splunk-security_content/dist/api/stories.json

{"stories": [{"name": "IcedID", "id": "1d2cc747-63d7-49a9-abb8-93aa36305603", "version": 1, "date": "2021-07-29", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the IcedID banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection.", "narrative": "IcedId banking trojan campaigns targeting banks and other vertical sectors.This malware is known in Microsoft Windows OS targetting browser such as firefox and chrom to steal banking information. It is also known to its unique payload downloaded in C2 where it can be a .png file that hides the core shellcode bot using steganography technique or gzip dat file that contains \"license.dat\" which is the actual core icedid bot.", "references": ["https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/", "https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/"], "tags": {"name": "IcedID", "analytic_story": "IcedID", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1087.002", "mitre_attack_technique": "Domain Account", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "BRONZE BUTLER", "Chimera", "Dragonfly", "FIN6", "Fox Kitten", "Ke3chang", "LAPSUS$", "Lazarus Group", "MuddyWater", "OilRig", "Poseidon Group", "Sandworm Team", "Turla", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1087", "mitre_attack_technique": "Account Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1055", "mitre_attack_technique": "Process Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT32", "APT37", "APT41", "Cobalt Group", "Kimsuky", "PLATINUM", "Silence", "Turla"]}, {"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1204", "mitre_attack_technique": "User Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["LAPSUS$"]}, {"mitre_attack_id": "T1204.002", "mitre_attack_technique": "Malicious File", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT-C-36", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "Ajax Security Team", "Andariel", "Aoqin Dragon", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "Dark Caracal", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Earth Lusca", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HEXANE", "Higaisa", "Inception", "IndigoZebra", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "PROMETHIUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Whitefly", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1548.002", "mitre_attack_technique": "Bypass User Account Control", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT29", "APT37", "BRONZE BUTLER", "Cobalt Group", "Earth Lusca", "Evilnum", "MuddyWater", "Patchwork", "Threat Group-3390"]}, {"mitre_attack_id": "T1548", "mitre_attack_technique": "Abuse Elevation Control Mechanism", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1112", "mitre_attack_technique": "Modify Registry", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "APT38", "APT41", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN8", "Gamaredon Group", "Gorgon Group", "Kimsuky", "Magic Hound", "Patchwork", "Silence", "TA505", "Threat Group-3390", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1560.001", "mitre_attack_technique": "Archive via Utility", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT1", "APT28", "APT29", "APT3", "APT33", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Chimera", "CopyKittens", "Earth Lusca", "FIN8", "Fox Kitten", "GALLIUM", "Gallmaker", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "MuddyWater", "Mustang Panda", "Sowbug", "Turla", "menuPass"]}, {"mitre_attack_id": "T1560", "mitre_attack_technique": "Archive Collected Data", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT28", "APT32", "Axiom", "Dragonfly", "FIN6", "Ke3chang", "Lazarus Group", "Leviathan", "Patchwork", "menuPass"]}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.005", "mitre_attack_technique": "Mshta", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "APT32", "Confucius", "Earth Lusca", "FIN7", "Gamaredon Group", "Inception", "Kimsuky", "Lazarus Group", "LazyScripter", "MuddyWater", "Mustang Panda", "SideCopy", "Sidewinder", "TA551"]}, {"mitre_attack_id": "T1482", "mitre_attack_technique": "Domain Trust Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "Chimera", "Earth Lusca", "FIN8"]}, {"mitre_attack_id": "T1566", "mitre_attack_technique": "Phishing", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["Axiom", "GOLD SOUTHFIELD"]}, {"mitre_attack_id": "T1566.001", "mitre_attack_technique": "Spearphishing Attachment", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "IndigoZebra", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1566.002", "mitre_attack_technique": "Spearphishing Link", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT1", "APT28", "APT29", "APT3", "APT32", "APT33", "APT39", "BlackTech", "Cobalt Group", "Confucius", "EXOTIC LILY", "Earth Lusca", "Elderwood", "Ember Bear", "Evilnum", "FIN4", "FIN7", "FIN8", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Sandworm Team", "Sidewinder", "TA505", "Transparent Tribe", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1547.001", "mitre_attack_technique": "Registry Run Keys / Startup Folder", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Dark Caracal", "Darkhotel", "Dragonfly", "FIN10", "FIN6", "FIN7", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Putter Panda", "RTM", "Rocke", "Sidewinder", "Silence", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1218.010", "mitre_attack_technique": "Regsvr32", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "Blue Mockingbird", "Cobalt Group", "Deep Panda", "Inception", "Kimsuky", "Lazarus Group", "Leviathan", "TA551", "WIRTE"]}, {"mitre_attack_id": "T1218.011", "mitre_attack_technique": "Rundll32", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "CopyKittens", "Gamaredon Group", "HAFNIUM", "Kimsuky", "Lazarus Group", "LazyScripter", "Magic Hound", "MuddyWater", "Sandworm Team", "TA505", "TA551"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1005", "mitre_attack_technique": "Data from Local System", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT1", "APT28", "APT29", "APT3", "APT37", "APT38", "APT39", "APT41", "Andariel", "Axiom", "BRONZE BUTLER", "Dark Caracal", "Dragonfly", "FIN6", "FIN7", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Inception", "Ke3chang", "Kimsuky", "LAPSUS$", "Lazarus Group", "Magic Hound", "Patchwork", "Sandworm Team", "Stealth Falcon", "Threat Group-3390", "Turla", "Windigo", "menuPass"]}, {"mitre_attack_id": "T1036.003", "mitre_attack_technique": "Rename System Utilities", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT32", "GALLIUM", "Lazarus Group", "menuPass"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1105", "mitre_attack_technique": "Ingress Tool Transfer", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "Chimera", "Cobalt Group", "Confucius", "Darkhotel", "Dragonfly", "Elderwood", "Ember Bear", "Evilnum", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "IndigoZebra", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "Rancor", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Turla", "Volatile Cedar", "WIRTE", "Whitefly", "Windshift", "Winnti Group", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1204.001", "mitre_attack_technique": "Malicious Link", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT33", "APT39", "BlackTech", "Cobalt Group", "Confucius", "EXOTIC LILY", "Earth Lusca", "Elderwood", "Ember Bear", "Evilnum", "FIN4", "FIN7", "FIN8", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Sandworm Team", "Sidewinder", "TA505", "Transparent Tribe", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}], "mitre_attack_tactics": ["Collection", "Command And Control", "Defense Evasion", "Discovery", "Execution", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Installation", "Reconnaissance"]}, "detection_names": ["ESCU - Account Discovery With Net App - Rule", "ESCU - CHCP Command Execution - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Create Remote Thread In Shell Application - Rule", "ESCU - Disable Defender AntiVirus Registry - Rule", "ESCU - Disable Defender BlockAtFirstSeen Feature - Rule", "ESCU - Disable Defender Enhanced Notification - Rule", "ESCU - Disable Defender MpEngine Registry - Rule", "ESCU - Disable Defender Spynet Reporting - Rule", "ESCU - Disable Defender Submit Samples Consent Feature - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Disabling Defender Services - Rule", "ESCU - Drop IcedID License dat - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - IcedID Exfiltrated Archived File Creation - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Office Application Spawn Regsvr32 process - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Sqlite Module In Temp Folder - Rule", "ESCU - Suspicious Copy on System32 - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Suspicious Rundll32 PluginInit - Rule", "ESCU - Windows Curl Download to Suspicious Path - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Windows Phishing Recent ISO Exec Registry - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Wmic NonInteractive App Uninstallation - Rule"], "investigation_names": [], "baseline_names": ["ESCU - Previously seen command line arguments"], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Account Discovery With Net App", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Account Discovery"}]}}, {"name": "CHCP Command Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "CMD Carry Out String Command Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Command Shell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Create Remote Thread In Shell Application", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Disable Defender AntiVirus Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Defender BlockAtFirstSeen Feature", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Defender Enhanced Notification", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Defender MpEngine Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Defender Spynet Reporting", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Defender Submit Samples Consent Feature", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Schedule Task", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disabling Defender Services", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Drop IcedID License dat", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "User Execution"}, {"mitre_attack_technique": "Malicious File"}]}}, {"name": "Eventvwr UAC Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Executables Or Script Creation In Suspicious Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "FodHelper UAC Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}, {"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "IcedID Exfiltrated Archived File Creation", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Archive via Utility"}, {"mitre_attack_technique": "Archive Collected Data"}]}}, {"name": "Mshta spawning Rundll32 OR Regsvr32 Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Mshta"}]}}, {"name": "NLTest Domain Trust Discovery", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Trust Discovery"}]}}, {"name": "Office Application Spawn Regsvr32 process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Application Spawn rundll32 process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Document Executing Macro Code", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Spawning MSHTA", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Process Creating LNK file in Suspicious Location", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Link"}]}}, {"name": "Registry Keys Used For Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Registry Run Keys / Startup Folder"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Regsvr32 with Known Silent Switch Cmdline", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvr32"}]}}, {"name": "Rundll32 Create Remote Thread To A Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Rundll32 CreateRemoteThread In Browser", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Rundll32 DNSQuery", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Rundll32 Process Creating Exe Dll Files", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "RunDLL Loading DLL By Ordinal", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Schedule Task with Rundll32 Command Trigger", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Sqlite Module In Temp Folder", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data from Local System"}]}}, {"name": "Suspicious Copy on System32", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "Masquerading"}]}}, {"name": "Suspicious IcedID Rundll32 Cmdline", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Suspicious Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Suspicious Rundll32 PluginInit", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Windows Curl Download to Suspicious Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Windows ISO LNK File Creation", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Malicious Link"}, {"mitre_attack_technique": "User Execution"}]}}, {"name": "Windows Phishing Recent ISO Exec Registry", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}]}}, {"name": "WinEvent Scheduled Task Created Within Public Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "WinEvent Windows Task Scheduler Event Action Started", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}]}}, {"name": "Wmic NonInteractive App Uninstallation", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}]}, {"name": "AcidRain", "id": "c68717c6-4938-434b-987c-e1ce9d516124", "version": 1, "date": "2022-04-12", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the acidrain malware including deleting of files and etc. AcidRain is an ELF MIPS malware specifically designed to wipe modems and routers. The complete list of targeted devices is unknown at this time, but WatchGuard FireBox has specifically been listed as a target. This malware is capable of wiping and deleting non-standard linux files and overwriting storage device files that might related to router, ssd card and many more.", "narrative": "Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption is the goal.", "references": ["https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/"], "tags": {"name": "AcidRain", "analytic_story": "AcidRain", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1485", "mitre_attack_technique": "Data Destruction", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "Gamaredon Group", "LAPSUS$", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1070.004", "mitre_attack_technique": "File Deletion", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT3", "APT32", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Chimera", "Cobalt Group", "Dragonfly", "Evilnum", "FIN10", "FIN5", "FIN6", "FIN8", "Gamaredon Group", "Group5", "Kimsuky", "Lazarus Group", "Magic Hound", "Mustang Panda", "OilRig", "Patchwork", "Rocke", "Sandworm Team", "Silence", "TEMP.Veles", "TeamTNT", "The White Company", "Threat Group-3390", "Tropic Trooper", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1070", "mitre_attack_technique": "Indicator Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Lazarus Group"]}], "mitre_attack_tactics": ["Defense Evasion", "Impact"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Linux Deletion Of Cron Jobs - Rule", "ESCU - Linux Deletion Of Init Daemon Script - Rule", "ESCU - Linux Deletion Of Services - Rule", "ESCU - Linux High Frequency Of File Deletion In Etc Folder - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Linux Deletion Of Cron Jobs", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}, {"mitre_attack_technique": "File Deletion"}, {"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "Linux Deletion Of Init Daemon Script", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}, {"mitre_attack_technique": "File Deletion"}, {"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "Linux Deletion Of Services", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}, {"mitre_attack_technique": "File Deletion"}, {"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "Linux High Frequency Of File Deletion In Etc Folder", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}, {"mitre_attack_technique": "File Deletion"}, {"mitre_attack_technique": "Indicator Removal"}]}}]}, {"name": "Active Directory Discovery", "id": "8460679c-2b21-463e-b381-b813417c32f2", "version": 1, "date": "2021-08-20", "author": "Mauricio Velazco, Splunk", "description": "Monitor for activities and techniques associated with Discovery and Reconnaissance within with Active Directory environments.", "narrative": "Discovery consists of techniques an adversay uses to gain knowledge about an internal environment or network. These techniques provide adversaries with situational awareness and allows them to have the necessary information before deciding how to act or who/what to target next.\\\nOnce an attacker obtains an initial foothold in an Active Directory environment, she is forced to engage in Discovery techniques in the initial phases of a breach to better understand and navigate the target network. Some examples include but are not limited to enumerating domain users, domain admins, computers, domain controllers, network shares, group policy objects, domain trusts, etc.", "references": ["https://attack.mitre.org/tactics/TA0007/", "https://adsecurity.org/?p=2535", "https://attack.mitre.org/techniques/T1087/001/", "https://attack.mitre.org/techniques/T1087/002/", "https://attack.mitre.org/techniques/T1087/003/", "https://attack.mitre.org/techniques/T1482/", "https://attack.mitre.org/techniques/T1201/", "https://attack.mitre.org/techniques/T1069/001/", "https://attack.mitre.org/techniques/T1069/002/", "https://attack.mitre.org/techniques/T1018/", "https://attack.mitre.org/techniques/T1049/", "https://attack.mitre.org/techniques/T1033/"], "tags": {"name": "Active Directory Discovery", "analytic_story": "Active Directory Discovery", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1087.002", "mitre_attack_technique": "Domain Account", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "BRONZE BUTLER", "Chimera", "Dragonfly", "FIN6", "Fox Kitten", "Ke3chang", "LAPSUS$", "Lazarus Group", "MuddyWater", "OilRig", "Poseidon Group", "Sandworm Team", "Turla", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1087", "mitre_attack_technique": "Account Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29"]}, {"mitre_attack_id": "T1018", "mitre_attack_technique": "Remote System Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "APT3", "APT32", "APT39", "BRONZE BUTLER", "Chimera", "Deep Panda", "Dragonfly", "Earth Lusca", "FIN5", "FIN6", "FIN8", "Fox Kitten", "GALLIUM", "HEXANE", "Indrik Spider", "Ke3chang", "Leafminer", "Naikon", "Rocke", "Sandworm Team", "Silence", "Threat Group-3390", "Turla", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1069", "mitre_attack_technique": "Permission Groups Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "APT3", "TA505"]}, {"mitre_attack_id": "T1069.002", "mitre_attack_technique": "Domain Groups", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "Dragonfly", "Inception", "Ke3chang", "LAPSUS$", "OilRig", "Turla"]}, {"mitre_attack_id": "T1482", "mitre_attack_technique": "Domain Trust Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "Chimera", "Earth Lusca", "FIN8"]}, {"mitre_attack_id": "T1201", "mitre_attack_technique": "Password Policy Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["Chimera", "OilRig", "Turla"]}, {"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1069.001", "mitre_attack_technique": "Local Groups", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["Chimera", "HEXANE", "OilRig", "Tonto Team", "Turla", "admin@338"]}, {"mitre_attack_id": "T1033", "mitre_attack_technique": "System Owner/User Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT37", "APT38", "APT39", "APT41", "Chimera", "Dragonfly", "Earth Lusca", "FIN10", "GALLIUM", "Gamaredon Group", "HEXANE", "Ke3chang", "Lazarus Group", "Magic Hound", "MuddyWater", "OilRig", "Patchwork", "Sandworm Team", "Sidewinder", "Stealth Falcon", "Threat Group-3390", "Tropic Trooper", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1087.001", "mitre_attack_technique": "Local Account", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT1", "APT3", "APT32", "Chimera", "Fox Kitten", "Ke3chang", "Moses Staff", "OilRig", "Poseidon Group", "Threat Group-3390", "Turla", "admin@338"]}, {"mitre_attack_id": "T1049", "mitre_attack_technique": "System Network Connections Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT1", "APT3", "APT32", "APT38", "APT41", "Andariel", "BackdoorDiplomacy", "Chimera", "Earth Lusca", "GALLIUM", "HEXANE", "Ke3chang", "Lazarus Group", "Magic Hound", "MuddyWater", "Mustang Panda", "OilRig", "Poseidon Group", "Sandworm Team", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1016", "mitre_attack_technique": "System Network Configuration Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT1", "APT19", "APT3", "APT32", "APT41", "Chimera", "Darkhotel", "Dragonfly", "Earth Lusca", "GALLIUM", "HEXANE", "Higaisa", "Ke3chang", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "SideCopy", "Sidewinder", "Stealth Falcon", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1016.001", "mitre_attack_technique": "Internet Connection Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "Gamaredon Group", "HEXANE", "Turla"]}, {"mitre_attack_id": "T1558.003", "mitre_attack_technique": "Kerberoasting", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "FIN7", "Wizard Spider"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}], "mitre_attack_tactics": ["Credential Access", "Discovery", "Execution", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - AdsiSearcher Account Discovery - Rule", "ESCU - Domain Account Discovery with Dsquery - Rule", "ESCU - Domain Account Discovery With Net App - Rule", "ESCU - Domain Account Discovery with Wmic - Rule", "ESCU - Domain Controller Discovery with Nltest - Rule", "ESCU - Domain Controller Discovery with Wmic - Rule", "ESCU - Domain Group Discovery with Adsisearcher - Rule", "ESCU - Domain Group Discovery With Dsquery - Rule", "ESCU - Domain Group Discovery With Net - Rule", "ESCU - Domain Group Discovery With Wmic - Rule", "ESCU - DSQuery Domain Discovery - Rule", "ESCU - Elevated Group Discovery With Net - Rule", "ESCU - Elevated Group Discovery with PowerView - Rule", "ESCU - Elevated Group Discovery With Wmic - Rule", "ESCU - Get ADDefaultDomainPasswordPolicy with Powershell - Rule", "ESCU - Get ADDefaultDomainPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get ADUser with PowerShell - Rule", "ESCU - Get ADUser with PowerShell Script Block - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainPolicy with Powershell - Rule", "ESCU - Get DomainPolicy with Powershell Script Block - Rule", "ESCU - Get-DomainTrust with PowerShell - Rule", "ESCU - Get-DomainTrust with PowerShell Script Block - Rule", "ESCU - Get DomainUser with PowerShell - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Get-ForestTrust with PowerShell - Rule", "ESCU - Get-ForestTrust with PowerShell Script Block - Rule", "ESCU - Get WMIObject Group Discovery - Rule", "ESCU - Get WMIObject Group Discovery with Script Block Logging - Rule", "ESCU - GetAdComputer with PowerShell - Rule", "ESCU - GetAdComputer with PowerShell Script Block - Rule", "ESCU - GetAdGroup with PowerShell - Rule", "ESCU - GetAdGroup with PowerShell Script Block - Rule", "ESCU - GetCurrent User with PowerShell - Rule", "ESCU - GetCurrent User with PowerShell Script Block - Rule", "ESCU - GetDomainComputer with PowerShell - Rule", "ESCU - GetDomainComputer with PowerShell Script Block - Rule", "ESCU - GetDomainController with PowerShell - Rule", "ESCU - GetDomainController with PowerShell Script Block - Rule", "ESCU - GetDomainGroup with PowerShell - Rule", "ESCU - GetDomainGroup with PowerShell Script Block - Rule", "ESCU - GetLocalUser with PowerShell - Rule", "ESCU - GetLocalUser with PowerShell Script Block - Rule", "ESCU - GetNetTcpconnection with PowerShell - Rule", "ESCU - GetNetTcpconnection with PowerShell Script Block - Rule", "ESCU - GetWmiObject Ds Computer with PowerShell - Rule", "ESCU - GetWmiObject Ds Computer with PowerShell Script Block - Rule", "ESCU - GetWmiObject Ds Group with PowerShell - Rule", "ESCU - GetWmiObject Ds Group with PowerShell Script Block - Rule", "ESCU - GetWmiObject DS User with PowerShell - Rule", "ESCU - GetWmiObject DS User with PowerShell Script Block - Rule", "ESCU - GetWmiObject User Account with PowerShell - Rule", "ESCU - GetWmiObject User Account with PowerShell Script Block - Rule", "ESCU - Local Account Discovery with Net - Rule", "ESCU - Local Account Discovery With Wmic - Rule", "ESCU - Net Localgroup Discovery - Rule", "ESCU - Network Connection Discovery With Arp - Rule", "ESCU - Network Connection Discovery With Net - Rule", "ESCU - Network Connection Discovery With Netstat - Rule", "ESCU - Network Discovery Using Route Windows App - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Password Policy Discovery with Net - Rule", "ESCU - PowerShell Get LocalGroup Discovery - Rule", "ESCU - Powershell Get LocalGroup Discovery with Script Block Logging - Rule", "ESCU - Remote System Discovery with Adsisearcher - Rule", "ESCU - Remote System Discovery with Dsquery - Rule", "ESCU - Remote System Discovery with Net - Rule", "ESCU - Remote System Discovery