
| Software Deployment Tools
| Execution, Lateral Movement
|-
| T1547.001
| Registry Run Keys / Startup Folder
| Persistence, Privilege Escalation
|-
| T1021.002
| SMB/Windows Admin Shares
| Lateral Movement
|-
| T1566.001
| Spearphishing Attachment
| Initial Access
|}
====Kill Chain Phase====
* Actions on Objectives
* Command and Control
* Delivery
* Exploitation
* Installation
====Reference====
* https://www.us-cert.gov/ncas/alerts/TA18-201A
* https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf
* https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html
''version'': 1
</div>
</div>
----
===Hidden cobra malware===
Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Authentication, Email, Endpoint, Network_Resolution, Network_Traffic
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070.005/ T1070.005], [https://attack.mitre.org/techniques/T1071.004/ T1071.004], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1071.002/ T1071.002], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1021.002/ T1021.002]
* '''Last Updated''': 2020-01-22
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Baseline_of_dns_query_length_-_mltk|Baseline of DNS Query Length - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Baseline_of_smb_traffic_-_mltk|Baseline of SMB Traffic - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Create_or_delete_windows_shares_using_net_exe|Create or delete windows shares using net exe]]
* [[Documentation:ESSOC:detections:Detections#Dns_query_length_outliers_-_mltk|DNS Query Length Outliers - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Dns_query_length_with_high_standard_deviation|DNS Query Length With High Standard Deviation]]
* [[Documentation:ESSOC:detections:Detections#Detect_outbound_smb_traffic|Detect Outbound SMB Traffic]]
* [[Documentation:ESSOC:detections:Detections#Get_dns_server_history_for_a_host|Get DNS Server History for a host]]
* [[Documentation:ESSOC:detections:Detections#Get_dns_traffic_ratio|Get DNS traffic ratio]]
* [[Documentation:ESSOC:detections:Detections#Get_history_of_email_sources|Get History Of Email Sources]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_outbound_emails_to_hidden_cobra_threat_actors|Get Outbound Emails to Hidden Cobra Threat Actors]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
* [[Documentation:ESSOC:detections:Detections#Get_process_responsible_for_the_dns_traffic|Get Process Responsible For The DNS Traffic]]
* [[Documentation:ESSOC:detections:Detections#Investigate_successful_remote_desktop_authentications|Investigate Successful Remote Desktop Authentications]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_command_line_arguments|Previously seen command line arguments]]
* [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_traffic|Remote Desktop Network Traffic]]
* [[Documentation:ESSOC:detections:Detections#Remote_desktop_process_running_on_system|Remote Desktop Process Running On System]]
* [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike|SMB Traffic Spike]]
* [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike_-_mltk|SMB Traffic Spike - MLTK]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1070.005
| Network Share Connection Removal
| Defense Evasion
|-
| T1071.004
| DNS
| Command And Control
|-
| T1048.003
| Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
| Exfiltration
|-
| T1071.002
| File Transfer Protocols
| Command And Control
|-
| T1021.001
| Remote Desktop Protocol
| Lateral Movement
|-
| T1021.002
| SMB/Windows Admin Shares
| Lateral Movement
|}
====Kill Chain Phase====
* Actions on Objectives
* Command and Control
====Reference====
* https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity
* https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf
''version'': 2
</div>
</div>
----
===Icedid===
Leverage searches that allow you to detect and investigate unusual activities that might relate to the IcedID banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087.002/ T1087.002], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1204.002/ T1204.002], [https://attack.mitre.org/techniques/T1548.002/ T1548.002], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1560.001/ T1560.001], [https://attack.mitre.org/techniques/T1218.005/ T1218.005], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1566.001/ T1566.001], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1005/ T1005], [https://attack.mitre.org/techniques/T1218.010/ T1218.010], [https://attack.mitre.org/techniques/T1590.005/ T1590.005], [https://attack.mitre.org/techniques/T1027/ T1027], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1021.002/ T1021.002]
* '''Last Updated''': 2021-07-29
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Account_discovery_with_net_app|Account Discovery With Net App]]
* [[Documentation:ESSOC:detections:Detections#Chcp_command_execution|CHCP Command Execution]]
* [[Documentation:ESSOC:detections:Detections#Create_remote_thread_in_shell_application|Create Remote Thread In Shell Application]]
* [[Documentation:ESSOC:detections:Detections#Drop_icedid_license_dat|Drop IcedID License dat]]
* [[Documentation:ESSOC:detections:Detections#Eventvwr_uac_bypass|Eventvwr UAC Bypass]]
* [[Documentation:ESSOC:detections:Detections#Fodhelper_uac_bypass|FodHelper UAC Bypass]]
* [[Documentation:ESSOC:detections:Detections#Icedid_exfiltrated_archived_file_creation|IcedID Exfiltrated Archived File Creation]]
* [[Documentation:ESSOC:detections:Detections#Mshta_spawning_rundll32_or_regsvr32_process|Mshta spawning Rundll32 OR Regsvr32 Process]]
* [[Documentation:ESSOC:detections:Detections#Nltest_domain_trust_discovery|NLTest Domain Trust Discovery]]
* [[Documentation:ESSOC:detections:Detections#Office_application_spawn_regsvr32_process|Office Application Spawn Regsvr32 process]]
* [[Documentation:ESSOC:detections:Detections#Office_application_spawn_rundll32_process|Office Application Spawn rundll32 process]]
* [[Documentation:ESSOC:detections:Detections#Office_document_executing_macro_code|Office Document Executing Macro Code]]
* [[Documentation:ESSOC:detections:Detections#Office_product_spawning_mshta|Office Product Spawning MSHTA]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_command_line_arguments|Previously seen command line arguments]]
* [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
* [[Documentation:ESSOC:detections:Detections#Rundll32_create_remote_thread_to_a_process|Rundll32 Create Remote Thread To A Process]]
* [[Documentation:ESSOC:detections:Detections#Rundll32_createremotethread_in_browser|Rundll32 CreateRemoteThread In Browser]]
* [[Documentation:ESSOC:detections:Detections#Rundll32_dnsquery|Rundll32 DNSQuery]]
* [[Documentation:ESSOC:detections:Detections#Rundll32_process_creating_exe_dll_files|Rundll32 Process Creating Exe Dll Files]]
* [[Documentation:ESSOC:detections:Detections#Schedule_task_with_rundll32_command_trigger|Schedule Task with Rundll32 Command Trigger]]