with Wmic - Rule", "ESCU - ServicePrincipalNames Discovery with PowerShell - Rule", "ESCU - ServicePrincipalNames Discovery with SetSPN - Rule", "ESCU - System User Discovery With Query - Rule", "ESCU - System User Discovery With Whoami - Rule", "ESCU - User Discovery With Env Vars PowerShell - Rule", "ESCU - User Discovery With Env Vars PowerShell Script Block - Rule", "ESCU - Windows Hidden Schedule Task Settings - Rule", "ESCU - Windows Linked Policies In ADSI Discovery - Rule", "ESCU - Windows Root Domain linked policies Discovery - Rule", "ESCU - Wmic Group Discovery - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Mauricio Velazco", "detections": [{"name": "AdsiSearcher Account Discovery", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Account Discovery"}]}}, {"name": "Domain Account Discovery with Dsquery", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Account Discovery"}]}}, {"name": "Domain Account Discovery With Net App", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Account Discovery"}]}}, {"name": "Domain Account Discovery with Wmic", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Account Discovery"}]}}, {"name": "Domain Controller Discovery with Nltest", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}, {"name": "Domain Controller Discovery with Wmic", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}, {"name": "Domain Group Discovery with Adsisearcher", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Domain Groups"}]}}, {"name": "Domain Group Discovery With Dsquery", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Domain Groups"}]}}, {"name": "Domain Group Discovery With Net", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Domain Groups"}]}}, {"name": "Domain Group Discovery With Wmic", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Domain Groups"}]}}, {"name": "DSQuery Domain Discovery", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Trust Discovery"}]}}, {"name": "Elevated Group Discovery With Net", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Domain Groups"}]}}, {"name": "Elevated Group Discovery with PowerView", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Domain Groups"}]}}, {"name": "Elevated Group Discovery With Wmic", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Domain Groups"}]}}, {"name": "Get ADDefaultDomainPasswordPolicy with Powershell", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Policy Discovery"}]}}, {"name": "Get ADDefaultDomainPasswordPolicy with Powershell Script Block", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Policy Discovery"}]}}, {"name": "Get ADUser with PowerShell", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Account Discovery"}]}}, {"name": "Get ADUser with PowerShell Script Block", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Account Discovery"}]}}, {"name": "Get ADUserResultantPasswordPolicy with Powershell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Policy Discovery"}]}}, {"name": "Get ADUserResultantPasswordPolicy with Powershell Script Block", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Policy Discovery"}]}}, {"name": "Get DomainPolicy with Powershell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Policy Discovery"}]}}, {"name": "Get DomainPolicy with Powershell Script Block", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Policy Discovery"}]}}, {"name": "Get-DomainTrust with PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Trust Discovery"}]}}, {"name": "Get-DomainTrust with PowerShell Script Block", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Trust Discovery"}]}}, {"name": "Get DomainUser with PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Account Discovery"}]}}, {"name": "Get DomainUser with PowerShell Script Block", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Account Discovery"}]}}, {"name": "Get-ForestTrust with PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Trust Discovery"}]}}, {"name": "Get-ForestTrust with PowerShell Script Block", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Trust Discovery"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Get WMIObject Group Discovery", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Local Groups"}]}}, {"name": "Get WMIObject Group Discovery with Script Block Logging", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Local Groups"}]}}, {"name": "GetAdComputer with PowerShell", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}, {"name": "GetAdComputer with PowerShell Script Block", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}, {"name": "GetAdGroup with PowerShell", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Domain Groups"}]}}, {"name": "GetAdGroup with PowerShell Script Block", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Domain Groups"}]}}, {"name": "GetCurrent User with PowerShell", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Owner/User Discovery"}]}}, {"name": "GetCurrent User with PowerShell Script Block", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Owner/User Discovery"}]}}, {"name": "GetDomainComputer with PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}, {"name": "GetDomainComputer with PowerShell Script Block", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}, {"name": "GetDomainController with PowerShell", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}, {"name": "GetDomainController with PowerShell Script Block", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}, {"name": "GetDomainGroup with PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Domain Groups"}]}}, {"name": "GetDomainGroup with PowerShell Script Block", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Domain Groups"}]}}, {"name": "GetLocalUser with PowerShell", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Discovery"}, {"mitre_attack_technique": "Local Account"}]}}, {"name": "GetLocalUser with PowerShell Script Block", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Discovery"}, {"mitre_attack_technique": "Local Account"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "GetNetTcpconnection with PowerShell", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Connections Discovery"}]}}, {"name": "GetNetTcpconnection with PowerShell Script Block", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Connections Discovery"}]}}, {"name": "GetWmiObject Ds Computer with PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}, {"name": "GetWmiObject Ds Computer with PowerShell Script Block", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}, {"name": "GetWmiObject Ds Group with PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Domain Groups"}]}}, {"name": "GetWmiObject Ds Group with PowerShell Script Block", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Domain Groups"}]}}, {"name": "GetWmiObject DS User with PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Account Discovery"}]}}, {"name": "GetWmiObject DS User with PowerShell Script Block", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Account Discovery"}]}}, {"name": "GetWmiObject User Account with PowerShell", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Discovery"}, {"mitre_attack_technique": "Local Account"}]}}, {"name": "GetWmiObject User Account with PowerShell Script Block", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Discovery"}, {"mitre_attack_technique": "Local Account"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Local Account Discovery with Net", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Discovery"}, {"mitre_attack_technique": "Local Account"}]}}, {"name": "Local Account Discovery With Wmic", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Discovery"}, {"mitre_attack_technique": "Local Account"}]}}, {"name": "Net Localgroup Discovery", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Local Groups"}]}}, {"name": "Network Connection Discovery With Arp", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Connections Discovery"}]}}, {"name": "Network Connection Discovery With Net", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Connections Discovery"}]}}, {"name": "Network Connection Discovery With Netstat", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Connections Discovery"}]}}, {"name": "Network Discovery Using Route Windows App", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Configuration Discovery"}, {"mitre_attack_technique": "Internet Connection Discovery"}]}}, {"name": "NLTest Domain Trust Discovery", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Trust Discovery"}]}}, {"name": "Password Policy Discovery with Net", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Policy Discovery"}]}}, {"name": "PowerShell Get LocalGroup Discovery", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Local Groups"}]}}, {"name": "Powershell Get LocalGroup Discovery with Script Block Logging", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Local Groups"}]}}, {"name": "Remote System Discovery with Adsisearcher", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}, {"name": "Remote System Discovery with Dsquery", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}, {"name": "Remote System Discovery with Net", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}, {"name": "Remote System Discovery with Wmic", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}, {"name": "ServicePrincipalNames Discovery with PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Kerberoasting"}]}}, {"name": "ServicePrincipalNames Discovery with SetSPN", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Kerberoasting"}]}}, {"name": "System User Discovery With Query", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Owner/User Discovery"}]}}, {"name": "System User Discovery With Whoami", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Owner/User Discovery"}]}}, {"name": "User Discovery With Env Vars PowerShell", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Owner/User Discovery"}]}}, {"name": "User Discovery With Env Vars PowerShell Script Block", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Owner/User Discovery"}]}}, {"name": "Windows Hidden Schedule Task Settings", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Windows Linked Policies In ADSI Discovery", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Account Discovery"}]}}, {"name": "Windows Root Domain linked policies Discovery", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Account Discovery"}]}}, {"name": "Wmic Group Discovery", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Local Groups"}]}}]}, {"name": "Active Directory Kerberos Attacks", "id": "38b8cf16-8461-11ec-ade1-acde48001122", "version": 1, "date": "2022-02-02", "author": "Mauricio Velazco, Splunk", "description": "Monitor for activities and techniques associated with Kerberos based attacks within with Active Directory environments.", "narrative": "Kerberos, initially named after Cerberus, the three-headed dog in Greek mythology, is a network authentication protocol that allows computers and users to prove their identity through a trusted third-party. This trusted third-party issues Kerberos tickets using symmetric encryption to allow users access to services and network resources based on their privilege level. Kerberos is the default authentication protocol used on Windows Active Directory networks since the introduction of Windows Server 2003. With Kerberos being the backbone of Windows authentication, it is commonly abused by adversaries across the different phases of a breach including initial access, privilege escalation, defense evasion, credential access, lateral movement, etc.\\ This Analytic Story groups detection use cases in which the Kerberos protocol is abused. Defenders can leverage these analytics to detect and hunt for adversaries engaging in Kerberos based attacks.", "references": ["https://en.wikipedia.org/wiki/Kerberos_(protocol)", "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9", "https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html", "https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/", "https://attack.mitre.org/techniques/T1558/003/", "https://attack.mitre.org/techniques/T1550/003/", "https://attack.mitre.org/techniques/T1558/004/"], "tags": {"name": "Active Directory Kerberos Attacks", "analytic_story": "Active Directory Kerberos Attacks", "category": ["Adversary Tactics", "Account Compromise", "Lateral Movement", "Privilege Escalation"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1558", "mitre_attack_technique": "Steal or Forge Kerberos Tickets", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1558.004", "mitre_attack_technique": "AS-REP Roasting", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1558.003", "mitre_attack_technique": "Kerberoasting", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "FIN7", "Wizard Spider"]}, {"mitre_attack_id": "T1558.001", "mitre_attack_technique": "Golden Ticket", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Ke3chang"]}, {"mitre_attack_id": "T1550", "mitre_attack_technique": "Use Alternate Authentication Material", "mitre_attack_tactics": ["Defense Evasion", "Lateral Movement"], "mitre_attack_groups": ["APT29"]}, {"mitre_attack_id": "T1589", "mitre_attack_technique": "Gather Victim Identity Information", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": ["APT32", "HEXANE", "LAPSUS$", "Magic Hound"]}, {"mitre_attack_id": "T1589.002", "mitre_attack_technique": "Email Addresses", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": ["APT32", "EXOTIC LILY", "HAFNIUM", "HEXANE", "Kimsuky", "LAPSUS$", "Lazarus Group", "Magic Hound", "MuddyWater", "Sandworm Team", "Silent Librarian", "TA551"]}, {"mitre_attack_id": "T1550.003", "mitre_attack_technique": "Pass the Ticket", "mitre_attack_tactics": ["Defense Evasion", "Lateral Movement"], "mitre_attack_groups": ["APT29", "APT32", "BRONZE BUTLER"]}, {"mitre_attack_id": "T1110.003", "mitre_attack_technique": "Password Spraying", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Chimera", "HEXANE", "Lazarus Group", "Leafminer", "Sandworm Team", "Silent Librarian"]}, {"mitre_attack_id": "T1110", "mitre_attack_technique": "Brute Force", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT38", "APT39", "DarkVishnya", "Dragonfly", "FIN5", "Fox Kitten", "HEXANE", "Lazarus Group", "OilRig", "Turla"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1078.002", "mitre_attack_technique": "Domain Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT29", "APT3", "Chimera", "Indrik Spider", "Naikon", "Sandworm Team", "TA505", "Threat Group-1314", "Wizard Spider"]}, {"mitre_attack_id": "T1018", "mitre_attack_technique": "Remote System Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "APT3", "APT32", "APT39", "BRONZE BUTLER", "Chimera", "Deep Panda", "Dragonfly", "Earth Lusca", "FIN5", "FIN6", "FIN8", "Fox Kitten", "GALLIUM", "HEXANE", "Indrik Spider", "Ke3chang", "Leafminer", "Naikon", "Rocke", "Sandworm Team", "Silence", "Threat Group-3390", "Turla", "Wizard Spider", "menuPass"]}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Discovery", "Initial Access", "Lateral Movement", "Persistence", "Privilege Escalation", "Reconnaissance"], "datamodels": ["Endpoint", "Network_Traffic"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Reconnaissance"]}, "detection_names": ["ESCU - Disabled Kerberos Pre-Authentication Discovery With Get-ADUser - Rule", "ESCU - Disabled Kerberos Pre-Authentication Discovery With PowerView - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Kerberos Pre-Authentication Flag Disabled in UserAccountControl - Rule", "ESCU - Kerberos Pre-Authentication Flag Disabled with PowerShell - Rule", "ESCU - Kerberos Service Ticket Request Using RC4 Encryption - Rule", "ESCU - Kerberos TGT Request Using RC4 Encryption - Rule", "ESCU - Kerberos User Enumeration - Rule", "ESCU - Mimikatz PassTheTicket CommandLine Parameters - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - PetitPotam Suspicious Kerberos TGT Request - Rule", "ESCU - Rubeus Command Line Parameters - Rule", "ESCU - Rubeus Kerberos Ticket Exports Through Winlogon Access - Rule", "ESCU - ServicePrincipalNames Discovery with PowerShell - Rule", "ESCU - ServicePrincipalNames Discovery with SetSPN - Rule", "ESCU - Suspicious Kerberos Service Ticket Request - Rule", "ESCU - Suspicious Ticket Granting Ticket Request - Rule", "ESCU - Unknown Process Using The Kerberos Protocol - Rule", "ESCU - Unusual Number of Kerberos Service Tickets Requested - Rule", "ESCU - Windows Computer Account Created by Computer Account - Rule", "ESCU - Windows Computer Account Requesting Kerberos Ticket - Rule", "ESCU - Windows Computer Account With SPN - Rule", "ESCU - Windows Disabled Users Failing To Authenticate Kerberos - Rule", "ESCU - Windows Get-AdComputer Unconstrained Delegation Discovery - Rule", "ESCU - Windows Invalid Users Failed Authentication via Kerberos - Rule", "ESCU - Windows Kerberos Local Successful Logon - Rule", "ESCU - Windows PowerView Constrained Delegation Discovery - Rule", "ESCU - Windows PowerView Kerberos Service Ticket Request - Rule", "ESCU - Windows PowerView SPN Discovery - Rule", "ESCU - Windows PowerView Unconstrained Delegation Discovery - Rule", "ESCU - Unusual Number of Computer Service Tickets Requested - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Mauricio Velazco", "detections": [{"name": "Disabled Kerberos Pre-Authentication Discovery With Get-ADUser", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}, {"mitre_attack_technique": "AS-REP Roasting"}]}}, {"name": "Disabled Kerberos Pre-Authentication Discovery With PowerView", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}, {"mitre_attack_technique": "AS-REP Roasting"}]}}, {"name": "Kerberoasting spn request with RC4 encryption", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}, {"mitre_attack_technique": "Kerberoasting"}]}}, {"name": "Kerberos Pre-Authentication Flag Disabled in UserAccountControl", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}, {"mitre_attack_technique": "AS-REP Roasting"}]}}, {"name": "Kerberos Pre-Authentication Flag Disabled with PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}, {"mitre_attack_technique": "AS-REP Roasting"}]}}, {"name": "Kerberos Service Ticket Request Using RC4 Encryption", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}, {"mitre_attack_technique": "Golden Ticket"}]}}, {"name": "Kerberos TGT Request Using RC4 Encryption", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Use Alternate Authentication Material"}]}}, {"name": "Kerberos User Enumeration", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Gather Victim Identity Information"}, {"mitre_attack_technique": "Email Addresses"}]}}, {"name": "Mimikatz PassTheTicket CommandLine Parameters", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Use Alternate Authentication Material"}, {"mitre_attack_technique": "Pass the Ticket"}]}}, {"name": "Multiple Users Failing To Authenticate From Host Using Kerberos", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Brute Force"}]}}, {"name": "PetitPotam Suspicious Kerberos TGT Request", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Rubeus Command Line Parameters", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Use Alternate Authentication Material"}, {"mitre_attack_technique": "Pass the Ticket"}, {"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}, {"mitre_attack_technique": "Kerberoasting"}, {"mitre_attack_technique": "AS-REP Roasting"}]}}, {"name": "Rubeus Kerberos Ticket Exports Through Winlogon Access", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Use Alternate Authentication Material"}, {"mitre_attack_technique": "Pass the Ticket"}]}}, {"name": "ServicePrincipalNames Discovery with PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Kerberoasting"}]}}, {"name": "ServicePrincipalNames Discovery with SetSPN", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Kerberoasting"}]}}, {"name": "Suspicious Kerberos Service Ticket Request", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Domain Accounts"}]}}, {"name": "Suspicious Ticket Granting Ticket Request", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Domain Accounts"}]}}, {"name": "Unknown Process Using The Kerberos Protocol", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Use Alternate Authentication Material"}]}}, {"name": "Unusual Number of Kerberos Service Tickets Requested", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}, {"mitre_attack_technique": "Kerberoasting"}]}}, {"name": "Windows Computer Account Created by Computer Account", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}]}}, {"name": "Windows Computer Account Requesting Kerberos Ticket", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}]}}, {"name": "Windows Computer Account With SPN", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}]}}, {"name": "Windows Disabled Users Failing To Authenticate Kerberos", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Brute Force"}]}}, {"name": "Windows Get-AdComputer Unconstrained Delegation Discovery", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}, {"name": "Windows Invalid Users Failed Authentication via Kerberos", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Brute Force"}]}}, {"name": "Windows Kerberos Local Successful Logon", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}]}}, {"name": "Windows PowerView Constrained Delegation Discovery", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}, {"name": "Windows PowerView Kerberos Service Ticket Request", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}, {"mitre_attack_technique": "Kerberoasting"}]}}, {"name": "Windows PowerView SPN Discovery", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}, {"mitre_attack_technique": "Kerberoasting"}]}}, {"name": "Windows PowerView Unconstrained Delegation Discovery", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}, {"name": "Unusual Number of Computer Service Tickets Requested", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}]}, {"name": "Active Directory Lateral Movement", "id": "399d65dc-1f08-499b-a259-aad9051f38ad", "version": 3, "date": "2021-12-09", "author": "David Dorsey, Mauricio Velazco Splunk", "description": "Detect and investigate tactics, techniques, and procedures around how attackers move laterally within an Active Directory environment. Since lateral movement is often a necessary step in a breach, it is important for cyber defenders to deploy detection coverage.", "narrative": "Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\\\nIndications of lateral movement in an Active Directory network can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, Service Control Manager, the DCOM protocol, WinRM or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or \"crown jewels\" to a persistent threat actor.\\\nAn adversary can use lateral movement for multiple purposes, including remote execution of tools, pivoting to additional systems, obtaining access to specific information or files, access to additional credentials, exfiltrating data, or delivering a secondary effect. Adversaries may use legitimate credentials alongside inherent network and operating-system functionality to remotely connect to other systems and remain under the radar of network defenders.