* [[Documentation:ESSOC:detections:Detections#Sqlite_module_in_temp_folder|Sqlite Module In Temp Folder]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_icedid_regsvr32_cmdline|Suspicious IcedID Regsvr32 Cmdline]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_icedid_rundll32_cmdline|Suspicious IcedID Rundll32 Cmdline]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_plugininit|Suspicious Rundll32 PluginInit]]
* [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_within_public_path|WinEvent Scheduled Task Created Within Public Path]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1087.002
| Domain Account
| Discovery
|-
| T1562.001
| Disable or Modify Tools
| Defense Evasion
|-
| T1059
| Command and Scripting Interpreter
| Execution
|-
| T1055
| Process Injection
| Defense Evasion, Privilege Escalation
|-
| T1204.002
| Malicious File
| Execution
|-
| T1548.002
| Bypass User Account Control
| Privilege Escalation, Defense Evasion
|-
| T1112
| Modify Registry
| Defense Evasion
|-
| T1560.001
| Archive via Utility
| Collection
|-
| T1218.005
| Mshta
| Defense Evasion
|-
| T1482
| Domain Trust Discovery
| Discovery
|-
| T1566.001
| Spearphishing Attachment
| Initial Access
|-
| T1547.001
| Registry Run Keys / Startup Folder
| Persistence, Privilege Escalation
|-
| T1218.011
| Rundll32
| Defense Evasion
|-
| T1053
| Scheduled Task/Job
| Execution, Persistence, Privilege Escalation
|-
| T1005
| Data from Local System
| Collection
|-
| T1218.010
| Regsvr32
| Defense Evasion
|-
| T1590.005
| IP Addresses
| Reconnaissance
|-
| T1027
| Obfuscated Files or Information
| Defense Evasion
|-
| T1053.005
| Scheduled Task
| Execution, Persistence, Privilege Escalation
|-
| T1021.002
| SMB/Windows Admin Shares
| Lateral Movement
|}
====Kill Chain Phase====
* Actions on Objectives
* Exploitation
* Privilege Escalation
* Reconnaissance
====Reference====
* https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/
* https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/
''version'': 1
</div>
</div>
----
===Orangeworm attack group===
Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Email, Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1106/ T1106], [https://attack.mitre.org/techniques/T1569/ T1569], [https://attack.mitre.org/techniques/T1574.011/ T1574.011], [https://attack.mitre.org/techniques/T1543.003/ T1543.003]
* '''Last Updated''': 2020-01-22
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#First_time_seen_running_windows_service|First Time Seen Running Windows Service]]
* [[Documentation:ESSOC:detections:Detections#Get_history_of_email_sources|Get History Of Email Sources]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_running_windows_services_-_initial|Previously Seen Running Windows Services - Initial]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_running_windows_services_-_update|Previously Seen Running Windows Services - Update]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_command_line_arguments|Previously seen command line arguments]]
* [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1569.002
| Service Execution
| Execution
|-
| T1055
| Process Injection
| Defense Evasion, Privilege Escalation
|-
| T1106
| Native API
| Execution
|-
| T1569
| System Services
| Execution
|-
| T1574.011
| Services Registry Permissions Weakness
| Persistence, Privilege Escalation, Defense Evasion
|-
| T1543.003
| Windows Service
| Persistence, Privilege Escalation
|}
====Kill Chain Phase====
* Actions on Objectives
* Installation
====Reference====
* https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia
* https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/
''version'': 2
</div>
</div>
----
===Ransomware===
Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Email, Endpoint, Network_Traffic
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560.001/ T1560.001], [https://attack.mitre.org/techniques/T1562.007/ T1562.007], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1489/ T1489], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1218.003/ T1218.003], [https://attack.mitre.org/techniques/T1070.004/ T1070.004], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1087.002/ T1087.002], [https://attack.mitre.org/techniques/T1087.001/ T1087.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1069.002/ T1069.002], [https://attack.mitre.org/techniques/T1069.001/ T1069.001], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1070.001/ T1070.001], [https://attack.mitre.org/techniques/T1531/ T1531], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1059.005/ T1059.005], [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1222/ T1222], [https://attack.mitre.org/techniques/T1491/ T1491], [https://attack.mitre.org/techniques/T1574.002/ T1574.002], [https://attack.mitre.org/techniques/T1027.005/ T1027.005], [https://attack.mitre.org/techniques/T1546.015/ T1546.015], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1592/ T1592], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1218.007/ T1218.007]
* '''Last Updated''': 2020-02-04
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#7zip_commandline_to_smb_share_path|7zip CommandLine To SMB Share Path]]
* [[Documentation:ESSOC:detections:Detections#Allow_file_and_printing_sharing_in_firewall|Allow File And Printing Sharing In Firewall]]
* [[Documentation:ESSOC:detections:Detections#Allow_network_discovery_in_firewall|Allow Network Discovery In Firewall]]
* [[Documentation:ESSOC:detections:Detections#Allow_operation_with_consent_admin|Allow Operation with Consent Admin]]
* [[Documentation:ESSOC:detections:Detections#Attempt_to_disable_services|Attempt To Disable Services]]
* [[Documentation:ESSOC:detections:Detections#Attempt_to_delete_services|Attempt To delete Services]]
* [[Documentation:ESSOC:detections:Detections#Bcdedit_failure_recovery_modification|BCDEdit Failure Recovery Modification]]
* [[Documentation:ESSOC:detections:Detections#Baseline_of_command_line_length_-_mltk|Baseline of Command Line Length - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Baseline_of_smb_traffic_-_mltk|Baseline of SMB Traffic - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Cmlua_or_cmstplua_uac_bypass|CMLUA Or CMSTPLUA UAC Bypass]]
* [[Documentation:ESSOC:detections:Detections#Clear_unallocated_sector_using_cipher_app|Clear Unallocated Sector Using Cipher App]]
* [[Documentation:ESSOC:detections:Detections#Common_ransomware_extensions|Common Ransomware Extensions]]
* [[Documentation:ESSOC:detections:Detections#Common_ransomware_notes|Common Ransomware Notes]]
* [[Documentation:ESSOC:detections:Detections#Conti_common_exec_parameter|Conti Common Exec parameter]]
* [[Documentation:ESSOC:detections:Detections#Delete_a_net_user|Delete A Net User]]
* [[Documentation:ESSOC:detections:Detections#Delete_shadowcopy_with_powershell|Delete ShadowCopy With PowerShell]]