\\\nIf there is evidence of lateral movement, it is imperative for analysts to collect evidence of the associated offending hosts. For example, an attacker might leverage host A to gain access to host B. From there, the attacker may try to move laterally to host C. In this example, the analyst should gather as much information as possible from all three hosts. \\\n It is also important to collect authentication logs for each host, to ensure that the offending accounts are well-documented. Analysts should account for all processes to ensure that the attackers did not install unauthorized software.", "references": ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html", "http://www.irongeek.com/i.php?page=videos/derbycon7/t405-hunting-lateral-movement-for-fun-and-profit-mauricio-velazco"], "tags": {"name": "Active Directory Lateral Movement", "analytic_story": "Active Directory Lateral Movement", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1550", "mitre_attack_technique": "Use Alternate Authentication Material", "mitre_attack_tactics": ["Defense Evasion", "Lateral Movement"], "mitre_attack_groups": ["APT29"]}, {"mitre_attack_id": "T1550.002", "mitre_attack_technique": "Pass the Hash", "mitre_attack_tactics": ["Defense Evasion", "Lateral Movement"], "mitre_attack_groups": ["APT1", "APT28", "APT32", "Chimera", "GALLIUM", "Kimsuky"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021.002", "mitre_attack_technique": "SMB/Windows Admin Shares", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT39", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "FIN8", "Fox Kitten", "Ke3chang", "Lazarus Group", "Moses Staff", "Orangeworm", "Sandworm Team", "Threat Group-1314", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1569", "mitre_attack_technique": "System Services", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1569.002", "mitre_attack_technique": "Service Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT32", "APT38", "APT39", "APT41", "Blue Mockingbird", "Chimera", "FIN6", "Ke3chang", "Silence", "Wizard Spider"]}, {"mitre_attack_id": "T1021.003", "mitre_attack_technique": "Distributed Component Object Model", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1047", "mitre_attack_technique": "Windows Management Instrumentation", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT29", "APT32", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "Earth Lusca", "FIN6", "FIN7", "FIN8", "GALLIUM", "Gamaredon Group", "Indrik Spider", "Lazarus Group", "Leviathan", "Magic Hound", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "Stealth Falcon", "Threat Group-3390", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1021.006", "mitre_attack_technique": "Windows Remote Management", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT29", "Chimera", "Threat Group-3390", "Wizard Spider"]}, {"mitre_attack_id": "T1218.014", "mitre_attack_technique": "MMC", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1053.002", "mitre_attack_technique": "At", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "BRONZE BUTLER", "Threat Group-3390"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1574.011", "mitre_attack_technique": "Services Registry Permissions Weakness", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021.001", "mitre_attack_technique": "Remote Desktop Protocol", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT1", "APT29", "APT3", "APT39", "APT41", "Axiom", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "HEXANE", "Kimsuky", "Lazarus Group", "Leviathan", "Magic Hound", "OilRig", "Patchwork", "Silence", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}], "mitre_attack_tactics": ["Defense Evasion", "Execution", "Initial Access", "Lateral Movement", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint", "Network_Traffic"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Executable File Written in Administrative SMB Share - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Interactive Session on Remote Endpoint with PowerShell - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Possible Lateral Movement PowerShell Spawn - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and Winrs - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell Script Block - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Short Lived Scheduled Task - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Windows Service Created with Suspicious Service Path - Rule", "ESCU - Windows Service Created Within Public Path - Rule", "ESCU - Windows Service Creation on Remote Endpoint - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - Windows Service Initiation on Remote Endpoint - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Wmiprsve LOLBAS Execution Process Spawn - Rule", "ESCU - Wsmprovhost LOLBAS Execution Process Spawn - Rule", "ESCU - Randomly Generated Scheduled Task Name - Rule", "ESCU - Randomly Generated Windows Service Name - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Unusual Number of Computer Service Tickets Requested - Rule", "ESCU - Unusual Number of Remote Endpoint Authentication Events - Rule", "ESCU - Remote Desktop Network Traffic - Rule"], "investigation_names": ["ESCU - Investigate Successful Remote Desktop Authentications - Response Task"], "baseline_names": ["ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Identify Systems Using Remote Desktop"], "author_company": "Mauricio Velazco Splunk", "author_name": "David Dorsey", "detections": [{"name": "Detect Activity Related to Pass the Hash Attacks", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Use Alternate Authentication Material"}, {"mitre_attack_technique": "Pass the Hash"}]}}, {"name": "Detect PsExec With accepteula Flag", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "SMB/Windows Admin Shares"}]}}, {"name": "Detect Renamed PSExec", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Services"}, {"mitre_attack_technique": "Service Execution"}]}}, {"name": "Executable File Written in Administrative SMB Share", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "SMB/Windows Admin Shares"}]}}, {"name": "Impacket Lateral Movement Commandline Parameters", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "SMB/Windows Admin Shares"}, {"mitre_attack_technique": "Distributed Component Object Model"}, {"mitre_attack_technique": "Windows Management Instrumentation"}, {"mitre_attack_technique": "Windows Service"}]}}, {"name": "Interactive Session on Remote Endpoint with PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "Windows Remote Management"}]}}, {"name": "Mmc LOLBAS Execution Process Spawn", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "Distributed Component Object Model"}, {"mitre_attack_technique": "MMC"}]}}, {"name": "Possible Lateral Movement PowerShell Spawn", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "Distributed Component Object Model"}, {"mitre_attack_technique": "Windows Remote Management"}, {"mitre_attack_technique": "Windows Management Instrumentation"}, {"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Windows Service"}, {"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "MMC"}]}}, {"name": "Remote Process Instantiation via DCOM and PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "Distributed Component Object Model"}]}}, {"name": "Remote Process Instantiation via DCOM and PowerShell Script Block", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "Distributed Component Object Model"}]}}, {"name": "Remote Process Instantiation via WinRM and PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "Windows Remote Management"}]}}, {"name": "Remote Process Instantiation via WinRM and PowerShell Script Block", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "Windows Remote Management"}]}}, {"name": "Remote Process Instantiation via WinRM and Winrs", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "Windows Remote Management"}]}}, {"name": "Remote Process Instantiation via WMI", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation"}]}}, {"name": "Remote Process Instantiation via WMI and PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation"}]}}, {"name": "Remote Process Instantiation via WMI and PowerShell Script Block", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation"}]}}, {"name": "Scheduled Task Creation on Remote Endpoint using At", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}, {"mitre_attack_technique": "At"}]}}, {"name": "Scheduled Task Initiation on Remote Endpoint", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}, {"mitre_attack_technique": "Scheduled Task"}]}}, {"name": "Schtasks scheduling job on remote system", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Services LOLBAS Execution Process Spawn", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}, {"mitre_attack_technique": "Windows Service"}]}}, {"name": "Short Lived Scheduled Task", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}]}}, {"name": "Svchost LOLBAS Execution Process Spawn", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}, {"mitre_attack_technique": "Scheduled Task"}]}}, {"name": "Windows Service Created with Suspicious Service Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Services"}, {"mitre_attack_technique": "Service Execution"}]}}, {"name": "Windows Service Created Within Public Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}, {"mitre_attack_technique": "Windows Service"}]}}, {"name": "Windows Service Creation on Remote Endpoint", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}, {"mitre_attack_technique": "Windows Service"}]}}, {"name": "Windows Service Creation Using Registry Entry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Services Registry Permissions Weakness"}]}}, {"name": "Windows Service Initiation on Remote Endpoint", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}, {"mitre_attack_technique": "Windows Service"}]}}, {"name": "WinEvent Scheduled Task Created Within Public Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Wmiprsve LOLBAS Execution Process Spawn", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation"}]}}, {"name": "Wsmprovhost LOLBAS Execution Process Spawn", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "Windows Remote Management"}]}}, {"name": "Randomly Generated Scheduled Task Name", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}, {"mitre_attack_technique": "Scheduled Task"}]}}, {"name": "Randomly Generated Windows Service Name", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}, {"mitre_attack_technique": "Windows Service"}]}}, {"name": "Remote Desktop Process Running On System", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Desktop Protocol"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "Unusual Number of Computer Service Tickets Requested", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "Unusual Number of Remote Endpoint Authentication Events", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "Remote Desktop Network Traffic", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Desktop Protocol"}, {"mitre_attack_technique": "Remote Services"}]}}]}, {"name": "Active Directory Password Spraying", "id": "3de109da-97d2-11eb-8b6a-acde48001122", "version": 1, "date": "2021-04-07", "author": "Mauricio Velazco, Splunk", "description": "Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments.", "narrative": "In a password spraying attack, adversaries leverage one or a small list of commonly used / popular passwords against a large volume of usernames to acquire valid account credentials. Unlike a Brute Force attack that targets a specific user or small group of users with a large number of passwords, password spraying follows the opposite aproach and increases the chances of obtaining valid credentials while avoiding account lockouts. This allows adversaries to remain undetected if the target organization does not have the proper monitoring and detection controls in place.\\\nPassword Spraying can be leveraged by adversaries across different stages in an attack. It can be used to obtain an iniial access to an environment but can also be used to escalate privileges when access has been already achieved. In some scenarios, this technique capitalizes on a security policy most organizations implement, password rotation. As enterprise users change their passwords, it is possible some pick predictable, seasonal passwords such as `$CompanyNameWinter`, `Summer2021`, etc.\\\nSpecifically, this Analytic Story is focused on detecting possible Password Spraying attacks against Active Directory environments leveraging Windows Event Logs in the `Account Logon` and `Logon/Logoff` Advanced Audit Policy categories. It presents 9 detection analytics which can aid defenders in identifying instances where one source user, source host or source process attempts to authenticate against a target or targets using a high, unsual, number of unique users. A user, host or process attempting to authenticate with multiple users is not common behavior for legitimate systems and should be monitored by security teams. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, multi-user systems and missconfigured systems. These should be easily spotted when first implementing the detection and addded to an allow list or lookup table. The presented detections can also be used in Threat Hunting exercises.", "references": ["https://attack.mitre.org/techniques/T1110/003/", "https://www.microsoft.com/security/blog/2020/04/23/protecting-organization-password-spray-attacks/", "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn452415(v=ws.11)"], "tags": {"name": "Active Directory Password Spraying", "analytic_story": "Active Directory Password Spraying", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1110.003", "mitre_attack_technique": "Password Spraying", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Chimera", "HEXANE", "Lazarus Group", "Leafminer", "Sandworm Team", "Silent Librarian"]}, {"mitre_attack_id": "T1110", "mitre_attack_technique": "Brute Force", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT38", "APT39", "DarkVishnya", "Dragonfly", "FIN5", "Fox Kitten", "HEXANE", "Lazarus Group", "OilRig", "Turla"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": [], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule", "ESCU - Multiple Users Failing To Authenticate From Process - Rule", "ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule", "ESCU - Windows Disabled Users Failing To Authenticate Kerberos - Rule", "ESCU - Windows Invalid Users Failed Authentication via Kerberos - Rule", "ESCU - Windows Users Authenticate Using Explicit Credentials - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Mauricio Velazco", "detections": [{"name": "Multiple Invalid Users Failing To Authenticate From Host Using NTLM", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Brute Force"}]}}, {"name": "Multiple Users Failing To Authenticate From Host Using Kerberos", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Brute Force"}]}}, {"name": "Multiple Users Failing To Authenticate From Host Using NTLM", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Brute Force"}]}}, {"name": "Multiple Users Failing To Authenticate From Process", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Brute Force"}]}}, {"name": "Multiple Users Remotely Failing To Authenticate From Host", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Brute Force"}]}}, {"name": "Windows Disabled Users Failing To Authenticate Kerberos", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Brute Force"}]}}, {"name": "Windows Invalid Users Failed Authentication via Kerberos", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Brute Force"}]}}, {"name": "Windows Users Authenticate Using Explicit Credentials", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Brute Force"}]}}]}, {"name": "AgentTesla", "id": "9bb6077a-843e-418b-b134-c57ef997103c", "version": 1, "date": "2022-04-12", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the AgentTesla malware including .chm application child process, ftp/smtp connection, persistence and many more. AgentTesla is one of the advanced remote access trojans (RAT) that are capable of stealing sensitive information from the infected or targeted host machine. It can collect various types of data, including browser profile information, keystrokes, capture screenshots and vpn credentials. AgentTesla has been active malware since 2014 and often delivered as a malicious attachment in phishing emails.It is also the top malware in 2021 based on the CISA report.", "narrative": "Adversaries or threat actor may use this malware to maximize the impact of infection on the target organization in operations where network wide availability interruption is the goal.", "references": ["https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla", "https://cert.gov.ua/article/861292", "https://www.cisa.gov/uscert/ncas/alerts/aa22-216a", "https://www.joesandbox.com/analysis/702680/0/html"], "tags": {"name": "AgentTesla", "analytic_story": "AgentTesla", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.001", "mitre_attack_technique": "Compiled HTML File", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT38", "APT41", "Dark Caracal", "OilRig", "Silence"]}, {"mitre_attack_id": "T1548.002", "mitre_attack_technique": "Bypass User Account Control", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT29", "APT37", "BRONZE BUTLER", "Cobalt Group", "Earth Lusca", "Evilnum", "MuddyWater", "Patchwork", "Threat Group-3390"]}, {"mitre_attack_id": "T1548", "mitre_attack_technique": "Abuse Elevation Control Mechanism", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1555", "mitre_attack_technique": "Credentials from Password Stores", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "APT33", "APT39", "Evilnum", "FIN6", "HEXANE", "Leafminer", "MuddyWater", "OilRig", "Stealth Falcon"]}, {"mitre_attack_id": "T1555.003", "mitre_attack_technique": "Credentials from Web Browsers", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "APT3", "APT33", "APT37", "Ajax Security Team", "FIN6", "HEXANE", "Inception", "Kimsuky", "LAPSUS$", "Leafminer", "Molerats", "MuddyWater", "OilRig", "Patchwork", "Sandworm Team", "Stealth Falcon", "TA505", "ZIRCONIUM"]}, {"mitre_attack_id": "T1566", "mitre_attack_technique": "Phishing", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["Axiom", "GOLD SOUTHFIELD"]}, {"mitre_attack_id": "T1566.001", "mitre_attack_technique": "Spearphishing Attachment", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "IndigoZebra", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1014", "mitre_attack_technique": "Rootkit", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT41", "Rocke", "TeamTNT", "Winnti Group"]}, {"mitre_attack_id": "T1068", "mitre_attack_technique": "Exploitation for Privilege Escalation", "mitre_attack_tactics": ["Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT33", "BITTER", "Cobalt Group", "FIN6", "FIN8", "LAPSUS$", "PLATINUM", "Threat Group-3390", "Tonto Team", "Turla", "Whitefly", "ZIRCONIUM"]}, {"mitre_attack_id": "T1071.003", "mitre_attack_technique": "Mail Protocols", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT28", "APT32", "Kimsuky", "SilverTerrier", "Turla"]}, {"mitre_attack_id": "T1071", "mitre_attack_technique": "Application Layer Protocol", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["Dragonfly", "Magic Hound", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1204.001", "mitre_attack_technique": "Malicious Link", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT33", "APT39", "BlackTech", "Cobalt Group", "Confucius", "EXOTIC LILY", "Earth Lusca", "Elderwood", "Ember Bear", "Evilnum", "FIN4", "FIN7", "FIN8", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Sandworm Team", "Sidewinder", "TA505", "Transparent Tribe", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1204", "mitre_attack_technique": "User Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["LAPSUS$"]}], "mitre_attack_tactics": ["Command And Control", "Credential Access", "Defense Evasion", "Execution", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Delivery", "Exploitation", "Installation"]}, "detection_names": ["ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Excessive Usage Of Taskkill - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Non Chrome Process Accessing Chrome Default Dir - Rule", "ESCU - Non Firefox Process Access Firefox Profile Dir - Rule", "ESCU - Office Application Drop Executable - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawn CMD Process - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - PowerShell - Connect To Internet With Hidden Window - Rule", "ESCU - PowerShell Loading DotNET into Memory via Reflection - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Suspicious Driver Loaded Path - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Windows Driver Load Non-Standard Path - Rule", "ESCU - Windows Drivers Loaded by Signature - Rule", "ESCU - Windows File Transfer Protocol In Non-Common Process Path - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Windows Mail Protocol In Non-Common Process Path - Rule", "ESCU - Windows Multi hop Proxy TOR Website Query - Rule", "ESCU - Windows Phishing Recent ISO Exec Registry - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Add or Set Windows Defender Exclusion", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Detect HTML Help Spawn Child Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Compiled HTML File"}]}}, {"name": "Disabling Remote User Account Control", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Excessive Usage Of Taskkill", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Executables Or Script Creation In Suspicious Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "Non Chrome Process Accessing Chrome Default Dir", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Credentials from Password Stores"}, {"mitre_attack_technique": "Credentials from Web Browsers"}]}}, {"name": "Non Firefox Process Access Firefox Profile Dir", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Credentials from Password Stores"}, {"mitre_attack_technique": "Credentials from Web Browsers"}]}}, {"name": "Office Application Drop Executable", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Application Spawn rundll32 process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Document Executing Macro Code", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Spawn CMD Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Spawning CertUtil", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "PowerShell - Connect To Internet With Hidden Window", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "PowerShell Loading DotNET into Memory via Reflection", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Powershell Windows Defender Exclusion Commands", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Scheduled Task Deleted Or Created via CMD", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Suspicious Driver Loaded Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Service"}, {"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Suspicious Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Windows Driver Load Non-Standard Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Rootkit"}]}}, {"name": "Windows Drivers Loaded by Signature", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Rootkit"}, {"mitre_attack_technique": "Exploitation for Privilege Escalation"}]}}, {"name": "Windows File Transfer Protocol In Non-Common Process Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Mail Protocols"}, {"mitre_attack_technique": "Application Layer Protocol"}]}}, {"name": "Windows ISO LNK File Creation", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Malicious Link"}, {"mitre_attack_technique": "User Execution"}]}}, {"name": "Windows Mail Protocol In Non-Common Process Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Mail Protocols"}, {"mitre_attack_technique": "Application Layer Protocol"}]}}, {"name": "Windows Multi hop Proxy TOR Website Query", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Mail Protocols"}, {"mitre_attack_technique": "Application Layer Protocol"}]}}, {"name": "Windows Phishing Recent ISO Exec Registry", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}]}}]}, {"name": "Apache Struts Vulnerability", "id": "2dcfd6a2-e7d2-4873-b6ba-adaf819d2a1e", "version": 1, "date": "2018-12-06", "author": "Rico Valdez, Splunk", "description": "Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities.", "narrative": "In March of 2017, a remote code-execution vulnerability in the Jakarta Multipart parser in Apache Struts, a widely used open-source framework for creating Java web applications, was disclosed and assigned to CVE-2017-5638. About two months later, hackers exploited the flaw to carry out the world's <a href=https://www.usatoday.com/story/tech/2017/09/07/nations-biggest-hacks-and-data-breaches-millions/644311001/> 5th largest data breach</a>. The target, credit giant Equifax, <a href=https://money.cnn.com/2017/09/16/technology/equifax-breach-security-hole/index.html>told investigators</a> that it had become aware of the vulnerability two months before the attack. \\\nThe exploit involved manipulating the `Content-Type HTTP` header to execute commands embedded in the header.\\\nThis Analytic Story contains two different searches that help to identify activity that may be related to this issue. The first search looks for characteristics of the `Content-Type` header consistent with attempts to exploit the vulnerability. This should be a relatively pertinent indicator, as the `Content-Type` header is generally consistent and does not have a large degree of variation.\\\nThe second search looks for the execution of various commands typically entered on the command shell when an attacker first lands on a system. These commands are not generally executed on web servers during the course of day-to-day operation, but they may be used when the system is undergoing maintenance or troubleshooting.\\\nFirst, it is helpful is to understand how often the notable event is generated, as well as the commonalities in some of these events. This may help determine whether this is a common occurrence that is of a lesser concern or a rare event that may require more extensive investigation. It can also help to understand whether the issue is restricted to a single user or system or is broader in scope.\\\nWhen looking at the target of the behavior illustrated by the event, you should note the sensitivity of the user and or/system to help determine the potential impact. It is also helpful to see what other events involving the target have occurred in the recent past. This can help tie different events together and give further situational awareness regarding the target.\\\nVarious types of information for external systems should be reviewed and (potentially) collected if the incident is, indeed, judged to be malicious. Information like this can be useful in generating your own threat intelligence to create alerts in the future.\\\nLooking at the country, responsible party, and fully qualified domain names associated with the external IP address--as well as the registration information associated with those domain names, if they are frequently visited by others--can help you answer the question of \"who,\" in regard to the external system. Answering that can help qualify the event and may serve useful for tracking. In addition, there are various sources that can provide some reputation information on the IP address or domain name, which can assist in determining if the event is malicious in nature. Finally, determining whether or not there are other events associated with the IP address may help connect some dots or show other events that should be brought into scope.