* [[Documentation:ESSOC:detections:Detections#Deleting_shadow_copies|Deleting Shadow Copies]]
* [[Documentation:ESSOC:detections:Detections#Detect_rclone_command-line_usage|Detect RClone Command-Line Usage]]
* [[Documentation:ESSOC:detections:Detections#Detect_renamed_rclone|Detect Renamed RClone]]
* [[Documentation:ESSOC:detections:Detections#Detect_sharphound_command-line_arguments|Detect SharpHound Command-Line Arguments]]
* [[Documentation:ESSOC:detections:Detections#Detect_sharphound_file_modifications|Detect SharpHound File Modifications]]
* [[Documentation:ESSOC:detections:Detections#Detect_sharphound_usage|Detect SharpHound Usage]]
* [[Documentation:ESSOC:detections:Detections#Disable_amsi_through_registry|Disable AMSI Through Registry]]
* [[Documentation:ESSOC:detections:Detections#Disable_etw_through_registry|Disable ETW Through Registry]]
* [[Documentation:ESSOC:detections:Detections#Disable_logs_using_wevtutil|Disable Logs Using WevtUtil]]
* [[Documentation:ESSOC:detections:Detections#Disable_net_user_account|Disable Net User Account]]
* [[Documentation:ESSOC:detections:Detections#Disable_windows_behavior_monitoring|Disable Windows Behavior Monitoring]]
* [[Documentation:ESSOC:detections:Detections#Excessive_service_stop_attempt|Excessive Service Stop Attempt]]
* [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_net_app|Excessive Usage Of Net App]]
* [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_sc_service_utility|Excessive Usage Of SC Service Utility]]
* [[Documentation:ESSOC:detections:Detections#Execute_javascript_with_jscript_com_clsid|Execute Javascript With Jscript COM CLSID]]
* [[Documentation:ESSOC:detections:Detections#Fsutil_zeroing_file|Fsutil Zeroing File]]
* [[Documentation:ESSOC:detections:Detections#Get_backup_logs_for_endpoint|Get Backup Logs For Endpoint]]
* [[Documentation:ESSOC:detections:Detections#Get_history_of_email_sources|Get History Of Email Sources]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
* [[Documentation:ESSOC:detections:Detections#Get_sysmon_wmi_activity_for_host|Get Sysmon WMI Activity for Host]]
* [[Documentation:ESSOC:detections:Detections#Icacls_grant_command|ICACLS Grant Command]]
* [[Documentation:ESSOC:detections:Detections#Known_services_killed_by_ransomware|Known Services Killed by Ransomware]]
* [[Documentation:ESSOC:detections:Detections#Modification_of_wallpaper|Modification Of Wallpaper]]
* [[Documentation:ESSOC:detections:Detections#Msmpeng_application_dll_side_loading|Msmpeng Application DLL Side Loading]]
* [[Documentation:ESSOC:detections:Detections#Permission_modification_using_takeown_app|Permission Modification using Takeown App]]
* [[Documentation:ESSOC:detections:Detections#Powershell_disable_security_monitoring|Powershell Disable Security Monitoring]]
* [[Documentation:ESSOC:detections:Detections#Powershell_enable_smb1protocol_feature|Powershell Enable SMB1Protocol Feature]]
* [[Documentation:ESSOC:detections:Detections#Powershell_execute_com_object|Powershell Execute COM Object]]
* [[Documentation:ESSOC:detections:Detections#Prevent_automatic_repair_mode_using_bcdedit|Prevent Automatic Repair Mode using Bcdedit]]
* [[Documentation:ESSOC:detections:Detections#Prohibited_network_traffic_allowed|Prohibited Network Traffic Allowed]]
* [[Documentation:ESSOC:detections:Detections#Recon_avproduct_through_pwh_or_wmi|Recon AVProduct Through Pwh or WMI]]
* [[Documentation:ESSOC:detections:Detections#Recursive_delete_of_directory_in_batch_cmd|Recursive Delete of Directory In Batch CMD]]
* [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
* [[Documentation:ESSOC:detections:Detections#Remote_process_instantiation_via_wmi|Remote Process Instantiation via WMI]]
* [[Documentation:ESSOC:detections:Detections#Resize_shadowstorage_volume|Resize Shadowstorage Volume]]
* [[Documentation:ESSOC:detections:Detections#Revil_common_exec_parameter|Revil Common Exec Parameter]]
* [[Documentation:ESSOC:detections:Detections#Revil_registry_entry|Revil Registry Entry]]
* [[Documentation:ESSOC:detections:Detections#Rundll32_lockworkstation|Rundll32 LockWorkStation]]
* [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike|SMB Traffic Spike]]
* [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike_-_mltk|SMB Traffic Spike - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Schtasks_used_for_forcing_a_reboot|Schtasks used for forcing a reboot]]
* [[Documentation:ESSOC:detections:Detections#Spike_in_file_writes|Spike in File Writes]]
* [[Documentation:ESSOC:detections:Detections#Start_up_during_safe_mode_boot|Start Up During Safe Mode Boot]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_event_log_service_behavior|Suspicious Event Log Service Behavior]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_scheduled_task_from_public_directory|Suspicious Scheduled Task from Public Directory]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_wevtutil_usage|Suspicious wevtutil Usage]]
* [[Documentation:ESSOC:detections:Detections#System_processes_run_from_unexpected_locations|System Processes Run From Unexpected Locations]]
* [[Documentation:ESSOC:detections:Detections#Tor_traffic|TOR Traffic]]
* [[Documentation:ESSOC:detections:Detections#Uac_bypass_with_colorui_com_object|UAC Bypass With Colorui COM Object]]
* [[Documentation:ESSOC:detections:Detections#Usn_journal_deletion|USN Journal Deletion]]
* [[Documentation:ESSOC:detections:Detections#Uninstall_app_using_msiexec|Uninstall App Using MsiExec]]
* [[Documentation:ESSOC:detections:Detections#Unusually_long_command_line|Unusually Long Command Line]]
* [[Documentation:ESSOC:detections:Detections#Unusually_long_command_line_-_mltk|Unusually Long Command Line - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Wbadmin_delete_system_backups|WBAdmin Delete System Backups]]
* [[Documentation:ESSOC:detections:Detections#Wbemprox_com_object_execution|Wbemprox COM Object Execution]]
* [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_clear_logs|WevtUtil Usage To Clear Logs]]
* [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_disable_logs|Wevtutil Usage To Disable Logs]]
* [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_within_public_path|WinEvent Scheduled Task Created Within Public Path]]
* [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_to_spawn_shell|WinEvent Scheduled Task Created to Spawn Shell]]
* [[Documentation:ESSOC:detections:Detections#Windows_event_log_cleared|Windows Event Log Cleared]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1560.001
| Archive via Utility
| Collection
|-
| T1562.007
| Disable or Modify Cloud Firewall
| Defense Evasion
|-
| T1548
| Abuse Elevation Control Mechanism
| Privilege Escalation, Defense Evasion
|-
| T1489
| Service Stop
| Impact
|-
| T1490
| Inhibit System Recovery
| Impact
|-
| T1218.003
| CMSTP
| Defense Evasion
|-
| T1070.004
| File Deletion
| Defense Evasion
|-
| T1485
| Data Destruction
| Impact
|-
| T1204
| User Execution
| Execution
|-
| T1020
| Automated Exfiltration
| Exfiltration
|-
| T1087.002
| Domain Account
| Discovery
|-
| T1087.001
| Local Account
| Discovery
|-
| T1482
| Domain Trust Discovery
| Discovery
|-
| T1069.002
| Domain Groups
| Discovery
|-
| T1069.001
| Local Groups
| Discovery
|-
| T1562.001
| Disable or Modify Tools
| Defense Evasion
|-
| T1070.001
| Clear Windows Event Logs
| Defense Evasion
|-
| T1531
| Account Access Removal
| Impact
|-
| T1569.002
| Service Execution
| Execution
|-
| T1059.005
| Visual Basic
| Execution
|-
| T1070
| Indicator Removal on Host
| Defense Evasion
|-
| T1222
| File and Directory Permissions Modification
| Defense Evasion
|-
| T1491
| Defacement
| Impact
|-
| T1574.002
| DLL Side-Loading
| Persistence, Privilege Escalation, Defense Evasion
|-
| T1027.005
| Indicator Removal from Tools
| Defense Evasion
|-
| T1546.015
| Component Object Model Hijacking
| Privilege Escalation, Persistence
|-
| T1048
| Exfiltration Over Alternative Protocol
| Exfiltration
|-
| T1592
| Gather Victim Host Information
| Reconnaissance
|-
| T1547.001
| Registry Run Keys / Startup Folder
| Persistence, Privilege Escalation
|-
| T1047
| Windows Management Instrumentation
| Execution
|-
| T1112
| Modify Registry
| Defense Evasion
|-
| T1218.011
| Rundll32
| Defense Evasion
|-
| T1021.002
| SMB/Windows Admin Shares
| Lateral Movement
|-
| T1053.005
| Scheduled Task
| Execution, Persistence, Privilege Escalation
|-
| T1036.003
| Rename System Utilities
| Defense Evasion
|-
| T1071.001
| Web Protocols
| Command And Control
|-
| T1218.007
| Msiexec
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
* Command and Control
* Delivery
* Exfiltration
* Exploitation
* Privilege Escalation
* Reconnaissance
====Reference====
* https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/
* https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html
''version'': 1
</div>
</div>
----
===Ransomware cloud===
Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features.
* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1486/ T1486]
* '''Last Updated''': 2020-10-27
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Aws_detect_users_creating_keys_with_encrypt_policy_without_mfa|AWS Detect Users creating keys with encrypt policy without MFA]]
* [[Documentation:ESSOC:detections:Detections#Aws_detect_users_with_kms_keys_performing_encryption_s3|AWS Detect Users with KMS keys performing encryption S3]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1486
| Data Encrypted for Impact
| Impact
|}
====Kill Chain Phase====
====Reference====
* https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
* https://github.com/d1vious/git-wild-hunt
* https://www.youtube.com/watch?v=PgzNib37g0M
''version'': 1
</div>
</div>
----
===Revil ransomware===
Leverage searches that allow you to detect and investigate unusual activities that might relate to the Revil ransomware, including looking for file writes associated with Revil, encrypting network shares, deleting shadow volume storage, registry key modification, deleting of security logs, and more.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.007/ T1562.007], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1491/ T1491], [https://attack.mitre.org/techniques/T1574.002/ T1574.002], [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1218.003/ T1218.003]
* '''Last Updated''': 2021-06-04
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Allow_network_discovery_in_firewall|Allow Network Discovery In Firewall]]
* [[Documentation:ESSOC:detections:Detections#Delete_shadowcopy_with_powershell|Delete ShadowCopy With PowerShell]]
* [[Documentation:ESSOC:detections:Detections#Disable_windows_behavior_monitoring|Disable Windows Behavior Monitoring]]
* [[Documentation:ESSOC:detections:Detections#Modification_of_wallpaper|Modification Of Wallpaper]]
* [[Documentation:ESSOC:detections:Detections#Msmpeng_application_dll_side_loading|Msmpeng Application DLL Side Loading]]
* [[Documentation:ESSOC:detections:Detections#Powershell_disable_security_monitoring|Powershell Disable Security Monitoring]]
* [[Documentation:ESSOC:detections:Detections#Revil_common_exec_parameter|Revil Common Exec Parameter]]
* [[Documentation:ESSOC:detections:Detections#Revil_registry_entry|Revil Registry Entry]]
* [[Documentation:ESSOC:detections:Detections#Wbemprox_com_object_execution|Wbemprox COM Object Execution]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1562.007
| Disable or Modify Cloud Firewall
| Defense Evasion
|-
| T1490
| Inhibit System Recovery
| Impact
|-
| T1562.001
| Disable or Modify Tools
| Defense Evasion
|-
| T1491
| Defacement
| Impact
|-
| T1574.002
| DLL Side-Loading
| Persistence, Privilege Escalation, Defense Evasion
|-
| T1204
| User Execution
| Execution
|-
| T1112
| Modify Registry
| Defense Evasion
|-
| T1218.003
| CMSTP
| Defense Evasion
|}
====Kill Chain Phase====
* Exploitation
====Reference====
* https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
* https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
''version'': 1
</div>
</div>
----
===Ryuk ransomware===
Leverage searches that allow you to detect and investigate unusual activities that might relate to the Ryuk ransomware, including looking for file writes associated with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, suspicious psexec use, and more.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint, Network_Traffic
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1489/ T1489]
* '''Last Updated''': 2020-11-06
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Bcdedit_failure_recovery_modification|BCDEdit Failure Recovery Modification]]
* [[Documentation:ESSOC:detections:Detections#Common_ransomware_extensions|Common Ransomware Extensions]]
* [[Documentation:ESSOC:detections:Detections#Common_ransomware_notes|Common Ransomware Notes]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Nltest_domain_trust_discovery|NLTest Domain Trust Discovery]]
* [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_bruteforce|Remote Desktop Network Bruteforce]]
* [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_traffic|Remote Desktop Network Traffic]]
* [[Documentation:ESSOC:detections:Detections#Ryuk_test_files_detected|Ryuk Test Files Detected]]
* [[Documentation:ESSOC:detections:Detections#Ryuk_wake_on_lan_command|Ryuk Wake on LAN Command]]
* [[Documentation:ESSOC:detections:Detections#Spike_in_file_writes|Spike in File Writes]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_scheduled_task_from_public_directory|Suspicious Scheduled Task from Public Directory]]
* [[Documentation:ESSOC:detections:Detections#Wbadmin_delete_system_backups|WBAdmin Delete System Backups]]