\\\nGathering various data elements on the system of interest can sometimes help quickly determine that something suspicious may be happening. Some of these items include determining who else may have recently logged into the system, whether any unusual scheduled tasks exist, whether the system is communicating on suspicious ports, whether there are modifications to sensitive registry keys, and whether there are any known vulnerabilities on the system. This information can often highlight other activity commonly seen in attack scenarios or give more information about how the system may have been targeted.\\\nhen a specific service or application is targeted, it is often helpful to know the associated version to help determine whether or not it is vulnerable to a specific exploit.\\\nhen it is suspected there is an attack targeting a web server, it is helpful to look at some of the behavior of the web service to see if there is evidence that the service has been compromised. Some indications of this might be network connections to external resources, the web service spawning child processes that are not associated with typical behavior, and whether the service wrote any files that might be malicious in nature.\\\nIn the event that a suspicious file is found, we can review more information about it to help determine if it is, in fact, malicious. Identifying the file type, any processes that have the file open, what processes created and/or modified the file, and the number of systems that may have this file can help to determine if the file is malicious. Also, determining the file hash and checking it against reputation sources, such as VirusTotal, can sometimes quickly help determine whether it is malicious in nature.\\\nOften, a simple inspection of a suspect process name and path can tell you if the system has been compromised. For example, if `svchost.exe` is found running from a location other than `C:\\Windows\\System32`, it is likely something malicious designed to hide in plain sight when simply reviewing process names. Similarly, if the process itself seems legitimate, but the parent process is running from the temporary browser cache, there may be activity initiated via a compromised website the user visited.\\\nIt can also be very helpful to examine various behaviors of the process of interest or the parent of the process that is of interest. For example, if it turns out that the process of interest is malicious, it would be good to see if the parent to that process spawned other processes that might also be worth further scrutiny. If a process is suspect, reviewing the network connections made around the time of the event and/or if the process spawned any child processes could be helpful in determining whether it is malicious or executing a malicious script.", "references": ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"], "tags": {"name": "Apache Struts Vulnerability", "analytic_story": "Apache Struts Vulnerability", "category": ["Vulnerability"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1082", "mitre_attack_technique": "System Information Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT18", "APT19", "APT29", "APT3", "APT32", "APT37", "APT38", "Aquatic Panda", "Blue Mockingbird", "Chimera", "Confucius", "Darkhotel", "Gamaredon Group", "HEXANE", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Sowbug", "Stealth Falcon", "TeamTNT", "Tropic Trooper", "Turla", "Windigo", "Windshift", "Wizard Spider", "ZIRCONIUM", "admin@338"]}], "mitre_attack_tactics": ["Discovery"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation"]}, "detection_names": ["ESCU - Suspicious Java Classes - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Unusually Long Content-Type Length - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Rico Valdez", "detections": [{"name": "Suspicious Java Classes", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "Web Servers Executing Suspicious Processes", "source": "application", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Information Discovery"}]}}, {"name": "Unusually Long Content-Type Length", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}]}, {"name": "Asset Tracking", "id": "91c676cf-0b23-438d-abee-f6335e1fce77", "version": 1, "date": "2017-09-13", "author": "Bhavin Patel, Splunk", "description": "Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further.", "narrative": "This Analytic Story is designed to help you develop a better understanding of what authorized and unauthorized devices are part of your enterprise. This story can help you better categorize and classify assets, providing critical business context and awareness of their assets during an incident. Information derived from this Analytic Story can be used to better inform and support other analytic stories. For successful detection, you will need to leverage the Assets and Identity Framework from Enterprise Security to populate your known assets.", "references": ["https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/"], "tags": {"name": "Asset Tracking", "analytic_story": "Asset Tracking", "category": ["Best Practices"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [], "mitre_attack_tactics": [], "datamodels": ["Network_Sessions"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Reconnaissance"]}, "detection_names": ["ESCU - Detect Unauthorized Assets by MAC address - Rule"], "investigation_names": ["ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Response Task", "ESCU - Get Notable History - Response Task"], "baseline_names": ["ESCU - Count of assets by category"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Detect Unauthorized Assets by MAC address", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}]}, {"name": "AsyncRAT", "id": "d7053072-7dd2-4874-8314-bfcbc99978a4", "version": 1, "date": "2023-01-24", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the AsyncRAT malware including mshta application child process, bat loader execution, persistence and many more. AsyncRAT is an open source remote administration tool released last 2019. It's designed to remotely control computers via an encrypted connection, with view screen, keylogger, chat communication, persistence, defense evasion (e.g. Windows defender), DOS attack and many more.", "narrative": "although this project contains legal disclaimer, Adversaries or threat actors are popularly used in some attacks. This malware recently came across a Fully undetected batch script loader that downloads and loads the AsyncRAT from its C2 server. The batch script is obfuscated and will load a powershell loader that will decode and decrypt (AES256) the actual AsyncRAT malware.", "references": ["https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat", "https://www.netskope.com/blog/asyncrat-using-fully-undetected-downloader"], "tags": {"name": "AsyncRAT", "analytic_story": "AsyncRAT", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1036.003", "mitre_attack_technique": "Rename System Utilities", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT32", "GALLIUM", "Lazarus Group", "menuPass"]}, {"mitre_attack_id": "T1055", "mitre_attack_technique": "Process Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT32", "APT37", "APT41", "Cobalt Group", "Kimsuky", "PLATINUM", "Silence", "Turla"]}, {"mitre_attack_id": "T1055.001", "mitre_attack_technique": "Dynamic-link Library Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["BackdoorDiplomacy", "Lazarus Group", "Leviathan", "Putter Panda", "TA505", "Tropic Trooper", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1027", "mitre_attack_technique": "Obfuscated Files or Information", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "Aquatic Panda", "BITTER", "BackdoorDiplomacy", "BlackOasis", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Earth Lusca", "Elderwood", "Ember Bear", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Group5", "HEXANE", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leafminer", "Leviathan", "Magic Hound", "Mofang", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Putter Panda", "Rocke", "Sandworm Team", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Transparent Tribe", "Tropic Trooper", "Turla", "Whitefly", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1592", "mitre_attack_technique": "Gather Victim Host Information", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547.001", "mitre_attack_technique": "Registry Run Keys / Startup Folder", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Dark Caracal", "Darkhotel", "Dragonfly", "FIN10", "FIN6", "FIN7", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Putter Panda", "RTM", "Rocke", "Sidewinder", "Silence", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.010", "mitre_attack_technique": "Regsvr32", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "Blue Mockingbird", "Cobalt Group", "Deep Panda", "Inception", "Kimsuky", "Lazarus Group", "Leviathan", "TA551", "WIRTE"]}, {"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1059.005", "mitre_attack_technique": "Visual Basic", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT32", "APT33", "APT37", "APT38", "APT39", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Earth Lusca", "FIN4", "FIN7", "Gamaredon Group", "Gorgon Group", "HEXANE", "Higaisa", "Inception", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "Transparent Tribe", "Turla", "WIRTE", "Windshift"]}, {"mitre_attack_id": "T1134.002", "mitre_attack_technique": "Create Process with Token", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["Lazarus Group", "Turla"]}, {"mitre_attack_id": "T1134", "mitre_attack_technique": "Access Token Manipulation", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["Blue Mockingbird", "FIN6"]}, {"mitre_attack_id": "T1566.001", "mitre_attack_technique": "Spearphishing Attachment", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "IndigoZebra", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1566", "mitre_attack_technique": "Phishing", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["Axiom", "GOLD SOUTHFIELD"]}], "mitre_attack_tactics": ["Defense Evasion", "Execution", "Initial Access", "Persistence", "Privilege Escalation", "Reconnaissance"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Loading Of Dynwrapx Module - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - PowerShell Loading DotNET into Memory via Reflection - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Suspicious Copy on System32 - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Vbscript Execution Using Wscript App - Rule", "ESCU - Windows Access Token Manipulation SeDebugPrivilege - Rule", "ESCU - Windows Powershell Cryptography Namespace - Rule", "ESCU - Windows Scheduled Task with Highest Privileges - Rule", "ESCU - Windows Spearphishing Attachment Connect To None MS Office Domain - Rule", "ESCU - Windows Spearphishing Attachment Onenote Spawn Mshta - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "CMD Carry Out String Command Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Command Shell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Executables Or Script Creation In Suspicious Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "Execution of File with Multiple Extensions", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rename System Utilities"}]}}, {"name": "Loading Of Dynwrapx Module", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}, {"mitre_attack_technique": "Dynamic-link Library Injection"}]}}, {"name": "Malicious PowerShell Process - Execution Policy Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Powershell Fileless Script Contains Base64 Encoded Content", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "Obfuscated Files or Information"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "PowerShell Loading DotNET into Memory via Reflection", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Powershell Processing Stream Of Data", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Recon Using WMI Class", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Gather Victim Host Information"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Registry Keys Used For Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Registry Run Keys / Startup Folder"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Regsvr32 Silent and Install Param Dll Loading", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvr32"}]}}, {"name": "Regsvr32 with Known Silent Switch Cmdline", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvr32"}]}}, {"name": "Scheduled Task Deleted Or Created via CMD", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Suspicious Copy on System32", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "Masquerading"}]}}, {"name": "Suspicious Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Vbscript Execution Using Wscript App", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Visual Basic"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Windows Access Token Manipulation SeDebugPrivilege", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create Process with Token"}, {"mitre_attack_technique": "Access Token Manipulation"}]}}, {"name": "Windows Powershell Cryptography Namespace", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Windows Scheduled Task with Highest Privileges", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}, {"mitre_attack_technique": "Scheduled Task"}]}}, {"name": "Windows Spearphishing Attachment Connect To None MS Office Domain", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}]}}, {"name": "Windows Spearphishing Attachment Onenote Spawn Mshta", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}]}}, {"name": "WinEvent Scheduled Task Created Within Public Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "WinEvent Windows Task Scheduler Event Action Started", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}]}}]}, {"name": "Atlassian Confluence Server and Data Center CVE-2022-26134", "id": "91623a50-41fa-4c4e-8637-c239b80ff439", "version": 1, "date": "2022-06-03", "author": "Michael Haag, Splunk", "description": "On June 2, security researchers at Volexity published a blog outlining the discovery of an unauthenticated remote code execution zero day vulnerability (CVE-2022-26134) being actively exploited in Atlassian Confluence Server and Data Center instances in the wild. Atlassian released a fix within 24 hours of the blog''s release.", "narrative": "Atlassian describes the vulnerability as an Object-Graph Navigation Language (OGNL) injection allowing an unauthenticated user to execute arbitrary code on a Confluence Server or Data Server instance. Volexity did not release proof-of-concept (POC) exploit code, but researchers there have observed coordinated, widespread exploitation. Volexity first discovered the vulnerability over the weekend on two Internet-facing web servers running Confluence Server software. The investigation was due to suspicious activity on the hosts, including JSP webshells that were written to disk.", "references": ["https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html", "https://www.splunk.com/en_us/blog/security/atlassian-confluence-vulnerability-cve-2022-26134.html", "https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/", "https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/"], "tags": {"name": "Atlassian Confluence Server and Data Center CVE-2022-26134", "analytic_story": "Atlassian Confluence Server and Data Center CVE-2022-26134", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Application Security", "mitre_attack_enrichments": [{"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}, {"mitre_attack_id": "T1505", "mitre_attack_technique": "Server Software Component", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Initial Access", "Persistence"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Java Writing JSP File - Rule", "ESCU - Confluence Unauthenticated Remote Code Execution CVE-2022-26134 - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Java Writing JSP File", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Confluence Unauthenticated Remote Code Execution CVE-2022-26134", "source": "web", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "Exploit Public-Facing Application"}]}}]}, {"name": "AwfulShred", "id": "e36935ce-f48c-4fb2-8109-7e80c1cdc9e2", "version": 1, "date": "2023-01-24", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the AwfulShred malware including wiping files, process kill, system reboot via system request, shred,  and service stops.", "narrative": "AwfulShred is a malicious linux shell script designed to corrupt or wipe the linux targeted system. It uses shred command to overwrite files and to increase data damage. This obfuscated malicious script can also disable and corrupts apache, HTTP and SSH services, deactivate swap files, clear bash history and finally reboot the system.", "references": ["https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/", "https://cert.gov.ua/article/3718487"], "tags": {"name": "AwfulShred", "analytic_story": "AwfulShred", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1485", "mitre_attack_technique": "Data Destruction", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "Gamaredon Group", "LAPSUS$", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1070.004", "mitre_attack_technique": "File Deletion", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT3", "APT32", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Chimera", "Cobalt Group", "Dragonfly", "Evilnum", "FIN10", "FIN5", "FIN6", "FIN8", "Gamaredon Group", "Group5", "Kimsuky", "Lazarus Group", "Magic Hound", "Mustang Panda", "OilRig", "Patchwork", "Rocke", "Sandworm Team", "Silence", "TEMP.Veles", "TeamTNT", "The White Company", "Threat Group-3390", "Tropic Trooper", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1070", "mitre_attack_technique": "Indicator Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Lazarus Group"]}, {"mitre_attack_id": "T1489", "mitre_attack_technique": "Service Stop", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["Indrik Spider", "Lazarus Group", "Wizard Spider"]}, {"mitre_attack_id": "T1200", "mitre_attack_technique": "Hardware Additions", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["DarkVishnya"]}, {"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1053.006", "mitre_attack_technique": "Systemd Timers", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1529", "mitre_attack_technique": "System Shutdown/Reboot", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT37", "APT38", "Lazarus Group"]}, {"mitre_attack_id": "T1059.004", "mitre_attack_technique": "Unix Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT41", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}], "mitre_attack_tactics": ["Defense Evasion", "Execution", "Impact", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Linux Data Destruction Command - Rule", "ESCU - Linux Deleting Critical Directory Using RM Command - Rule", "ESCU - Linux Deletion Of Services - Rule", "ESCU - Linux Disable Services - Rule", "ESCU - Linux Hardware Addition SwapOff - Rule", "ESCU - Linux Impair Defenses Process Kill - Rule", "ESCU - Linux Indicator Removal Clear Cache - Rule", "ESCU - Linux Indicator Removal Service File Deletion - Rule", "ESCU - Linux Service Restarted - Rule", "ESCU - Linux Shred Overwrite Command - Rule", "ESCU - Linux Stop Services - Rule", "ESCU - Linux System Reboot Via System Request Key - Rule", "ESCU - Linux Unix Shell Enable All SysRq Functions - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Linux Data Destruction Command", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Linux Deleting Critical Directory Using RM Command", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Linux Deletion Of Services", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}, {"mitre_attack_technique": "File Deletion"}, {"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "Linux Disable Services", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Service Stop"}]}}, {"name": "Linux Hardware Addition SwapOff", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Hardware Additions"}]}}, {"name": "Linux Impair Defenses Process Kill", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Linux Indicator Removal Clear Cache", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "Linux Indicator Removal Service File Deletion", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File Deletion"}, {"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "Linux Service Restarted", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Systemd Timers"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Shred Overwrite Command", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Linux Stop Services", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Service Stop"}]}}, {"name": "Linux System Reboot Via System Request Key", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Shutdown/Reboot"}]}}, {"name": "Linux Unix Shell Enable All SysRq Functions", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Unix Shell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}]}, {"name": "AWS Cross Account Activity", "id": "2f2f610a-d64d-48c2-b57c-967a2b49ab5a", "version": 1, "date": "2018-06-04", "author": "David Dorsey, Splunk", "description": "Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity.", "narrative": "Amazon Web Services (AWS) admins manage access to AWS resources and services across the enterprise using AWS's Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage AWS users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as EC2 instances, the AWS Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\\\nHerein lies the rub. In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\\\nThis Analytic Story includes searches that will help you monitor your AWS CloudTrail logs for evidence of suspicious cross-account activity.  For example, while accessing multiple AWS accounts and roles may be perfectly valid behavior, it may be suspicious when an account requests privileges of an account it has not accessed in the past. After identifying suspicious activities, you can use the provided investigative searches to help you probe more deeply.", "references": ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"], "tags": {"name": "AWS Cross Account Activity", "analytic_story": "AWS Cross Account Activity", "category": ["Cloud Security"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1550", "mitre_attack_technique": "Use Alternate Authentication Material", "mitre_attack_tactics": ["Defense Evasion", "Lateral Movement"], "mitre_attack_groups": ["APT29"]}], "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Lateral Movement", "Persistence", "Privilege Escalation"], "datamodels": [], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect sts get session token abuse - Rule"], "investigation_names": ["ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"], "baseline_names": ["ESCU - Previously Seen AWS Cross Account Activity"], "author_company": "Splunk", "author_name": "David Dorsey", "detections": [{"name": "aws detect attach to role policy", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "aws detect permanent key creation", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "aws detect role creation", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "aws detect sts assume role abuse", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "aws detect sts get session token abuse", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Use Alternate Authentication Material"}]}}]}, {"name": "AWS Defense Evasion", "id": "4e00b690-293f-434d-a9d8-bcfb2ea5fff9", "version": 1, "date": "2022-07-15", "author": "Gowthamaraj Rajendran, Splunk", "description": "Identify activity and techniques associated with the Evasion of Defenses within AWS, such as Disabling CloudTrail, Deleting CloudTrail and many others.", "narrative": "Adversaries employ a variety of techniques in order to avoid detection and operate without barriers. This often involves modifying the configuration of security monitoring tools to get around them or explicitly disabling them to prevent them from running. This Analytic Story includes analytics that identify activity consistent with adversaries attempting to disable various security mechanisms on AWS. Such activity may involve deleting the CloudTrail logs , as this is where all the AWS logs get stored or explicitly changing the retention policy of S3 buckets. Other times, adversaries attempt deletion of a specified AWS CloudWatch log group.", "references": ["https://attack.mitre.org/tactics/TA0005/"], "tags": {"name": "AWS Defense Evasion", "analytic_story": "AWS Defense Evasion", "category": ["Cloud Security"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1562.008", "mitre_attack_technique": "Disable Cloud Logs", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}], "mitre_attack_tactics": ["Defense Evasion"], "datamodels": [], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - AWS Defense Evasion Delete Cloudtrail - Rule", "ESCU - AWS Defense Evasion Delete CloudWatch Log Group - Rule", "ESCU - AWS Defense Evasion Impair Security Services - Rule", "ESCU - AWS Defense Evasion PutBucketLifecycle - Rule", "ESCU - AWS Defense Evasion Stop Logging Cloudtrail - Rule", "ESCU - AWS Defense Evasion Update Cloudtrail - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Gowthamaraj Rajendran", "detections": [{"name": "AWS Defense Evasion Delete Cloudtrail", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable Cloud Logs"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "AWS Defense Evasion Delete CloudWatch Log Group", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Impair Defenses"}, {"mitre_attack_technique": "Disable Cloud Logs"}]}}, {"name": "AWS Defense Evasion Impair Security Services", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable Cloud Logs"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "AWS Defense Evasion PutBucketLifecycle", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable Cloud Logs"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "AWS Defense Evasion Stop Logging Cloudtrail", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable Cloud Logs"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "AWS Defense Evasion Update Cloudtrail", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Impair Defenses"}, {"mitre_attack_technique": "Disable Cloud Logs"}]}}]}, {"name": "AWS IAM Privilege Escalation", "id": "ced74200-8465-4bc3-bd2c-22782eec6750", "version": 1, "date": "2021-03-08", "author": "Bhavin Patel, Splunk", "description": "This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation.", "narrative": "Amazon Web Services provides a neat feature called Identity and Access Management (IAM) that enables organizations to manage various AWS services and resources in a secure way. All IAM users have roles, groups and policies associated with them which governs and sets permissions to allow a user to access specific restrictions.