* [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_within_public_path|WinEvent Scheduled Task Created Within Public Path]]
* [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_to_spawn_shell|WinEvent Scheduled Task Created to Spawn Shell]]
* [[Documentation:ESSOC:detections:Detections#Windows_disableantispyware_registry|Windows DisableAntiSpyware Registry]]
* [[Documentation:ESSOC:detections:Detections#Windows_security_account_manager_stopped|Windows Security Account Manager Stopped]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1490
| Inhibit System Recovery
| Impact
|-
| T1485
| Data Destruction
| Impact
|-
| T1482
| Domain Trust Discovery
| Discovery
|-
| T1021.001
| Remote Desktop Protocol
| Lateral Movement
|-
| T1486
| Data Encrypted for Impact
| Impact
|-
| T1059.003
| Windows Command Shell
| Execution
|-
| T1053.005
| Scheduled Task
| Execution, Persistence, Privilege Escalation
|-
| T1562.001
| Disable or Modify Tools
| Defense Evasion
|-
| T1489
| Service Stop
| Impact
|}
====Kill Chain Phase====
* Actions on Objectives
* Delivery
* Exploitation
* Lateral Movement
* Privilege Escalation
* Reconnaissance
====Reference====
* https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html
* https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/
* https://us-cert.cisa.gov/ncas/alerts/aa20-302a
''version'': 1
</div>
</div>
----
===Samsam ransomware===
Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Authentication, Email, Endpoint, Network_Traffic, Web
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1036.005/ T1036.005], [https://attack.mitre.org/techniques/T1595/ T1595], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1489/ T1489], [https://attack.mitre.org/techniques/T1204.002/ T1204.002], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1531/ T1531], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1222/ T1222], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1082/ T1082], [https://attack.mitre.org/techniques/T1016/ T1016], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1117/ T1117], [https://attack.mitre.org/techniques/T1202/ T1202], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1203/ T1203], [https://attack.mitre.org/techniques/T1072/ T1072], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1190/ T1190]
* '''Last Updated''': 2018-12-13
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Attacker_tools_on_endpoint|Attacker Tools On Endpoint]]
* [[Documentation:ESSOC:detections:Detections#Batch_file_write_to_system32|Batch File Write to System32]]
* [[Documentation:ESSOC:detections:Detections#Common_ransomware_extensions|Common Ransomware Extensions]]
* [[Documentation:ESSOC:detections:Detections#Common_ransomware_notes|Common Ransomware Notes]]
* [[Documentation:ESSOC:detections:Detections#Deleting_shadow_copies|Deleting Shadow Copies]]
* [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]
* [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]
* [[Documentation:ESSOC:detections:Detections#Detect_attackers_scanning_for_vulnerable_jboss_servers|Detect attackers scanning for vulnerable JBoss servers]]
* [[Documentation:ESSOC:detections:Detections#Detect_malicious_requests_to_exploit_jboss_servers|Detect malicious requests to exploit JBoss servers]]
* [[Documentation:ESSOC:detections:Detections#File_with_samsam_extension|File with Samsam Extension]]
* [[Documentation:ESSOC:detections:Detections#Get_backup_logs_for_endpoint|Get Backup Logs For Endpoint]]
* [[Documentation:ESSOC:detections:Detections#Get_history_of_email_sources|Get History Of Email Sources]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
* [[Documentation:ESSOC:detections:Detections#Investigate_successful_remote_desktop_authentications|Investigate Successful Remote Desktop Authentications]]
* [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_bruteforce|Remote Desktop Network Bruteforce]]
* [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_traffic|Remote Desktop Network Traffic]]
* [[Documentation:ESSOC:detections:Detections#Samsam_test_file_write|Samsam Test File Write]]
* [[Documentation:ESSOC:detections:Detections#Spike_in_file_writes|Spike in File Writes]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1036.005
| Match Legitimate Name or Location
| Defense Evasion
|-
| T1595
| Active Scanning
| Reconnaissance
|-
| T1003
| OS Credential Dumping
| Credential Access
|-
| T1489
| Service Stop
| Impact
|-
| T1204.002
| Malicious File
| Execution
|-
| T1485
| Data Destruction
| Impact
|-
| T1531
| Account Access Removal
| Impact
|-
| T1490
| Inhibit System Recovery
| Impact
|-
| T1222
| File and Directory Permissions Modification
| Defense Evasion
|-
| T1021.002
| SMB/Windows Admin Shares
| Lateral Movement
|-
| T1569.002
| Service Execution
| Execution
|-
| T1082
| System Information Discovery
| Discovery
|-
| T1016
| System Network Configuration Discovery
| Discovery
|-
| T1562.001
| Disable or Modify Tools
| Defense Evasion
|-
| T1105
| Ingress Tool Transfer
| Command And Control
|-
| T1087
| Account Discovery
| Discovery
|-
| T1036
| Masquerading
| Defense Evasion
|-
| T1059
| Command and Scripting Interpreter
| Execution
|-
| T1117
| Regsvr32
|
|-
| T1202
| Indirect Command Execution
| Defense Evasion
|-
| T1053
| Scheduled Task/Job
| Execution, Persistence, Privilege Escalation
|-
| T1203
| Exploitation for Client Execution
| Execution
|-
| T1072
| Software Deployment Tools
| Execution, Lateral Movement
|-
| T1021.001
| Remote Desktop Protocol
| Lateral Movement
|-
| T1218.011
| Rundll32
| Defense Evasion
|-
| T1486
| Data Encrypted for Impact
| Impact
|-
| T1543.003
| Windows Service
| Persistence, Privilege Escalation
|-
| T1543
| Create or Modify System Process
| Persistence, Privilege Escalation
|-
| T1036.003
| Rename System Utilities
| Defense Evasion
|-
| T1190
| Exploit Public-Facing Application
| Initial Access
|}
====Kill Chain Phase====
* Actions on Objectives
* Command and Control
* Delivery
* Execution
* Exploitation
* Installation
* Lateral Movement
* Reconnaissance
====Reference====
* https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/
* https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/
* https://thehackernews.com/2018/07/samsam-ransomware-attacks.html
''version'': 1
</div>
</div>
----
===Trickbot===
Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection even in LDAP environment.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087.002/ T1087.002], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1204.002/ T1204.002], [https://attack.mitre.org/techniques/T1548.002/ T1548.002], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1560.001/ T1560.001], [https://attack.mitre.org/techniques/T1218.005/ T1218.005], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1566.001/ T1566.001], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1005/ T1005], [https://attack.mitre.org/techniques/T1218.010/ T1218.010], [https://attack.mitre.org/techniques/T1590.005/ T1590.005], [https://attack.mitre.org/techniques/T1027/ T1027], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1021.002/ T1021.002]
* '''Last Updated''': 2021-04-20
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Account_discovery_with_net_app|Account Discovery With Net App]]
* [[Documentation:ESSOC:detections:Detections#Attempt_to_stop_security_service|Attempt To Stop Security Service]]
* [[Documentation:ESSOC:detections:Detections#Cobalt_strike_named_pipes|Cobalt Strike Named Pipes]]
* [[Documentation:ESSOC:detections:Detections#Mshta_spawning_rundll32_or_regsvr32_process|Mshta spawning Rundll32 OR Regsvr32 Process]]
* [[Documentation:ESSOC:detections:Detections#Office_application_spawn_rundll32_process|Office Application Spawn rundll32 process]]
* [[Documentation:ESSOC:detections:Detections#Office_document_executing_macro_code|Office Document Executing Macro Code]]
* [[Documentation:ESSOC:detections:Detections#Office_product_spawn_cmd_process|Office Product Spawn CMD Process]]
* [[Documentation:ESSOC:detections:Detections#Powershell_remote_thread_to_known_windows_process|Powershell Remote Thread To Known Windows Process]]
* [[Documentation:ESSOC:detections:Detections#Schedule_task_with_rundll32_command_trigger|Schedule Task with Rundll32 Command Trigger]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_startw|Suspicious Rundll32 StartW]]
* [[Documentation:ESSOC:detections:Detections#Trickbot_named_pipe|Trickbot Named Pipe]]
* [[Documentation:ESSOC:detections:Detections#Wermgr_process_connecting_to_ip_check_web_services|Wermgr Process Connecting To IP Check Web Services]]
* [[Documentation:ESSOC:detections:Detections#Wermgr_process_create_executable_file|Wermgr Process Create Executable File]]
* [[Documentation:ESSOC:detections:Detections#Wermgr_process_spawned_cmd_or_powershell_process|Wermgr Process Spawned CMD Or Powershell Process]]
* [[Documentation:ESSOC:detections:Detections#Write_executable_in_smb_share|Write Executable in SMB Share]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1087.002
| Domain Account
| Discovery
|-
| T1562.001
| Disable or Modify Tools
| Defense Evasion
|-
| T1059
| Command and Scripting Interpreter
| Execution
|-
| T1055
| Process Injection
| Defense Evasion, Privilege Escalation
|-
| T1204.002
| Malicious File
| Execution
|-
| T1548.002
| Bypass User Account Control
| Privilege Escalation, Defense Evasion
|-
| T1112
| Modify Registry
| Defense Evasion
|-
| T1560.001
| Archive via Utility
| Collection
|-
| T1218.005
| Mshta
| Defense Evasion
|-
| T1482
| Domain Trust Discovery
| Discovery
|-
| T1566.001
| Spearphishing Attachment
| Initial Access
|-
| T1547.001
| Registry Run Keys / Startup Folder
| Persistence, Privilege Escalation
|-
| T1218.011
| Rundll32
| Defense Evasion
|-
| T1053
| Scheduled Task/Job
| Execution, Persistence, Privilege Escalation
|-
| T1005
| Data from Local System
| Collection
|-
| T1218.010
| Regsvr32
| Defense Evasion
|-
| T1590.005
| IP Addresses
| Reconnaissance
|-
| T1027
| Obfuscated Files or Information
| Defense Evasion
|-
| T1053.005
| Scheduled Task
| Execution, Persistence, Privilege Escalation
|-
| T1021.002
| SMB/Windows Admin Shares
| Lateral Movement
|}
====Kill Chain Phase====
* Actions on Objectives
* Exploitation
* Installation
* Lateral Movement
* Reconnaissance
====Reference====
* https://en.wikipedia.org/wiki/Trickbot
* https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/
''version'': 1
</div>
</div>
----
===Unusual processes===
Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1036.005/ T1036.005], [https://attack.mitre.org/techniques/T1595/ T1595], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1489/ T1489], [https://attack.mitre.org/techniques/T1204.002/ T1204.002], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1531/ T1531], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1222/ T1222], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1082/ T1082], [https://attack.mitre.org/techniques/T1016/ T1016], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1117/ T1117], [https://attack.mitre.org/techniques/T1202/ T1202], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1203/ T1203], [https://attack.mitre.org/techniques/T1072/ T1072], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1190/ T1190]
* '''Last Updated''': 2020-02-04
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Attacker_tools_on_endpoint|Attacker Tools On Endpoint]]
* [[Documentation:ESSOC:detections:Detections#Baseline_of_command_line_length_-_mltk|Baseline of Command Line Length - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option|Credential Extraction indicative of FGDump and CacheDump with s option]]
* [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option|Credential Extraction indicative of FGDump and CacheDump with v option]]
* [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_use_of_mimikatz_modules|Credential Extraction indicative of use of Mimikatz modules]]
* [[Documentation:ESSOC:detections:Detections#Credential_extraction_native_microsoft_debuggers_peek_into_the_kernel|Credential Extraction native Microsoft debuggers peek into the kernel]]
* [[Documentation:ESSOC:detections:Detections#Credential_extraction_native_microsoft_debuggers_via_z_command_line_option|Credential Extraction native Microsoft debuggers via z command line option]]
* [[Documentation:ESSOC:detections:Detections#Detect_rare_executables|Detect Rare Executables]]
* [[Documentation:ESSOC:detections:Detections#Detect_processes_used_for_system_network_configuration_discovery|Detect processes used for System Network Configuration Discovery]]
* [[Documentation:ESSOC:detections:Detections#First_time_seen_command_line_argument|First time seen command line argument]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#More_than_usual_number_of_lolbas_applications_in_short_time_period|More than usual number of LOLBAS applications in short time period]]
* [[Documentation:ESSOC:detections:Detections#Rare_parent-child_process_relationship|Rare Parent-Child Process Relationship]]
* [[Documentation:ESSOC:detections:Detections#Rundll_loading_dll_by_ordinal|RunDLL Loading DLL By Ordinal]]
* [[Documentation:ESSOC:detections:Detections#System_processes_run_from_unexpected_locations|System Processes Run From Unexpected Locations]]
* [[Documentation:ESSOC:detections:Detections#Unusually_long_command_line|Unusually Long Command Line]]
* [[Documentation:ESSOC:detections:Detections#Unusually_long_command_line_-_mltk|Unusually Long Command Line - MLTK]]
* [[Documentation:ESSOC:detections:Detections#Winrm_spawning_a_process|WinRM Spawning a Process]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1036.005
| Match Legitimate Name or Location
| Defense Evasion
|-
| T1595
| Active Scanning
| Reconnaissance
|-
| T1003
| OS Credential Dumping
| Credential Access
|-
| T1489
| Service Stop