\\\nHowever, if these IAM policies are misconfigured and have specific combinations of weak permissions; it can allow attackers to escalate their privileges and further compromise the organization. Rhino Security Labs have published comprehensive blogs detailing various AWS Escalation methods. By using this as an inspiration, Splunks research team wants to highlight how these attack vectors look in AWS Cloudtrail logs and provide you with detection queries to uncover these potentially malicious events via this Analytic Story. ", "references": ["https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/", "https://www.cyberark.com/resources/threat-research-blog/the-cloud-shadow-admin-threat-10-permissions-to-protect", "https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws"], "tags": {"name": "AWS IAM Privilege Escalation", "analytic_story": "AWS IAM Privilege Escalation", "category": ["Cloud Security"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1078.004", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Ke3chang", "LAPSUS$"]}, {"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1136.003", "mitre_attack_technique": "Cloud Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT29", "LAPSUS$"]}, {"mitre_attack_id": "T1136", "mitre_attack_technique": "Create Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["Indrik Spider", "Sandworm Team"]}, {"mitre_attack_id": "T1580", "mitre_attack_technique": "Cloud Infrastructure Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1110", "mitre_attack_technique": "Brute Force", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT38", "APT39", "DarkVishnya", "Dragonfly", "FIN5", "Fox Kitten", "HEXANE", "Lazarus Group", "OilRig", "Turla"]}, {"mitre_attack_id": "T1098", "mitre_attack_technique": "Account Manipulation", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT3", "Dragonfly", "Kimsuky", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1069.003", "mitre_attack_technique": "Cloud Groups", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1069", "mitre_attack_technique": "Permission Groups Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "APT3", "TA505"]}, {"mitre_attack_id": "T1201", "mitre_attack_technique": "Password Policy Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["Chimera", "OilRig", "Turla"]}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Discovery", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": [], "kill_chain_phases": ["Actions on Objectives", "Reconnaissance"]}, "detection_names": ["ESCU - AWS Create Policy Version to allow all resources - Rule", "ESCU - AWS CreateAccessKey - Rule", "ESCU - AWS CreateLoginProfile - Rule", "ESCU - AWS IAM Assume Role Policy Brute Force - Rule", "ESCU - AWS IAM Delete Policy - Rule", "ESCU - AWS IAM Failure Group Deletion - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Password Policy Changes - Rule", "ESCU - AWS SetDefaultPolicyVersion - Rule", "ESCU - AWS UpdateLoginProfile - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "AWS Create Policy Version to allow all resources", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "AWS CreateAccessKey", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Account"}, {"mitre_attack_technique": "Create Account"}]}}, {"name": "AWS CreateLoginProfile", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Account"}, {"mitre_attack_technique": "Create Account"}]}}, {"name": "AWS IAM Assume Role Policy Brute Force", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Infrastructure Discovery"}, {"mitre_attack_technique": "Brute Force"}]}}, {"name": "AWS IAM Delete Policy", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Manipulation"}]}}, {"name": "AWS IAM Failure Group Deletion", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Manipulation"}]}}, {"name": "AWS IAM Successful Group Deletion", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Groups"}, {"mitre_attack_technique": "Account Manipulation"}, {"mitre_attack_technique": "Permission Groups Discovery"}]}}, {"name": "AWS Password Policy Changes", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Policy Discovery"}]}}, {"name": "AWS SetDefaultPolicyVersion", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "AWS UpdateLoginProfile", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Account"}, {"mitre_attack_technique": "Create Account"}]}}]}, {"name": "AWS Identity and Access Management Account Takeover", "id": "4210b690-293f-411d-a9d8-bcfb2ea5fff9", "version": 2, "date": "2022-08-19", "author": "Gowthamaraj Rajendran, Bhavin Patel,  Splunk", "description": "Identify activity and techniques associated with accessing credential files from AWS resources, monitor unusual authentication related activities to the AWS Console and other services such as RDS.", "narrative": "Amazon Web Services provides a web service known as Identity and Access Management(IAM) for controlling and securly managing various AWS resources. This is basically the foundation of how users in AWS interact with various resources/services in cloud and vice versa. Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. Adversaries employ a variety of techniques to steal AWS Cloud credentials like account names, passwords and keys and takeover legitmate user accounts. Usage of legitimate keys will assist the attackers to gain access to other sensitive system and they can also mimic legitimate behaviour making them harder to be detected. Such activity may involve multiple failed login to the console, new console logins and password reset activities.", "references": ["https://attack.mitre.org/tactics/TA0006/"], "tags": {"name": "AWS Identity and Access Management Account Takeover", "analytic_story": "AWS Identity and Access Management Account Takeover", "category": ["Cloud Security"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1586", "mitre_attack_technique": "Compromise Accounts", "mitre_attack_tactics": ["Resource Development"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1586.003", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Resource Development"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1621", "mitre_attack_technique": "Multi-Factor Authentication Request Generation", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "LAPSUS$"]}, {"mitre_attack_id": "T1110", "mitre_attack_technique": "Brute Force", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT38", "APT39", "DarkVishnya", "Dragonfly", "FIN5", "Fox Kitten", "HEXANE", "Lazarus Group", "OilRig", "Turla"]}, {"mitre_attack_id": "T1110.001", "mitre_attack_technique": "Password Guessing", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28"]}, {"mitre_attack_id": "T1201", "mitre_attack_technique": "Password Policy Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["Chimera", "OilRig", "Turla"]}, {"mitre_attack_id": "T1110.003", "mitre_attack_technique": "Password Spraying", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Chimera", "HEXANE", "Lazarus Group", "Leafminer", "Sandworm Team", "Silent Librarian"]}, {"mitre_attack_id": "T1110.004", "mitre_attack_technique": "Credential Stuffing", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Chimera"]}, {"mitre_attack_id": "T1556", "mitre_attack_technique": "Modify Authentication Process", "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1556.006", "mitre_attack_technique": "Multi-Factor Authentication", "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1078.004", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Ke3chang", "LAPSUS$"]}, {"mitre_attack_id": "T1535", "mitre_attack_technique": "Unused/Unsupported Cloud Regions", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1552", "mitre_attack_technique": "Unsecured Credentials", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Discovery", "Initial Access", "Persistence", "Privilege Escalation", "Resource Development"], "datamodels": ["Authentication", "Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - AWS Console Login Failed During MFA Challenge - Rule", "ESCU - AWS Credential Access Failed Login - Rule", "ESCU - AWS Credential Access GetPasswordData - Rule", "ESCU - AWS Credential Access RDS Password reset - Rule", "ESCU - AWS High Number Of Failed Authentications For User - Rule", "ESCU - AWS High Number Of Failed Authentications From Ip - Rule", "ESCU - AWS Multi-Factor Authentication Disabled - Rule", "ESCU - AWS Multiple Failed MFA Requests For User - Rule", "ESCU - AWS Multiple Users Failing To Authenticate From Ip - Rule", "ESCU - AWS Successful Single-Factor Authentication - Rule", "ESCU - AWS Unusual Number of Failed Authentications From Ip - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by New User - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Bhavin Patel,  Splunk", "author_name": "Gowthamaraj Rajendran", "detections": [{"name": "AWS Console Login Failed During MFA Challenge", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Multi-Factor Authentication Request Generation"}]}}, {"name": "AWS Credential Access Failed Login", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Brute Force"}, {"mitre_attack_technique": "Password Guessing"}]}}, {"name": "AWS Credential Access GetPasswordData", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Brute Force"}, {"mitre_attack_technique": "Password Guessing"}]}}, {"name": "AWS Credential Access RDS Password reset", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Brute Force"}]}}, {"name": "AWS High Number Of Failed Authentications For User", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Policy Discovery"}]}}, {"name": "AWS High Number Of Failed Authentications From Ip", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Brute Force"}, {"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Credential Stuffing"}]}}, {"name": "AWS Multi-Factor Authentication Disabled", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Multi-Factor Authentication Request Generation"}, {"mitre_attack_technique": "Modify Authentication Process"}, {"mitre_attack_technique": "Multi-Factor Authentication"}]}}, {"name": "AWS Multiple Failed MFA Requests For User", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Multi-Factor Authentication Request Generation"}]}}, {"name": "AWS Multiple Users Failing To Authenticate From Ip", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Brute Force"}, {"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Credential Stuffing"}]}}, {"name": "AWS Successful Single-Factor Authentication", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}]}}, {"name": "AWS Unusual Number of Failed Authentications From Ip", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Brute Force"}, {"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Credential Stuffing"}]}}, {"name": "Detect AWS Console Login by User from New City", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}, {"name": "Detect AWS Console Login by User from New Country", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}, {"name": "Detect AWS Console Login by User from New Region", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}, {"name": "Detect AWS Console Login by New User", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Unsecured Credentials"}]}}]}, {"name": "AWS Network ACL Activity", "id": "2e8948a5-5239-406b-b56b-6c50ff268af4", "version": 2, "date": "2018-05-21", "author": "Bhavin Patel, Splunk", "description": "Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.", "narrative": "AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls.", "references": ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"], "tags": {"name": "AWS Network ACL Activity", "analytic_story": "AWS Network ACL Activity", "category": ["Cloud Security"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1562.007", "mitre_attack_technique": "Disable or Modify Cloud Firewall", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}], "mitre_attack_tactics": ["Defense Evasion"], "datamodels": [], "kill_chain_phases": ["Actions on Objectives", "Command & Control"]}, "detection_names": ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"], "investigation_names": ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"], "baseline_names": ["ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Baseline of Network ACL Activity by ARN"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "AWS Network Access Control List Created with All Open Ports", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Cloud Firewall"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "AWS Network Access Control List Deleted", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Cloud Firewall"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Detect Spike in Network ACL Activity", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Cloud Firewall"}]}}, {"name": "Detect Spike in blocked Outbound Traffic from your AWS", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}]}, {"name": "AWS Security Hub Alerts", "id": "2f2f610a-d64d-48c2-b57c-96722b49ab5a", "version": 1, "date": "2020-08-04", "author": "Bhavin Patel, Splunk", "description": "This story is focused around detecting Security Hub alerts generated from AWS", "narrative": "AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager.", "references": ["https://aws.amazon.com/security-hub/features/"], "tags": {"name": "AWS Security Hub Alerts", "analytic_story": "AWS Security Hub Alerts", "category": ["Cloud Security"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [], "mitre_attack_tactics": [], "datamodels": [], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule"], "investigation_names": ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Detect Spike in AWS Security Hub Alerts for EC2 Instance", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "Detect Spike in AWS Security Hub Alerts for User", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}]}, {"name": "AWS User Monitoring", "id": "2e8948a5-5239-406b-b56b-6c50f1269af3", "version": 1, "date": "2018-03-12", "author": "Bhavin Patel, Splunk", "description": "Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment.", "narrative": "It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\\\nIn addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new EC2 instances and increased bandwidth usage. \\\nFortunately, you can leverage Amazon Web Services (AWS) CloudTrail--a tool that helps you enable governance, compliance, and risk auditing of your AWS account--to give you increased visibility into your user and resource activity by recording AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from which the calls were made, and when the calls occurred.\\\nThe detection searches in this Analytic Story are designed to help you uncover AWS API activities from users not listed in the identity table, as well as similar activities from disabled accounts.", "references": ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"], "tags": {"name": "AWS User Monitoring", "analytic_story": "AWS User Monitoring", "category": ["Cloud Security"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1526", "mitre_attack_technique": "Cloud Service Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1078.004", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Ke3chang", "LAPSUS$"]}], "mitre_attack_tactics": ["Defense Evasion", "Discovery", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": [], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"], "baseline_names": ["ESCU - Baseline of Security Group Activity by ARN", "ESCU - Create a list of approved AWS service accounts", "ESCU - Baseline of API Calls per User ARN", "ESCU - Previously seen API call per user roles in CloudTrail"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "AWS Excessive Security Scanning", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Service Discovery"}]}}, {"name": "Detect API activity from users without MFA", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Detect AWS API Activities From Unapproved Accounts", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}]}}, {"name": "Detect new API calls from user roles", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}]}}, {"name": "Detect Spike in AWS API Activity", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}]}}, {"name": "Detect Spike in Security Group Activity", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}]}}]}, {"name": "Azorult", "id": "efed5343-4ac2-42b1-a16d-da2428d0ce94", "version": 1, "date": "2022-06-09", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the Azorult malware including firewall modification, icacl execution, spawning more process, botnet c2 communication, defense evasion and etc. The AZORULT malware was first discovered in 2016 to be an information stealer that steals browsing history, cookies, ID/passwords, cryptocurrency information and more. It can also be a downloader of other malware. A variant of this malware was able to create a new, hidden administrator account on the machine to set a registry key to establish a Remote Desktop Protocol (RDP) connection. Exploit kits such as Fallout Exploit Kit (EK) and phishing mails with social engineering technique are one of the major infection vectors of the AZORult malware. The current malspam and phishing emails use fake product order requests, invoice documents and payment information requests. This Trojan-Spyware connects to command and control (C&C) servers of attacker to send and receive information.", "narrative": "Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption is the goal.", "references": ["https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null", "https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/"], "tags": {"name": "Azorult", "analytic_story": "Azorult", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1021.001", "mitre_attack_technique": "Remote Desktop Protocol", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT1", "APT29", "APT3", "APT39", "APT41", "Axiom", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "HEXANE", "Kimsuky", "Lazarus Group", "Leviathan", "Magic Hound", "OilRig", "Patchwork", "Silence", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1548", "mitre_attack_technique": "Abuse Elevation Control Mechanism", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1136.001", "mitre_attack_technique": "Local Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT3", "APT39", "APT41", "Dragonfly", "Fox Kitten", "Kimsuky", "Leafminer", "Magic Hound", "TeamTNT"]}, {"mitre_attack_id": "T1136", "mitre_attack_technique": "Create Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["Indrik Spider", "Sandworm Team"]}, {"mitre_attack_id": "T1564.001", "mitre_attack_technique": "Hidden Files and Directories", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT32", "Lazarus Group", "Mustang Panda", "Rocke", "Transparent Tribe", "Tropic Trooper"]}, {"mitre_attack_id": "T1564", "mitre_attack_technique": "Hide Artifacts", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1548.002", "mitre_attack_technique": "Bypass User Account Control", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT29", "APT37", "BRONZE BUTLER", "Cobalt Group", "Earth Lusca", "Evilnum", "MuddyWater", "Patchwork", "Threat Group-3390"]}, {"mitre_attack_id": "T1489", "mitre_attack_technique": "Service Stop", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["Indrik Spider", "Lazarus Group", "Wizard Spider"]}, {"mitre_attack_id": "T1222", "mitre_attack_technique": "File and Directory Permissions Modification", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1531", "mitre_attack_technique": "Account Access Removal", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["LAPSUS$"]}, {"mitre_attack_id": "T1569", "mitre_attack_technique": "System Services", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1569.002", "mitre_attack_technique": "Service Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT32", "APT38", "APT39", "APT41", "Blue Mockingbird", "Chimera", "FIN6", "Ke3chang", "Silence", "Wizard Spider"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1562.004", "mitre_attack_technique": "Disable or Modify System Firewall", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "APT38", "Carbanak", "Dragonfly", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1222.001", "mitre_attack_technique": "Windows File and Directory Permissions Modification", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Wizard Spider"]}, {"mitre_attack_id": "T1069", "mitre_attack_technique": "Permission Groups Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "APT3", "TA505"]}, {"mitre_attack_id": "T1069.001", "mitre_attack_technique": "Local Groups", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["Chimera", "HEXANE", "OilRig", "Tonto Team", "Turla", "admin@338"]}, {"mitre_attack_id": "T1049", "mitre_attack_technique": "System Network Connections Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT1", "APT3", "APT32", "APT38", "APT41", "Andariel", "BackdoorDiplomacy", "Chimera", "Earth Lusca", "GALLIUM", "HEXANE", "Ke3chang", "Lazarus Group", "Magic Hound", "MuddyWater", "Mustang Panda", "OilRig", "Poseidon Group", "Sandworm Team", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1555", "mitre_attack_technique": "Credentials from Password Stores", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "APT33", "APT39", "Evilnum", "FIN6", "HEXANE", "Leafminer", "MuddyWater", "OilRig", "Stealth Falcon"]}, {"mitre_attack_id": "T1555.003", "mitre_attack_technique": "Credentials from Web Browsers", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "APT3", "APT33", "APT37", "Ajax Security Team", "FIN6", "HEXANE", "Inception", "Kimsuky", "LAPSUS$", "Leafminer", "Molerats", "MuddyWater", "OilRig", "Patchwork", "Sandworm Team", "Stealth Falcon", "TA505", "ZIRCONIUM"]}, {"mitre_attack_id": "T1566", "mitre_attack_technique": "Phishing", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["Axiom", "GOLD SOUTHFIELD"]}, {"mitre_attack_id": "T1566.001", "mitre_attack_technique": "Spearphishing Attachment", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "IndigoZebra", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1547.001", "mitre_attack_technique": "Registry Run Keys / Startup Folder", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Dark Caracal", "Darkhotel", "Dragonfly", "FIN10", "FIN6", "FIN7", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Putter Panda", "RTM", "Rocke", "Sidewinder", "Silence", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1071", "mitre_attack_technique": "Application Layer Protocol", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["Dragonfly", "Magic Hound", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1590.005", "mitre_attack_technique": "IP Addresses", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": ["Andariel", "HAFNIUM"]}, {"mitre_attack_id": "T1590", "mitre_attack_technique": "Gather Victim Network Information", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": ["HAFNIUM"]}, {"mitre_attack_id": "T1204.001", "mitre_attack_technique": "Malicious Link", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT33", "APT39", "BlackTech", "Cobalt Group", "Confucius", "EXOTIC LILY", "Earth Lusca", "Elderwood", "Ember Bear", "Evilnum", "FIN4", "FIN7", "FIN8", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Sandworm Team", "Sidewinder", "TA505", "Transparent Tribe", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1204", "mitre_attack_technique": "User Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["LAPSUS$"]}, {"mitre_attack_id": "T1112", "mitre_attack_technique": "Modify Registry", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "APT38", "APT41", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN8", "Gamaredon Group", "Gorgon Group", "Kimsuky", "Magic Hound", "Patchwork", "Silence", "TA505", "Threat Group-3390", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1219", "mitre_attack_technique": "Remote Access Software", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["Carbanak", "Cobalt Group", "DarkVishnya", "Evilnum", "GOLD