| Impact
|-
| T1204.002
| Malicious File
| Execution
|-
| T1485
| Data Destruction
| Impact
|-
| T1531
| Account Access Removal
| Impact
|-
| T1490
| Inhibit System Recovery
| Impact
|-
| T1222
| File and Directory Permissions Modification
| Defense Evasion
|-
| T1021.002
| SMB/Windows Admin Shares
| Lateral Movement
|-
| T1569.002
| Service Execution
| Execution
|-
| T1082
| System Information Discovery
| Discovery
|-
| T1016
| System Network Configuration Discovery
| Discovery
|-
| T1562.001
| Disable or Modify Tools
| Defense Evasion
|-
| T1105
| Ingress Tool Transfer
| Command And Control
|-
| T1087
| Account Discovery
| Discovery
|-
| T1036
| Masquerading
| Defense Evasion
|-
| T1059
| Command and Scripting Interpreter
| Execution
|-
| T1117
| Regsvr32
|
|-
| T1202
| Indirect Command Execution
| Defense Evasion
|-
| T1053
| Scheduled Task/Job
| Execution, Persistence, Privilege Escalation
|-
| T1203
| Exploitation for Client Execution
| Execution
|-
| T1072
| Software Deployment Tools
| Execution, Lateral Movement
|-
| T1021.001
| Remote Desktop Protocol
| Lateral Movement
|-
| T1218.011
| Rundll32
| Defense Evasion
|-
| T1486
| Data Encrypted for Impact
| Impact
|-
| T1543.003
| Windows Service
| Persistence, Privilege Escalation
|-
| T1543
| Create or Modify System Process
| Persistence, Privilege Escalation
|-
| T1036.003
| Rename System Utilities
| Defense Evasion
|-
| T1190
| Exploit Public-Facing Application
| Initial Access
|}
====Kill Chain Phase====
* Actions on Objectives
* Command and Control
* Denial of Service
* Exploitation
* Installation
* Privilege Escalation
====Reference====
* https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html
* https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf
* https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262
''version'': 2
</div>
</div>
----
===Windows file extension and association abuse===
Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1127.001/ T1127.001], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1127/ T1127], [https://attack.mitre.org/techniques/T1036/ T1036]
* '''Last Updated''': 2018-01-26
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Execution_of_file_with_multiple_extensions|Execution of File with Multiple Extensions]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1036.003
| Rename System Utilities
| Defense Evasion
|-
| T1127.001
| MSBuild
| Defense Evasion
|-
| T1218.011
| Rundll32
| Defense Evasion
|-
| T1127
| Trusted Developer Utilities Proxy Execution
| Defense Evasion
|-
| T1036
| Masquerading
| Defense Evasion
|}
====Kill Chain Phase====
* Actions on Objectives
====Reference====
* https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/
* https://attack.mitre.org/wiki/Technique/T1042
''version'': 1
</div>
</div>
----
===Windows service abuse===
Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1106/ T1106], [https://attack.mitre.org/techniques/T1569/ T1569], [https://attack.mitre.org/techniques/T1574.011/ T1574.011], [https://attack.mitre.org/techniques/T1543.003/ T1543.003]
* '''Last Updated''': 2017-11-02
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#First_time_seen_running_windows_service|First Time Seen Running Windows Service]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
* [[Documentation:ESSOC:detections:Detections#Illegal_service_and_process_control_via_mimikatz_modules|Illegal Service and Process Control via Mimikatz modules]]
* [[Documentation:ESSOC:detections:Detections#Illegal_service_and_process_control_via_powersploit_modules|Illegal Service and Process Control via PowerSploit modules]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_running_windows_services_-_initial|Previously Seen Running Windows Services - Initial]]
* [[Documentation:ESSOC:detections:Detections#Previously_seen_running_windows_services_-_update|Previously Seen Running Windows Services - Update]]
* [[Documentation:ESSOC:detections:Detections#Reg_exe_manipulating_windows_services_registry_keys|Reg exe Manipulating Windows Services Registry Keys]]
* [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1569.002
| Service Execution
| Execution
|-
| T1055
| Process Injection
| Defense Evasion, Privilege Escalation
|-
| T1106
| Native API
| Execution
|-
| T1569
| System Services
| Execution
|-
| T1574.011
| Services Registry Permissions Weakness
| Persistence, Privilege Escalation, Defense Evasion
|-
| T1543.003
| Windows Service
| Persistence, Privilege Escalation
|}
====Kill Chain Phase====
* Actions on Objectives
* Installation
====Reference====
* https://attack.mitre.org/wiki/Technique/T1050
* https://attack.mitre.org/wiki/Technique/T1031
''version'': 3
</div>
</div>
----
===Xmrig===
Leverage searches that allow you to detect and investigate unusual activities that might relate to the xmrig monero, including looking for file writes associated with its payload, process command-line, defense evasion (killing services, deleting users, modifying files or folder permission, killing other malware or other coin miner) and hacking tools including Telegram as mean of command and control (C2) to download other files. Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems which may impact system and/or hosted service availability. One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive. (1) Servers and cloud-based (2) systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1036.005/ T1036.005], [https://attack.mitre.org/techniques/T1595/ T1595], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1489/ T1489], [https://attack.mitre.org/techniques/T1204.002/ T1204.002], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1531/ T1531], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1222/ T1222], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1082/ T1082], [https://attack.mitre.org/techniques/T1016/ T1016], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1117/ T1117], [https://attack.mitre.org/techniques/T1202/ T1202], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1203/ T1203], [https://attack.mitre.org/techniques/T1072/ T1072], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1190/ T1190]
* '''Last Updated''': 2021-05-07
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Attacker_tools_on_endpoint|Attacker Tools On Endpoint]]
* [[Documentation:ESSOC:detections:Detections#Attempt_to_disable_services|Attempt To Disable Services]]
* [[Documentation:ESSOC:detections:Detections#Attempt_to_delete_services|Attempt To delete Services]]
* [[Documentation:ESSOC:detections:Detections#Delete_a_net_user|Delete A Net User]]
* [[Documentation:ESSOC:detections:Detections#Deleting_of_net_users|Deleting Of Net Users]]
* [[Documentation:ESSOC:detections:Detections#Deny_permission_using_cacls_utility|Deny Permission using Cacls Utility]]
* [[Documentation:ESSOC:detections:Detections#Disable_net_user_account|Disable Net User Account]]