SOUTHFIELD", "Kimsuky", "MuddyWater", "Mustang Panda", "RTM", "Sandworm Team", "TeamTNT", "Thrip"]}], "mitre_attack_tactics": ["Command And Control", "Credential Access", "Defense Evasion", "Discovery", "Execution", "Impact", "Initial Access", "Lateral Movement", "Persistence", "Privilege Escalation", "Reconnaissance"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Installation", "Reconnaissance"]}, "detection_names": ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - CHCP Command Execution - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Disable Defender BlockAtFirstSeen Feature - Rule", "ESCU - Disable Defender Enhanced Notification - Rule", "ESCU - Disable Defender Spynet Reporting - Rule", "ESCU - Disable Defender Submit Samples Consent Feature - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Excessive Attempt To Disable Services - Rule", "ESCU - Excessive Usage Of Cacls App - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Excessive Usage Of Taskkill - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Firewall Allowed Program Enable - Rule", "ESCU - Hide User Account From Sign-In Screen - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Icacls Deny Command - Rule", "ESCU - Net Localgroup Discovery - Rule", "ESCU - Network Connection Discovery With Net - Rule", "ESCU - Non Firefox Process Access Firefox Profile Dir - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawn CMD Process - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Windows Application Layer Protocol RMS Radmin Tool Namedpipe - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Gather Victim Network Info Through Ip Check Web Services - Rule", "ESCU - Windows Impair Defense Add Xml Applocker Rules - Rule", "ESCU - Windows Impair Defense Deny Security Software With Applocker - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Windows Modify Registry Disable Toast Notifications - Rule", "ESCU - Windows Modify Registry Disable Win Defender Raw Write Notif - Rule", "ESCU - Windows Modify Registry Disable Windows Security Center Notif - Rule", "ESCU - Windows Modify Registry Disabling WER Settings - Rule", "ESCU - Windows Modify Registry DisAllow Windows App - Rule", "ESCU - Windows Modify Registry Regedit Silent Reg Import - Rule", "ESCU - Windows Modify Registry Suppress Win Defender Notif - Rule", "ESCU - Windows Phishing Recent ISO Exec Registry - Rule", "ESCU - Windows Powershell Import Applocker Policy - Rule", "ESCU - Windows Remote Access Software RMS Registry - Rule", "ESCU - Windows Remote Service Rdpwinst Tool Execution - Rule", "ESCU - Windows Remote Services Allow Rdp In Firewall - Rule", "ESCU - Windows Remote Services Allow Remote Assistance - Rule", "ESCU - Windows Remote Services Rdp Enable - Rule", "ESCU - Windows Service Stop By Deletion - Rule", "ESCU - Windows Valid Account With Never Expires Password - Rule", "ESCU - Wmic NonInteractive App Uninstallation - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Allow Inbound Traffic By Firewall Rule Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Desktop Protocol"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "Allow Operation with Consent Admin", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Attempt To Stop Security Service", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "CHCP Command Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "CMD Carry Out String Command Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Command Shell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Create local admin accounts using net exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Local Account"}, {"mitre_attack_technique": "Create Account"}]}}, {"name": "Detect Use of cmd exe to Launch Script Interpreters", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "Windows Command Shell"}]}}, {"name": "Disable Defender BlockAtFirstSeen Feature", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Defender Enhanced Notification", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Defender Spynet Reporting", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Defender Submit Samples Consent Feature", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Show Hidden Files", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Hidden Files and Directories"}, {"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Hide Artifacts"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Windows Behavior Monitoring", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disabling Remote User Account Control", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Excessive Attempt To Disable Services", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Service Stop"}]}}, {"name": "Excessive Usage Of Cacls App", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File and Directory Permissions Modification"}]}}, {"name": "Excessive Usage Of Net App", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Access Removal"}]}}, {"name": "Excessive Usage Of SC Service Utility", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Services"}, {"mitre_attack_technique": "Service Execution"}]}}, {"name": "Excessive Usage Of Taskkill", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Executables Or Script Creation In Suspicious Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "Firewall Allowed Program Enable", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify System Firewall"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Hide User Account From Sign-In Screen", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Hiding Files And Directories With Attrib exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File and Directory Permissions Modification"}, {"mitre_attack_technique": "Windows File and Directory Permissions Modification"}]}}, {"name": "Icacls Deny Command", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File and Directory Permissions Modification"}]}}, {"name": "Net Localgroup Discovery", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Local Groups"}]}}, {"name": "Network Connection Discovery With Net", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Connections Discovery"}]}}, {"name": "Non Firefox Process Access Firefox Profile Dir", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Credentials from Password Stores"}, {"mitre_attack_technique": "Credentials from Web Browsers"}]}}, {"name": "Office Document Executing Macro Code", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Spawn CMD Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Spawning MSHTA", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Processes launching netsh", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify System Firewall"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Registry Keys Used For Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Registry Run Keys / Startup Folder"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Sc exe Manipulating Windows Services", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Service"}, {"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Scheduled Task Deleted Or Created via CMD", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Suspicious Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Suspicious Scheduled Task from Public Directory", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Windows Application Layer Protocol RMS Radmin Tool Namedpipe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Application Layer Protocol"}]}}, {"name": "Windows Defender Exclusion Registry Entry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows DisableAntiSpyware Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows Gather Victim Network Info Through Ip Check Web Services", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "IP Addresses"}, {"mitre_attack_technique": "Gather Victim Network Information"}]}}, {"name": "Windows Impair Defense Add Xml Applocker Rules", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows Impair Defense Deny Security Software With Applocker", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows ISO LNK File Creation", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Malicious Link"}, {"mitre_attack_technique": "User Execution"}]}}, {"name": "Windows Modify Registry Disable Toast Notifications", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Modify Registry Disable Win Defender Raw Write Notif", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Modify Registry Disable Windows Security Center Notif", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Modify Registry Disabling WER Settings", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Modify Registry DisAllow Windows App", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Modify Registry Regedit Silent Reg Import", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Modify Registry Suppress Win Defender Notif", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Phishing Recent ISO Exec Registry", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}]}}, {"name": "Windows Powershell Import Applocker Policy", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "PowerShell"}]}}, {"name": "Windows Remote Access Software RMS Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Access Software"}]}}, {"name": "Windows Remote Service Rdpwinst Tool Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Desktop Protocol"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "Windows Remote Services Allow Rdp In Firewall", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Desktop Protocol"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "Windows Remote Services Allow Remote Assistance", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Desktop Protocol"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "Windows Remote Services Rdp Enable", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Desktop Protocol"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "Windows Service Stop By Deletion", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Service Stop"}]}}, {"name": "Windows Valid Account With Never Expires Password", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Service Stop"}]}}, {"name": "Wmic NonInteractive App Uninstallation", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}]}, {"name": "Azure Active Directory Account Takeover", "id": "41514c46-7118-4eab-a9bb-f3bfa4e3bea9", "version": 2, "date": "2022-07-14", "author": "Mauricio Velazco, Splunk", "description": "Monitor for activities and techniques associated with Account Takover attacks against Azure Active Directory tenants.", "narrative": "Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day. Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization. This analytic storic groups detections that can help security operations teams identify the potential compromise of Azure Active Directory accounts.", "references": ["https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis", "https://azure.microsoft.com/en-us/services/active-directory/#overview", "https://attack.mitre.org/techniques/T1586/", "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-compare-azure-ad-to-ad", "https://www.imperva.com/learn/application-security/account-takeover-ato/", "https://www.varonis.com/blog/azure-active-directory", "https://www.barracuda.com/glossary/account-takeover"], "tags": {"name": "Azure Active Directory Account Takeover", "analytic_story": "Azure Active Directory Account Takeover", "category": ["Adversary Tactics", "Account Compromise", "Cloud Security", "Privilege Escalation"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1556", "mitre_attack_technique": "Modify Authentication Process", "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1556.006", "mitre_attack_technique": "Multi-Factor Authentication", "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1586", "mitre_attack_technique": "Compromise Accounts", "mitre_attack_tactics": ["Resource Development"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1586.003", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Resource Development"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1110", "mitre_attack_technique": "Brute Force", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT38", "APT39", "DarkVishnya", "Dragonfly", "FIN5", "Fox Kitten", "HEXANE", "Lazarus Group", "OilRig", "Turla"]}, {"mitre_attack_id": "T1110.003", "mitre_attack_technique": "Password Spraying", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Chimera", "HEXANE", "Lazarus Group", "Leafminer", "Sandworm Team", "Silent Librarian"]}, {"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1078.004", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Ke3chang", "LAPSUS$"]}, {"mitre_attack_id": "T1621", "mitre_attack_technique": "Multi-Factor Authentication Request Generation", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "LAPSUS$"]}, {"mitre_attack_id": "T1185", "mitre_attack_technique": "Browser Session Hijacking", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1110.001", "mitre_attack_technique": "Password Guessing", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28"]}, {"mitre_attack_id": "T1110.004", "mitre_attack_technique": "Credential Stuffing", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Chimera"]}], "mitre_attack_tactics": ["Collection", "Credential Access", "Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation", "Resource Development"], "datamodels": [], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation"]}, "detection_names": ["ESCU - AWS New MFA Method Registered For User - Rule", "ESCU - Azure Active Directory High Risk Sign-in - Rule", "ESCU - Azure AD Authentication Failed During MFA Challenge - Rule", "ESCU - Azure AD Concurrent Sessions From Different Ips - Rule", "ESCU - Azure AD High Number Of Failed Authentications For User - Rule", "ESCU - Azure AD High Number Of Failed Authentications From Ip - Rule", "ESCU - Azure AD Multi-Factor Authentication Disabled - Rule", "ESCU - Azure AD Multiple Failed MFA Requests For User - Rule", "ESCU - Azure AD Multiple Users Failing To Authenticate From Ip - Rule", "ESCU - Azure AD New MFA Method Registered For User - Rule", "ESCU - Azure AD Successful Authentication From Different Ips - Rule", "ESCU - Azure AD Successful PowerShell Authentication - Rule", "ESCU - Azure AD Successful Single-Factor Authentication - Rule", "ESCU - Azure AD Unusual Number of Failed Authentications From Ip - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Mauricio Velazco", "detections": [{"name": "AWS New MFA Method Registered For User", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Authentication Process"}, {"mitre_attack_technique": "Multi-Factor Authentication"}]}}, {"name": "Azure Active Directory High Risk Sign-in", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Brute Force"}, {"mitre_attack_technique": "Password Spraying"}]}}, {"name": "Azure AD Authentication Failed During MFA Challenge", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Multi-Factor Authentication Request Generation"}]}}, {"name": "Azure AD Concurrent Sessions From Different Ips", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Browser Session Hijacking"}]}}, {"name": "Azure AD High Number Of Failed Authentications For User", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Brute Force"}, {"mitre_attack_technique": "Password Guessing"}]}}, {"name": "Azure AD High Number Of Failed Authentications From Ip", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Brute Force"}, {"mitre_attack_technique": "Password Guessing"}, {"mitre_attack_technique": "Password Spraying"}]}}, {"name": "Azure AD Multi-Factor Authentication Disabled", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Modify Authentication Process"}, {"mitre_attack_technique": "Multi-Factor Authentication"}]}}, {"name": "Azure AD Multiple Failed MFA Requests For User", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Multi-Factor Authentication Request Generation"}, {"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}]}}, {"name": "Azure AD Multiple Users Failing To Authenticate From Ip", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Brute Force"}, {"mitre_attack_technique": "Password Spraying"}]}}, {"name": "Azure AD New MFA Method Registered For User", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Authentication Process"}, {"mitre_attack_technique": "Multi-Factor Authentication"}]}}, {"name": "Azure AD Successful Authentication From Different Ips", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Brute Force"}, {"mitre_attack_technique": "Password Guessing"}, {"mitre_attack_technique": "Password Spraying"}]}}, {"name": "Azure AD Successful PowerShell Authentication", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}]}}, {"name": "Azure AD Successful Single-Factor Authentication", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}]}}, {"name": "Azure AD Unusual Number of Failed Authentications From Ip", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Brute Force"}, {"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Credential Stuffing"}]}}]}, {"name": "Azure Active Directory Persistence", "id": "dca983db-6334-4a0d-be32-80611ca1396c", "version": 1, "date": "2022-08-17", "author": "Mauricio Velazco, Splunk", "description": "Monitor for activities and techniques associated with the execution of Persistence techniques against Azure Active Directory tenants.", "narrative": "Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\\ Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. This analytic storic groups detections that can help security operations teams identify the potential execution of Persistence techniques targeting Azure Active Directory tenants. ", "references": ["https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis", "https://azure.microsoft.com/en-us/services/active-directory/#overview", "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-compare-azure-ad-to-ad", "https://attack.mitre.org/tactics/TA0003/", "https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/Persistence/"], "tags": {"name": "Azure Active Directory Persistence", "analytic_story": "Azure Active Directory Persistence", "category": ["Cloud Security"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1136.003", "mitre_attack_technique": "Cloud Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT29", "LAPSUS$"]}, {"mitre_attack_id": "T1098.003", "mitre_attack_technique": "Additional Cloud Roles", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT29", "LAPSUS$"]}, {"mitre_attack_id": "T1484", "mitre_attack_technique": "Domain Policy Modification", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1484.002", "mitre_attack_technique": "Domain Trust Modification", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT29"]}, {"mitre_attack_id": "T1098", "mitre_attack_technique": "Account Manipulation", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT3", "Dragonfly", "Kimsuky", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1098.001", "mitre_attack_technique": "Additional Cloud Credentials", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT29"]}, {"mitre_attack_id": "T1136", "mitre_attack_technique": "Create Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["Indrik Spider", "Sandworm Team"]}, {"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1078.004", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Ke3chang", "LAPSUS$"]}], "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": [], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation"]}, "detection_names": ["ESCU - Azure AD External Guest User Invited - Rule", "ESCU - Azure AD Global Administrator Role Assigned - Rule", "ESCU - Azure AD New Custom Domain Added - Rule", "ESCU - Azure AD New Federated Domain Added - Rule", "ESCU - Azure AD Privileged Role Assigned - Rule", "ESCU - Azure AD Service Principal Created - Rule", "ESCU - Azure AD Service Principal New Client Credentials - Rule", "ESCU - Azure AD Service Principal Owner Added - Rule", "ESCU - Azure AD User Enabled And Password Reset - Rule", "ESCU - Azure AD User ImmutableId Attribute Updated - Rule", "ESCU - Azure Automation Account Created - Rule", "ESCU - Azure Automation Runbook Created - Rule", "ESCU - Azure Runbook Webhook Created - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Mauricio Velazco", "detections": [{"name": "Azure AD External Guest User Invited", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Account"}]}}, {"name": "Azure AD Global Administrator Role Assigned", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Additional Cloud Roles"}]}}, {"name": "Azure AD New Custom Domain Added", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Policy Modification"}, {"mitre_attack_technique": "Domain Trust Modification"}]}}, {"name": "Azure AD New Federated Domain Added", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Policy Modification"}, {"mitre_attack_technique": "Domain Trust Modification"}]}}, {"name": "Azure AD Privileged Role Assigned", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Manipulation"}, {"mitre_attack_technique": "Additional Cloud Roles"}]}}, {"name": "Azure AD Service Principal Created", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Account"}]}}, {"name": "Azure AD Service Principal New Client Credentials", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Manipulation"}, {"mitre_attack_technique": "Additional Cloud Credentials"}]}}, {"name": "Azure AD Service Principal Owner Added", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Manipulation"}]}}, {"name": "Azure AD User Enabled And Password Reset", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Manipulation"}]}}, {"name": "Azure AD User ImmutableId Attribute Updated", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Manipulation"}]}}, {"name": "Azure Automation Account Created", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create Account"}, {"mitre_attack_technique": "Cloud Account"}]}}, {"name": "Azure Automation Runbook Created", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create Account"}, {"mitre_attack_technique": "Cloud Account"}]}}, {"name": "Azure Runbook Webhook Created", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}]}}]}, {"name": "Baron Samedit CVE-2021-3156", "id": "817b0dfc-23ba-4bcc-96cc-2cb77e428fbe", "version": 1, "date": "2021-01-27", "author": "Shannon Davis, Splunk", "description": "Uncover activity consistent with CVE-2021-3156. Discovered by the Qualys Research Team, this vulnerability has been found to affect sudo across multiple Linux distributions (Ubuntu 20.04 and prior, Debian 10 and prior, Fedora 33 and prior). As this vulnerability was committed to code in July 2011, there will be many distributions affected. Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host.", "narrative": "A non-privledged user is able to execute the sudoedit command to trigger a buffer overflow. After the successful buffer overflow, they are then able to gain root privileges on the affected host. The conditions needed to be run are a trailing \"\\\" along with shell and edit flags. Monitoring the /var/log directory on Linux hosts using the Splunk Universal Forwarder will allow you to pick up this behavior when using the provided detection.", "references": ["https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit"], "tags": {"name": "Baron Samedit CVE-2021-3156", "analytic_story": "Baron Samedit CVE-2021-3156", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1068", "mitre_attack_technique": "Exploitation for Privilege Escalation", "mitre_attack_tactics": ["Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT33", "BITTER", "Cobalt Group", "FIN6", "FIN8", "LAPSUS$", "PLATINUM", "Threat Group-3390", "Tonto Team", "Turla", "Whitefly", "ZIRCONIUM"]}], "mitre_attack_tactics": ["Privilege Escalation"], "datamodels": [], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Detect Baron Samedit CVE-2021-3156 - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Shannon Davis", "detections": [{"name": "Detect Baron Samedit CVE-2021-3156", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation for Privilege Escalation"}]}}, {"name": "Detect Baron Samedit CVE-2021-3156 Segfault", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation for Privilege Escalation"}]}}, {"name": "Detect Baron Samedit CVE-2021-3156 via OSQuery", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation for Privilege Escalation"}]}}]}, {"name": "BITS Jobs", "id": "dbc7edce-8e4c-11eb-9f31-acde48001122", "version": 1, "date": "2021-03-26", "author": "Michael Haag, Splunk", "description": "Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.", "narrative": "Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM). BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations. The interface to create and manage BITS jobs is accessible through PowerShell and the BITSAdmin tool. Adversaries may abuse BITS to download, execute, and even clean up after running malicious code. BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls. BITS enabled execution may also enable persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots).", "references": ["https://attack.mitre.org/techniques/T1197/", "https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool"], "tags": {"name": "BITS Jobs", "analytic_story": "BITS Jobs", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1197", "mitre_attack_technique": "BITS Jobs", "mitre_attack_tactics": ["Defense Evasion", "Persistence"], "mitre_attack_groups": ["APT39", "APT41", "Leviathan", "Patchwork"]}, {"mitre_attack_id": "T1105", "mitre_attack_technique": "Ingress Tool Transfer", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "Chimera", "Cobalt Group", "Confucius", "Darkhotel", "Dragonfly", "Elderwood", "Ember Bear", "Evilnum", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "IndigoZebra", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "Rancor", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Turla", "Volatile Cedar", "WIRTE", "Whitefly", "Windshift", "Winnti Group", "ZIRCONIUM", "menuPass"]}], "mitre_attack_tactics": ["Command And Control", "Defense Evasion", "Persistence"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - BITS Job Persistence - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - PowerShell Start-BitsTransfer - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "BITS Job Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "BITS Jobs"}]}}, {"name": "BITSAdmin Download File", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "BITS Jobs"}, {"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "PowerShell Start-BitsTransfer", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "BITS Jobs"}]}}]}, {"name": "Brand Monitoring", "id": "91c676cf-0b23-438d-abee-f6335e1fce78", "version": 1, "date": "2017-12-19", "author": "David Dorsey, Splunk", "description": "Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name.", "narrative": "While you can educate your users and customers about the risks and threats posed by typosquatting, phishing, and corporate espionage, human error is a persistent fact of life. Of course, your adversaries are all too aware of this reality and will happily leverage it for nefarious purposes whenever possible&#51;phishing with lookalike addresses, embedding faux command-and-control domains in malware, and hosting malicious content on domains that closely mimic your corporate servers. This is where brand monitoring comes in.\\\nYou can use our adaptation of `DNSTwist`, together with the support searches in this Analytic Story, to generate permutations of specified brands and external domains. Splunk can monitor email, DNS requests, and web traffic for these permutations and provide you with early warnings and situational awareness--powerful elements of an effective defense.\\\nNotable events will include IP addresses, URLs, and user data. Drilling down can provide you with even more actionable intelligence, including likely geographic information, contextual searches to help you scope the problem, and investigative searches.", "references": ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"], "tags": {"name": "Brand Monitoring", "analytic_story": "Brand Monitoring", "category": ["Abuse"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [], "mitre_attack_tactics": [], "datamodels": ["Email", "Network_Resolution", "Web"], "kill_chain_phases": ["Actions on Objectives", "Delivery"]}, "detection_names": ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule"], "investigation_names": ["ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"], "baseline_names": ["ESCU - DNSTwist Domain Names"], "author_company": "Splunk", "author_name": "David Dorsey", "detections": [{"name": "Monitor DNS For Brand Abuse", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}, {"name": "Monitor Email For Brand Abuse", "source": "application", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}, {"name": "Monitor Web Traffic For Brand Abuse", "source": "web", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}]}, {"name": "Brute Ratel C4", "id": "0ec9dbfe-f64e-46bb-8eb8-04e92326f513", "version": 1, "date": "2022-08-23", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that may be related to Brute Ratel Red Teaming tool. This includes creation, modification and deletion of services, collection or data, ping IP, DNS cache, process injection, debug privileges adjustment, winlogon process duplicate token, lock workstation, get clipboard or screenshot and much more.", "narrative": "Brute RATEL BRC4 is the latest red-teaming tool that simulate several TTP's. It uses several techniques like syscall, patching ETW/AMSI and written in native C to minimize noise in process command-line. This tool was seen in the wild being abused by some ransomware (blackcat) and adversaries in their campaigns to install the BRC4 agent that can serve as remote admin tool to compromise the target host or network.", "references": ["https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/", "https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/"], "tags": {"name": "Brute Ratel C4", "analytic_story": "Brute Ratel C4", "category": ["Data Destruction", "Malware", "Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1491", "mitre_attack_technique": "Defacement", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1134.002", "mitre_attack_technique": "Create Process with Token", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["Lazarus Group", "Turla"]}, {"mitre_attack_id": "T1134", "mitre_attack_technique": "Access Token Manipulation", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["Blue Mockingbird", "FIN6"]}, {"mitre_attack_id": "T1134.001", "mitre_attack_technique": "Token Impersonation/Theft", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "FIN8"]}, {"mitre_attack_id": "T1589.001", "mitre_attack_technique": "Credentials", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": ["APT28", "APT29", "Chimera", "LAPSUS$", "Leviathan", "Magic Hound"]}, {"mitre_attack_id": "T1589", "mitre_attack_technique": "Gather Victim Identity Information", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": ["APT32", "HEXANE", "LAPSUS$", "Magic Hound"]}, {"mitre_attack_id": "T1574.001", "mitre_attack_technique": "DLL Search Order Hijacking", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT41", "Aquatic Panda", "BackdoorDiplomacy", "Evilnum", "RTM", "Threat Group-3390", "Tonto Team", "Whitefly", "menuPass"]}, {"mitre_attack_id": "T1574", "mitre_attack_technique": "Hijack Execution Flow", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1056.002", "mitre_attack_technique": "GUI Input Capture", "mitre_attack_tactics": ["Collection", "Credential Access"], "mitre_attack_groups": ["FIN4"]}, {"mitre_attack_id": "T1056", "mitre_attack_technique": "Input Capture", "mitre_attack_tactics": ["Collection", "Credential Access"], "mitre_attack_groups": ["APT39"]}, {"mitre_attack_id": "T1566.001", "mitre_attack_technique": "Spearphishing Attachment", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "IndigoZebra", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1566", "mitre_attack_technique": "Phishing", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["Axiom", "GOLD SOUTHFIELD"]}, {"mitre_attack_id": "T1204.001", "mitre_attack_technique": "Malicious Link", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT33", "APT39", "BlackTech", "Cobalt Group", "Confucius", "EXOTIC LILY", "Earth Lusca", "Elderwood", "Ember Bear", "Evilnum", "FIN4", "FIN7", "FIN8", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Sandworm Team", "Sidewinder", "TA505", "Transparent Tribe", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1204", "mitre_attack_technique": "User Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["LAPSUS$"]}, {"mitre_attack_id": "T1055", "mitre_attack_technique": "Process Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT32", "APT37", "APT41", "Cobalt Group", "Kimsuky", "PLATINUM", "Silence", "Turla"]}, {"mitre_attack_id": "T1055.002", "mitre_attack_technique": "Portable Executable Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["Gorgon Group", "Rocke"]}, {"mitre_attack_id": "T1219", "mitre_attack_technique": "Remote Access Software", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["Carbanak", "Cobalt Group", "DarkVishnya", "Evilnum", "GOLD SOUTHFIELD", "Kimsuky", "MuddyWater", "Mustang Panda", "RTM", "Sandworm Team", "TeamTNT", "Thrip"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1569", "mitre_attack_technique": "System Services", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1569.002", "mitre_attack_technique": "Service Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT32", "APT38", "APT39", "APT41", "Blue Mockingbird", "Chimera", "FIN6", "Ke3chang", "Silence", "Wizard Spider"]}, {"mitre_attack_id": "T1574.011", "mitre_attack_technique": "Services Registry Permissions Weakness", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1489", "mitre_attack_technique": "Service Stop", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["Indrik Spider", "Lazarus Group", "Wizard Spider"]}], "mitre_attack_tactics": ["Collection", "Command And Control", "Credential Access", "Defense Evasion", "Execution", "Impact", "Initial Access", "Persistence", "Privilege Escalation", "Reconnaissance"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Delivery", "Exploitation"]}, "detection_names": ["ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Windows Access Token Manipulation SeDebugPrivilege - Rule", "ESCU - Windows Access Token Manipulation Winlogon Duplicate Token Handle - Rule", "ESCU - Windows Access Token Winlogon Duplicate Handle In Uncommon Path - Rule", "ESCU - Windows Defacement Modify Transcodedwallpaper File - Rule", "ESCU - Windows Gather Victim Identity SAM Info - Rule", "ESCU - Windows Hijack Execution Flow Version Dll Side Load - Rule", "ESCU - Windows Input Capture Using Credential UI Dll - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Windows Phishing Recent ISO Exec Registry - Rule", "ESCU - Windows Process Injection With Public Source Path - Rule", "ESCU - Windows Remote Access Software BRC4 Loaded Dll - Rule", "ESCU - Windows Service Created with Suspicious Service Path - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - Windows Service Deletion In Registry - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Executables Or Script Creation In Suspicious Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "Modification Of Wallpaper", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Defacement"}]}}, {"name": "Suspicious Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Windows Access Token Manipulation SeDebugPrivilege", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create Process with Token"}, {"mitre_attack_technique": "Access Token Manipulation"}]}}, {"name": "Windows Access Token Manipulation Winlogon Duplicate Token Handle", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Token Impersonation/Theft"}, {"mitre_attack_technique": "Access Token Manipulation"}]}}, {"name": "Windows Access Token Winlogon Duplicate Handle In Uncommon Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Token Impersonation/Theft"}, {"mitre_attack_technique": "Access Token Manipulation"}]}}, {"name": "Windows Defacement Modify Transcodedwallpaper File", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Defacement"}]}}, {"name": "Windows Gather Victim Identity SAM Info", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Credentials"}, {"mitre_attack_technique": "Gather Victim Identity Information"}]}}, {"name": "Windows Hijack Execution Flow Version Dll Side Load", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DLL Search Order Hijacking"}, {"mitre_attack_technique": "Hijack Execution Flow"}]}}, {"name": "Windows Input Capture Using Credential UI Dll", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "GUI Input Capture"}, {"mitre_attack_technique": "Input Capture"}]}}, {"name": "Windows ISO LNK File Creation", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Malicious Link"}, {"mitre_attack_technique": "User Execution"}]}}, {"name": "Windows Phishing Recent ISO Exec Registry", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}]}}, {"name": "Windows Process Injection With Public Source Path", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}, {"mitre_attack_technique": "Portable Executable Injection"}]}}, {"name": "Windows Remote Access Software BRC4 Loaded Dll", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Access Software"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Windows Service Created with Suspicious Service Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Services"}, {"mitre_attack_technique": "Service Execution"}]}}, {"name": "Windows Service Creation Using Registry Entry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Services Registry Permissions Weakness"}]}}, {"name": "Windows Service Deletion In Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Service Stop"}]}}]}, {"name": "Caddy Wiper", "id": "435a156a-8ef1-4184-bd52-22328fb65d3a", "version": 1, "date": "2022-03-25", "author": "Teoderick Contreras, Rod Soto, Splunk", "description": "Caddy Wiper is a destructive payload that detects if its running on a Domain Controller and executes killswitch if detected. If not in a DC it destroys Users and subsequent mapped drives. This wiper also destroys drive partitions inculding boot partitions.", "narrative": "Caddy Wiper is destructive malware operation found by ESET multiple organizations in Ukraine. This malicious payload destroys user files, avoids executing on Dnomain Controllers and destroys boot and drive partitions.", "references": ["https://twitter.com/ESETresearch/status/1503436420886712321", "https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine/"], "tags": {"name": "Caddy Wiper", "analytic_story": "Caddy Wiper", "category": ["Data Destruction", "Malware", "Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1561.002", "mitre_attack_technique": "Disk Structure Wipe", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT37", "APT38", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1561", "mitre_attack_technique": "Disk Wipe", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Impact"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Windows Raw Access To Disk Volume Partition - Rule", "ESCU - Windows Raw Access To Master Boot Record Drive - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Rod Soto, Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Windows Raw Access To Disk Volume Partition", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disk Structure Wipe"}, {"mitre_attack_technique": "Disk Wipe"}]}}, {"name": "Windows Raw Access To Master Boot Record Drive", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disk Structure Wipe"}, {"mitre_attack_technique": "Disk Wipe"}]}}]}, {"name": "CISA AA22-257A", "id": "e1aec96e-bc7d-4edf-8ff7-3da9b7b29147", "version": 1, "date": "2022-09-15", "author": "Michael Haag, Splunk", "description": "The Iranian government-sponsored APT actors are actively targeting a broad range of victims across multiple U.S. critical infrastructure sectors, including the Transportation Sector and the Healthcare and Public Health Sector, as well as Australian organizations.", "narrative": "This advisory updates joint CSA Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities, which provides information on these Iranian government-sponsored APT actors exploiting known Fortinet and Microsoft Exchange vulnerabilities to gain initial access to a broad range of targeted entities in furtherance of malicious activities, including ransom operations. The authoring agencies now judge these actors are an APT group affiliated with the IRGC. Since the initial reporting of this activity in the FBI Liaison Alert System (FLASH) report APT Actors Exploiting Fortinet Vulnerabilities to Gain Access for Malicious Activity from May 2021, the authoring agencies have continued to observe these IRGC-affiliated actors exploiting known vulnerabilities for initial access. In addition to exploiting Fortinet and Microsoft Exchange vulnerabilities, the authoring agencies have observed these APT actors exploiting VMware Horizon Log4j vulnerabilities for initial access. The IRGC-affiliated actors have used this access for follow-on activity, including disk encryption and data extortion, to support ransom operations. The IRGC-affiliated actors are actively targeting a broad range of entities, including entities across multiple U.S. critical infrastructure sectors as well as Australian, Canadian, and United Kingdom organizations. These actors often operate under the auspices of Najee Technology Hooshmand Fater LLC, based in Karaj, Iran, and Afkar System Yazd Company, based in Yazd, Iran. The authoring agencies assess the actors are exploiting known vulnerabilities on unprotected networks rather than targeting specific targeted entities or sectors. This advisory provides observed tactics, techniques, and indicators of compromise (IOCs) that the authoring agencies assess are likely associated with this IRGC-affiliated APT. The authoring agencies urge organizations, especially critical infrastructure organizations, to apply the recommendations listed in the Mitigations section of this advisory to mitigate risk of compromise from these IRGC-affiliated cyber actors.", "references": ["https://www.cisa.gov/uscert/ncas/alerts/aa21-321a", "https://www.cisa.gov/uscert/ncas/alerts/aa22-257a", "https://www.ic3.gov/Media/News/2021/210527.pdf", "https://www.us-cert.gov/sites/default/files/AA22-257A.stix.xml", "https://www.us-cert.cisa.gov/iran"], "tags": {"name": "CISA AA22-257A", "analytic_story": "CISA AA22-257A", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.001", "mitre_attack_technique": "LSASS Memory", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT1", "APT28", "APT3", "APT32", "APT33", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Cleaver", "Earth Lusca", "FIN6", "FIN8", "Fox Kitten", "GALLIUM", "HAFNIUM", "Indrik Spider", "Ke3chang", "Kimsuky", "Leafminer", "Leviathan", "Magic Hound", "MuddyWater", "OilRig", "PLATINUM", "Sandworm Team", "Silence", "TEMP.Veles", "Threat Group-3390", "Whitefly"]}, {"mitre_attack_id": "T1136.001", "mitre_attack_technique": "Local Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT3", "APT39", "APT41", "Dragonfly", "Fox Kitten", "Kimsuky", "Leafminer", "Magic Hound", "TeamTNT"]}, {"mitre_attack_id": "T1136", "mitre_attack_technique": "Create Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["Indrik Spider", "Sandworm Team"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1505", "mitre_attack_technique": "Server Software Component", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1505.003", "mitre_attack_technique": "Web Shell", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT38", "APT39", "BackdoorDiplomacy", "Deep Panda", "Dragonfly", "Fox Kitten", "GALLIUM", "HAFNIUM", "Kimsuky", "Leviathan", "Magic Hound", "Moses Staff", "OilRig", "Sandworm Team", "TEMP.Veles", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Volatile Cedar"]}, {"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}, {"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1572", "mitre_attack_technique": "Protocol Tunneling", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["Chimera", "Cobalt Group", "FIN6", "Fox Kitten", "Leviathan", "OilRig"]}, {"mitre_attack_id": "T1021.004", "mitre_attack_technique": "SSH", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT39", "BlackTech", "FIN7", "Fox Kitten", "GCMAN", "Lazarus Group", "Leviathan", "OilRig", "Rocke", "TEMP.Veles", "TeamTNT", "menuPass"]}], "mitre_attack_tactics": ["Command And Control", "Credential Access", "Execution", "Initial Access", "Lateral Movement", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint", "Web"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Create local admin accounts using net exe - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Detect Exchange Web Shell - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Extraction of Registry Hives - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks Run Task On Demand - Rule", "ESCU - Short Lived Scheduled Task - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Windows Hidden Schedule Task Settings - Rule", "ESCU - Windows Possible Credential Dumping - Rule", "ESCU - Windows Protocol Tunneling with Plink - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Randomly Generated Scheduled Task Name - Rule", "ESCU - Log4Shell JNDI Payload Injection Attempt - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Dump LSASS via procdump Rename", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}]}}, {"name": "Create local admin accounts using net exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Local Account"}, {"mitre_attack_technique": "Create Account"}]}}, {"name": "Creation of lsass Dump with Taskmgr", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Detect Exchange Web Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "Web Shell"}, {"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Detect Mimikatz Using Loaded Images", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Detect New Local Admin account", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Local Account"}, {"mitre_attack_technique": "Create Account"}]}}, {"name": "Dump LSASS via comsvcs DLL", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Dump LSASS via procdump", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Extraction of Registry Hives", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Scheduled Task Deleted Or Created via CMD", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Schtasks Run Task On Demand", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Short Lived Scheduled Task", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}]}}, {"name": "W3WP Spawning Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "Web Shell"}]}}, {"name": "Windows Hidden Schedule Task Settings", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Windows Possible Credential Dumping", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Windows Protocol Tunneling with Plink", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Protocol Tunneling"}, {"mitre_attack_technique": "SSH"}]}}, {"name": "WinEvent Scheduled Task Created to Spawn Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "WinEvent Scheduled Task Created Within Public Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "WinEvent Windows Task Scheduler Event Action Started", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}]}}, {"name": "Randomly Generated Scheduled Task Name", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}, {"mitre_attack_technique": "Scheduled Task"}]}}, {"name": "Log4Shell JNDI Payload Injection Attempt", "source": "web", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}]}, {"name": "CISA AA22-264A", "id": "bc7056a5-c3b0-4b83-93ce-5f31739305c8", "version": 1, "date": "2022-09-22", "author": "Michael Haag, Splunk", "description": "Iranian State Actors Conduct Cyber Operations Against the Government of Albania.", "narrative": "The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint Cybersecurity Advisory to provide information on recent cyber operations against the Government of Albania in July and September. This advisory provides a timeline of activity observed, from initial access to execution of encryption and wiper attacks. Additional information concerning files used by the actors during their exploitation of and cyber attack against the victim organization is provided in Appendices A and B. In September 2022, Iranian cyber actors launched another wave of cyber attacks against the Government of Albania, using similar TTPs and malware as the cyber attacks in July. These were likely done in retaliation for public attribution of the cyber attacks in July and severed diplomatic ties between Albania and Iran.", "references": ["https://www.cisa.gov/uscert/ncas/alerts/aa22-264a", "https://www.cisa.gov/uscert/sites/default/files/publications/aa22-264a-iranian-cyber-actors-conduct-cyber-operations-against-the-government-of-albania.pdf", "https://www.mandiant.com/resources/blog/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against", "https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/"], "tags": {"name": "CISA AA22-264A", "analytic_story": "CISA AA22-264A", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1036.005", "mitre_attack_technique": "Match Legitimate Name or Location", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT1", "APT28", "APT29", "APT32", "APT39", "APT41", "Aoqin Dragon", "BRONZE BUTLER", "BackdoorDiplomacy", "Blue Mockingbird", "Carbanak", "Chimera", "Darkhotel", "Earth Lusca", "FIN7", "Ferocious Kitten", "Fox Kitten", "Gamaredon Group", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Poseidon Group", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "Sowbug", "TEMP.Veles", "TeamTNT", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Whitefly", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1595", "mitre_attack_technique": "Active Scanning", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1490", "mitre_attack_technique": "Inhibit System Recovery", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1003.001", "mitre_attack_technique": "LSASS Memory", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT1", "APT28", "APT3", "APT32", "APT33", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Cleaver", "Earth Lusca", "FIN6", "FIN8", "Fox Kitten", "GALLIUM", "HAFNIUM", "Indrik Spider", "Ke3chang", "Kimsuky", "Leafminer", "Leviathan", "Magic Hound", "MuddyWater", "OilRig", "PLATINUM", "Sandworm Team", "Silence", "TEMP.Veles", "Threat Group-3390", "Whitefly"]}, {"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1505", "mitre_attack_technique": "Server Software Component", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1505.003", "mitre_attack_technique": "Web Shell", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT38", "APT39", "BackdoorDiplomacy", "Deep Panda", "Dragonfly", "Fox