* [[Documentation:ESSOC:detections:Detections#Disable_windows_app_hotkeys|Disable Windows App Hotkeys]]
* [[Documentation:ESSOC:detections:Detections#Disabling_net_user_account|Disabling Net User Account]]
* [[Documentation:ESSOC:detections:Detections#Download_files_using_telegram|Download Files Using Telegram]]
* [[Documentation:ESSOC:detections:Detections#Enumerate_users_local_group_using_telegram|Enumerate Users Local Group Using Telegram]]
* [[Documentation:ESSOC:detections:Detections#Excessive_attempt_to_disable_services|Excessive Attempt To Disable Services]]
* [[Documentation:ESSOC:detections:Detections#Excessive_service_stop_attempt|Excessive Service Stop Attempt]]
* [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_cacls_app|Excessive Usage Of Cacls App]]
* [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_net_app|Excessive Usage Of Net App]]
* [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_taskkill|Excessive Usage Of Taskkill]]
* [[Documentation:ESSOC:detections:Detections#Executables_or_script_creation_in_suspicious_path|Executables Or Script Creation In Suspicious Path]]
* [[Documentation:ESSOC:detections:Detections#Grant_permission_using_cacls_utility|Grant Permission Using Cacls Utility]]
* [[Documentation:ESSOC:detections:Detections#Hide_user_account_from_sign-in_screen|Hide User Account From Sign-In Screen]]
* [[Documentation:ESSOC:detections:Detections#Icacls_grant_command|ICACLS Grant Command]]
* [[Documentation:ESSOC:detections:Detections#Icacls_deny_command|Icacls Deny Command]]
* [[Documentation:ESSOC:detections:Detections#Modify_acl_permission_to_files_or_folder|Modify ACL permission To Files Or Folder]]
* [[Documentation:ESSOC:detections:Detections#Modify_acls_permission_of_files_or_folders|Modify ACLs Permission Of Files Or Folders]]
* [[Documentation:ESSOC:detections:Detections#Process_kill_base_on_file_path|Process Kill Base On File Path]]
* [[Documentation:ESSOC:detections:Detections#Schtasks_run_task_on_demand|Schtasks Run Task On Demand]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_driver_loaded_path|Suspicious Driver Loaded Path]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_process_file_path|Suspicious Process File Path]]
* [[Documentation:ESSOC:detections:Detections#Xmrig_driver_loaded|XMRIG Driver Loaded]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1036.005
| Match Legitimate Name or Location
| Defense Evasion
|-
| T1595
| Active Scanning
| Reconnaissance
|-
| T1003
| OS Credential Dumping
| Credential Access
|-
| T1489
| Service Stop
| Impact
|-
| T1204.002
| Malicious File
| Execution
|-
| T1485
| Data Destruction
| Impact
|-
| T1531
| Account Access Removal
| Impact
|-
| T1490
| Inhibit System Recovery
| Impact
|-
| T1222
| File and Directory Permissions Modification
| Defense Evasion
|-
| T1021.002
| SMB/Windows Admin Shares
| Lateral Movement
|-
| T1569.002
| Service Execution
| Execution
|-
| T1082
| System Information Discovery
| Discovery
|-
| T1016
| System Network Configuration Discovery
| Discovery
|-
| T1562.001
| Disable or Modify Tools
| Defense Evasion
|-
| T1105
| Ingress Tool Transfer
| Command And Control
|-
| T1087
| Account Discovery
| Discovery
|-
| T1036
| Masquerading
| Defense Evasion
|-
| T1059
| Command and Scripting Interpreter
| Execution
|-
| T1117
| Regsvr32
|
|-
| T1202
| Indirect Command Execution
| Defense Evasion
|-
| T1053
| Scheduled Task/Job
| Execution, Persistence, Privilege Escalation
|-
| T1203
| Exploitation for Client Execution
| Execution
|-
| T1072
| Software Deployment Tools
| Execution, Lateral Movement
|-
| T1021.001
| Remote Desktop Protocol
| Lateral Movement
|-
| T1218.011
| Rundll32
| Defense Evasion
|-
| T1486
| Data Encrypted for Impact
| Impact
|-
| T1543.003
| Windows Service
| Persistence, Privilege Escalation
|-
| T1543
| Create or Modify System Process
| Persistence, Privilege Escalation
|-
| T1036.003
| Rename System Utilities
| Defense Evasion
|-
| T1190
| Exploit Public-Facing Application
| Initial Access
|}
====Kill Chain Phase====
* Actions on Objectives
* Command and Control
* Exploitation
* Installation
====Reference====
* https://github.com/xmrig/xmrig
* https://www.getmonero.org/resources/user-guides/mine-to-pool.html
* https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
* https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/
''version'': 1
</div>
</div>
----
==Vulnerability==
===Apache struts vulnerability===
Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint, Web
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1082/ T1082]
* '''Last Updated''': 2018-12-06
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
* [[Documentation:ESSOC:detections:Detections#Investigate_suspicious_strings_in_http_header|Investigate Suspicious Strings in HTTP Header]]
* [[Documentation:ESSOC:detections:Detections#Investigate_web_posts_from_src|Investigate Web POSTs From src]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_java_classes|Suspicious Java Classes]]
* [[Documentation:ESSOC:detections:Detections#Unusually_long_content-type_length|Unusually Long Content-Type Length]]
* [[Documentation:ESSOC:detections:Detections#Web_servers_executing_suspicious_processes|Web Servers Executing Suspicious Processes]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1082
| System Information Discovery
| Discovery
|}
====Kill Chain Phase====
* Actions on Objectives
* Delivery
* Exploitation
====Reference====
* https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf
''version'': 1
</div>
</div>
----
===Jboss vulnerability===
In March of 2016, adversaries were seen using JexBoss--an open-source utility used for testing and exploiting JBoss application servers. These searches help detect evidence of these attacks, such as network connections to external resources or web services spawning atypical child processes, among others.
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Web
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1082/ T1082]
* '''Last Updated''': 2017-09-14
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Detect_attackers_scanning_for_vulnerable_jboss_servers|Detect attackers scanning for vulnerable JBoss servers]]
* [[Documentation:ESSOC:detections:Detections#Detect_malicious_requests_to_exploit_jboss_servers|Detect malicious requests to exploit JBoss servers]]
* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
|-
| T1082
| System Information Discovery
| Discovery
|}
====Kill Chain Phase====
* Delivery
* Reconnaissance
====Reference====
* http://www.deependresearch.org/2016/04/jboss-exploits-view-from-victim.html
''version'': 1
</div>
</div>
----
<pre>
#############
# Automatically generated by doc_gen.py in https://github.com/splunk/security_content
# On Date: 2021-08-27 21:42:13.761546 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
</pre>
Reference in New Issue View Git Blame Copy Permalink