Kitten", "GALLIUM", "HAFNIUM", "Kimsuky", "Leviathan", "Magic Hound", "Moses Staff", "OilRig", "Sandworm Team", "TEMP.Veles", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Volatile Cedar"]}, {"mitre_attack_id": "T1070", "mitre_attack_technique": "Indicator Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Lazarus Group"]}, {"mitre_attack_id": "T1070.001", "mitre_attack_technique": "Clear Windows Event Logs", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT32", "APT38", "APT41", "Chimera", "Dragonfly", "FIN5", "FIN8", "Indrik Spider"]}, {"mitre_attack_id": "T1561.002", "mitre_attack_technique": "Disk Structure Wipe", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT37", "APT38", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1561", "mitre_attack_technique": "Disk Wipe", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1068", "mitre_attack_technique": "Exploitation for Privilege Escalation", "mitre_attack_tactics": ["Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT33", "BITTER", "Cobalt Group", "FIN6", "FIN8", "LAPSUS$", "PLATINUM", "Threat Group-3390", "Tonto Team", "Turla", "Whitefly", "ZIRCONIUM"]}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Execution", "Impact", "Persistence", "Privilege Escalation", "Reconnaissance"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Delivery", "Exploitation", "Installation", "Reconnaissance"]}, "detection_names": ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Excessive Usage Of Taskkill - Rule", "ESCU - Exchange PowerShell Module Usage - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows Possible Credential Dumping - Rule", "ESCU - Windows Raw Access To Disk Volume Partition - Rule", "ESCU - Windows Raw Access To Master Boot Record Drive - Rule", "ESCU - Windows System File on Disk - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Attacker Tools On Endpoint", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Match Legitimate Name or Location"}, {"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "OS Credential Dumping"}, {"mitre_attack_technique": "Active Scanning"}]}}, {"name": "Deleting Shadow Copies", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Detect Mimikatz Using Loaded Images", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Detect Mimikatz With PowerShell Script Block Logging", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "OS Credential Dumping"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Dump LSASS via comsvcs DLL", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Excessive Usage Of Taskkill", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Exchange PowerShell Module Usage", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "W3WP Spawning Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "Web Shell"}]}}, {"name": "Windows DisableAntiSpyware Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows Event Log Cleared", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}, {"mitre_attack_technique": "Clear Windows Event Logs"}]}}, {"name": "Windows Possible Credential Dumping", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Windows Raw Access To Disk Volume Partition", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disk Structure Wipe"}, {"mitre_attack_technique": "Disk Wipe"}]}}, {"name": "Windows Raw Access To Master Boot Record Drive", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disk Structure Wipe"}, {"mitre_attack_technique": "Disk Wipe"}]}}, {"name": "Windows System File on Disk", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation for Privilege Escalation"}]}}]}, {"name": "CISA AA22-277A", "id": "db408f93-e915-4215-9962-5fada348bdd7", "version": 1, "date": "2022-10-05", "author": "Michael Haag, Splunk", "description": "From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to advanced persistent threat (APT) activity on a Defense Industrial Base (DIB) Sector organization's enterprise network. During incident response activities, multiple utilities were utilized.", "narrative": "CISA uncovered that likely multiple APT groups compromised the organization's network, and some APT actors had long-term access to the environment. APT actors used an open-source toolkit called Impacket to gain their foothold within the environment and further compromise the network, and also used a custom data exfiltration tool, CovalentStealer, to steal the victim's sensitive data.", "references": ["https://www.cisa.gov/uscert/ncas/alerts/aa22-277a", "https://www.cisa.gov/uscert/sites/default/files/publications/aa22-277a-impacket-and-exfiltration-tool-used-to-steal-sensitive-information-from-defense-industrial-base-organization.pdf"], "tags": {"name": "CISA AA22-277A", "analytic_story": "CISA AA22-277A", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1105", "mitre_attack_technique": "Ingress Tool Transfer", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "Chimera", "Cobalt Group", "Confucius", "Darkhotel", "Dragonfly", "Elderwood", "Ember Bear", "Evilnum", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "IndigoZebra", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "Rancor", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Turla", "Volatile Cedar", "WIRTE", "Whitefly", "Windshift", "Winnti Group", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1059.007", "mitre_attack_technique": "JavaScript", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT32", "Cobalt Group", "Earth Lusca", "Ember Bear", "Evilnum", "FIN6", "FIN7", "Higaisa", "Indrik Spider", "Kimsuky", "LazyScripter", "Leafminer", "Molerats", "MuddyWater", "Sidewinder", "Silence", "TA505", "Turla"]}, {"mitre_attack_id": "T1070", "mitre_attack_technique": "Indicator Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Lazarus Group"]}, {"mitre_attack_id": "T1070.005", "mitre_attack_technique": "Network Share Connection Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Threat Group-3390"]}, {"mitre_attack_id": "T1560.001", "mitre_attack_technique": "Archive via Utility", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT1", "APT28", "APT29", "APT3", "APT33", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Chimera", "CopyKittens", "Earth Lusca", "FIN8", "Fox Kitten", "GALLIUM", "Gallmaker", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "MuddyWater", "Mustang Panda", "Sowbug", "Turla", "menuPass"]}, {"mitre_attack_id": "T1560", "mitre_attack_technique": "Archive Collected Data", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT28", "APT32", "Axiom", "Dragonfly", "FIN6", "Ke3chang", "Lazarus Group", "Leviathan", "Patchwork", "menuPass"]}, {"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021.002", "mitre_attack_technique": "SMB/Windows Admin Shares", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT39", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "FIN8", "Fox Kitten", "Ke3chang", "Lazarus Group", "Moses Staff", "Orangeworm", "Sandworm Team", "Threat Group-1314", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1021.003", "mitre_attack_technique": "Distributed Component Object Model", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1047", "mitre_attack_technique": "Windows Management Instrumentation", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT29", "APT32", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "Earth Lusca", "FIN6", "FIN7", "FIN8", "GALLIUM", "Gamaredon Group", "Indrik Spider", "Lazarus Group", "Leviathan", "Magic Hound", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "Stealth Falcon", "Threat Group-3390", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1049", "mitre_attack_technique": "System Network Connections Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT1", "APT3", "APT32", "APT38", "APT41", "Andariel", "BackdoorDiplomacy", "Chimera", "Earth Lusca", "GALLIUM", "HEXANE", "Ke3chang", "Lazarus Group", "Magic Hound", "MuddyWater", "Mustang Panda", "OilRig", "Poseidon Group", "Sandworm Team", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1016", "mitre_attack_technique": "System Network Configuration Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT1", "APT19", "APT3", "APT32", "APT41", "Chimera", "Darkhotel", "Dragonfly", "Earth Lusca", "GALLIUM", "HEXANE", "Higaisa", "Ke3chang", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "SideCopy", "Sidewinder", "Stealth Falcon", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1016.001", "mitre_attack_technique": "Internet Connection Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "Gamaredon Group", "HEXANE", "Turla"]}], "mitre_attack_tactics": ["Collection", "Command And Control", "Defense Evasion", "Discovery", "Execution", "Lateral Movement", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - Cmdline Tool Not Executed In CMD Shell - Rule", "ESCU - Create or delete windows shares using net exe - Rule", "ESCU - Detect Renamed WinRAR - Rule", "ESCU - Excessive Usage Of Taskkill - Rule", "ESCU - Exchange PowerShell Module Usage - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Network Connection Discovery With Netstat - Rule", "ESCU - Network Discovery Using Route Windows App - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "CertUtil Download With URLCache and Split Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Cmdline Tool Not Executed In CMD Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "JavaScript"}]}}, {"name": "Create or delete windows shares using net exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}, {"mitre_attack_technique": "Network Share Connection Removal"}]}}, {"name": "Detect Renamed WinRAR", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Archive via Utility"}, {"mitre_attack_technique": "Archive Collected Data"}]}}, {"name": "Excessive Usage Of Taskkill", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Exchange PowerShell Module Usage", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Impacket Lateral Movement Commandline Parameters", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "SMB/Windows Admin Shares"}, {"mitre_attack_technique": "Distributed Component Object Model"}, {"mitre_attack_technique": "Windows Management Instrumentation"}, {"mitre_attack_technique": "Windows Service"}]}}, {"name": "Network Connection Discovery With Netstat", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Connections Discovery"}]}}, {"name": "Network Discovery Using Route Windows App", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Configuration Discovery"}, {"mitre_attack_technique": "Internet Connection Discovery"}]}}]}, {"name": "CISA AA22-320A", "id": "c1fca73d-3a8d-49a6-b9c0-1d5d155f7dd4", "version": 1, "date": "2022-11-16", "author": "Michael Haag, Splunk", "description": "CISA and the FBI have identified an APT activity where the adversary gained initial access via Log4Shell via a unpatched VMware Horizon server. From there the adversary moved laterally and continued to its objective.", "narrative": "From mid-June through mid-July 2022, CISA conducted an incident response engagement at a Federal Civilian Executive Branch (FCEB) organization where CISA observed suspected advanced persistent threat (APT) activity. In the course of incident response activities, CISA determined that cyber threat actors exploited the Log4Shell vulnerability in an unpatched VMware Horizon server, installed XMRig crypto mining software, moved laterally to the domain controller (DC), compromised credentials, and then implanted Ngrok reverse proxies on several hosts to maintain persistence. CISA and the Federal Bureau of Investigation (FBI) assess that the FCEB network was compromised by Iranian government-sponsored APT actors.", "references": ["https://www.cisa.gov/uscert/ncas/alerts/aa22-320a", "https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf"], "tags": {"name": "CISA AA22-320A", "analytic_story": "CISA AA22-320A", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1003.001", "mitre_attack_technique": "LSASS Memory", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT1", "APT28", "APT3", "APT32", "APT33", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Cleaver", "Earth Lusca", "FIN6", "FIN8", "Fox Kitten", "GALLIUM", "HAFNIUM", "Indrik Spider", "Ke3chang", "Kimsuky", "Leafminer", "Leviathan", "Magic Hound", "MuddyWater", "OilRig", "PLATINUM", "Sandworm Team", "Silence", "TEMP.Veles", "Threat Group-3390", "Whitefly"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021.002", "mitre_attack_technique": "SMB/Windows Admin Shares", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT39", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "FIN8", "Fox Kitten", "Ke3chang", "Lazarus Group", "Moses Staff", "Orangeworm", "Sandworm Team", "Threat Group-1314", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1569", "mitre_attack_technique": "System Services", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1569.002", "mitre_attack_technique": "Service Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT32", "APT38", "APT39", "APT41", "Blue Mockingbird", "Chimera", "FIN6", "Ke3chang", "Silence", "Wizard Spider"]}, {"mitre_attack_id": "T1112", "mitre_attack_technique": "Modify Registry", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "APT38", "APT41", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN8", "Gamaredon Group", "Gorgon Group", "Kimsuky", "Magic Hound", "Patchwork", "Silence", "TA505", "Threat Group-3390", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1018", "mitre_attack_technique": "Remote System Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "APT3", "APT32", "APT39", "BRONZE BUTLER", "Chimera", "Deep Panda", "Dragonfly", "Earth Lusca", "FIN5", "FIN6", "FIN8", "Fox Kitten", "GALLIUM", "HEXANE", "Indrik Spider", "Ke3chang", "Leafminer", "Naikon", "Rocke", "Sandworm Team", "Silence", "Threat Group-3390", "Turla", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}, {"mitre_attack_id": "T1105", "mitre_attack_technique": "Ingress Tool Transfer", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "Chimera", "Cobalt Group", "Confucius", "Darkhotel", "Dragonfly", "Elderwood", "Ember Bear", "Evilnum", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "IndigoZebra", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "Rancor", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Turla", "Volatile Cedar", "WIRTE", "Whitefly", "Windshift", "Winnti Group", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1027", "mitre_attack_technique": "Obfuscated Files or Information", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "Aquatic Panda", "BITTER", "BackdoorDiplomacy", "BlackOasis", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Earth Lusca", "Elderwood", "Ember Bear", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Group5", "HEXANE", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leafminer", "Leviathan", "Magic Hound", "Mofang", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Putter Panda", "Rocke", "Sandworm Team", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Transparent Tribe", "Tropic Trooper", "Turla", "Whitefly", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1550", "mitre_attack_technique": "Use Alternate Authentication Material", "mitre_attack_tactics": ["Defense Evasion", "Lateral Movement"], "mitre_attack_groups": ["APT29"]}, {"mitre_attack_id": "T1550.003", "mitre_attack_technique": "Pass the Ticket", "mitre_attack_tactics": ["Defense Evasion", "Lateral Movement"], "mitre_attack_groups": ["APT29", "APT32", "BRONZE BUTLER"]}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1014", "mitre_attack_technique": "Rootkit", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT41", "Rocke", "TeamTNT", "Winnti Group"]}, {"mitre_attack_id": "T1068", "mitre_attack_technique": "Exploitation for Privilege Escalation", "mitre_attack_tactics": ["Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT33", "BITTER", "Cobalt Group", "FIN6", "FIN8", "LAPSUS$", "PLATINUM", "Threat Group-3390", "Tonto Team", "Turla", "Whitefly", "ZIRCONIUM"]}, {"mitre_attack_id": "T1572", "mitre_attack_technique": "Protocol Tunneling", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["Chimera", "Cobalt Group", "FIN6", "Fox Kitten", "Leviathan", "OilRig"]}, {"mitre_attack_id": "T1090", "mitre_attack_technique": "Proxy", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT41", "Blue Mockingbird", "CopyKittens", "Earth Lusca", "Fox Kitten", "LAPSUS$", "POLONIUM", "Sandworm Team", "Turla", "Windigo"]}, {"mitre_attack_id": "T1102", "mitre_attack_technique": "Web Service", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT32", "EXOTIC LILY", "Ember Bear", "FIN6", "FIN8", "Fox Kitten", "Gamaredon Group", "Inception", "LazyScripter", "Mustang Panda", "Rocke", "TeamTNT", "Turla"]}], "mitre_attack_tactics": ["Command And Control", "Credential Access", "Defense Evasion", "Discovery", "Execution", "Initial Access", "Lateral Movement", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint", "Network_Resolution", "Network_Traffic", "Risk", "Web"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Exploitation", "Installation", "Reconnaissance"]}, "detection_names": ["ESCU - Suspicious Powershell Command-Line Arguments - Rule", "ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Enable WDigest UseLogonCredential Registry - Rule", "ESCU - GetAdComputer with PowerShell Script Block - Rule", "ESCU - Hunting for Log4Shell - Rule", "ESCU - Log4Shell CVE-2021-44228 Exploitation - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Mimikatz PassTheTicket CommandLine Parameters - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Suspicious Driver Loaded Path - Rule", "ESCU - Windows Driver Load Non-Standard Path - Rule", "ESCU - Windows Drivers Loaded by Signature - Rule", "ESCU - Windows Mimikatz Binary Execution - Rule", "ESCU - Windows Ngrok Reverse Proxy Usage - Rule", "ESCU - Windows Service Create Kernel Mode Driver - Rule", "ESCU - XMRIG Driver Loaded - Rule", "ESCU - Ngrok Reverse Proxy on Network - Rule", "ESCU - Log4Shell JNDI Payload Injection Attempt - Rule", "ESCU - Log4Shell JNDI Payload Injection with Outbound Connection - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Suspicious Powershell Command-Line Arguments", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "PowerShell"}]}}, {"name": "Add or Set Windows Defender Exclusion", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Detect Mimikatz Using Loaded Images", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Detect Mimikatz With PowerShell Script Block Logging", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "OS Credential Dumping"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Detect PsExec With accepteula Flag", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "SMB/Windows Admin Shares"}]}}, {"name": "Detect Renamed PSExec", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Services"}, {"mitre_attack_technique": "Service Execution"}]}}, {"name": "Enable WDigest UseLogonCredential Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "GetAdComputer with PowerShell Script Block", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}, {"name": "Hunting for Log4Shell", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Log4Shell CVE-2021-44228 Exploitation", "source": "endpoint", "type": "Correlation", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}, {"mitre_attack_technique": "Exploit Public-Facing Application"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Malicious PowerShell Process - Encoded Command", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Obfuscated Files or Information"}]}}, {"name": "Mimikatz PassTheTicket CommandLine Parameters", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Use Alternate Authentication Material"}, {"mitre_attack_technique": "Pass the Ticket"}]}}, {"name": "Powershell Windows Defender Exclusion Commands", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Suspicious Driver Loaded Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Service"}, {"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Windows Driver Load Non-Standard Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Rootkit"}]}}, {"name": "Windows Drivers Loaded by Signature", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Rootkit"}, {"mitre_attack_technique": "Exploitation for Privilege Escalation"}]}}, {"name": "Windows Mimikatz Binary Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Windows Ngrok Reverse Proxy Usage", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Protocol Tunneling"}, {"mitre_attack_technique": "Proxy"}, {"mitre_attack_technique": "Web Service"}]}}, {"name": "Windows Service Create Kernel Mode Driver", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Service"}, {"mitre_attack_technique": "Create or Modify System Process"}, {"mitre_attack_technique": "Exploitation for Privilege Escalation"}]}}, {"name": "XMRIG Driver Loaded", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Service"}, {"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Ngrok Reverse Proxy on Network", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Protocol Tunneling"}, {"mitre_attack_technique": "Proxy"}, {"mitre_attack_technique": "Web Service"}]}}, {"name": "Log4Shell JNDI Payload Injection Attempt", "source": "web", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Log4Shell JNDI Payload Injection with Outbound Connection", "source": "web", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}]}, {"name": "Cloud Cryptomining", "id": "3b96d13c-fdc7-45dd-b3ad-c132b31cdd2a", "version": 1, "date": "2019-10-02", "author": "David Dorsey, Splunk", "description": "Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.", "narrative": "Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \\\nCryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \\\nWhen malicious miners appropriate a cloud instance, often spinning up hundreds of new instances, the costs can become astronomical for the account holder. So it is critically important to monitor your systems for suspicious activities that could indicate that your network has been infiltrated. \\\nThis Analytic Story is focused on detecting suspicious new instances in your cloud environment to help prevent cryptominers from gaining a foothold. It contains detection searches that will detect when a previously unused instance type or AMI is used. It also contains support searches to build lookup files to ensure proper execution of the detection searches.", "references": ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"], "tags": {"name": "Cloud Cryptomining", "analytic_story": "Cloud Cryptomining", "category": ["Cloud Security"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1535", "mitre_attack_technique": "Unused/Unsupported Cloud Regions", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1078.004", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Ke3chang", "LAPSUS$"]}, {"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}], "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": ["Change"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule"], "investigation_names": ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Compute Creations By User - Initial", "ESCU - Previously Seen Cloud Compute Creations By User - Update", "ESCU - Previously Seen Cloud Compute Images - Initial", "ESCU - Previously Seen Cloud Compute Images - Update", "ESCU - Previously Seen Cloud Compute Instance Types - Initial", "ESCU - Previously Seen Cloud Compute Instance Types - Update", "ESCU - Previously Seen Cloud Regions - Initial", "ESCU - Previously Seen Cloud Regions - Update"], "author_company": "Splunk", "author_name": "David Dorsey", "detections": [{"name": "Cloud Compute Instance Created In Previously Unused Region", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}, {"name": "Cloud Compute Instance Created With Previously Unseen Image", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "Cloud Compute Instance Created With Previously Unseen Instance Type", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "Abnormally High Number Of Cloud Instances Launched", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "Cloud Compute Instance Created By Previously Unseen User", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Valid Accounts"}]}}]}, {"name": "Cloud Federated Credential Abuse", "id": "cecdc1e7-0af2-4a55-8967-b9ea62c0317d", "version": 1, "date": "2021-01-26", "author": "Rod Soto, Splunk", "description": "This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements.", "narrative": "This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches.", "references": ["https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps", "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf", "https://us-cert.cisa.gov/ncas/alerts/aa21-008a"], "tags": {"name": "Cloud Federated Credential Abuse", "analytic_story": "Cloud Federated Credential Abuse", "category": ["Cloud Security"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1136.003", "mitre_attack_technique": "Cloud Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT29", "LAPSUS$"]}, {"mitre_attack_id": "T1136", "mitre_attack_technique": "Create Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["Indrik Spider", "Sandworm Team"]}, {"mitre_attack_id": "T1556", "mitre_attack_technique": "Modify Authentication Process", "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1003.001", "mitre_attack_technique": "LSASS Memory", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT1", "APT28", "APT3", "APT32", "APT33", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Cleaver", "Earth Lusca", "FIN6", "FIN8", "Fox Kitten", "GALLIUM", "HAFNIUM", "Indrik Spider", "Ke3chang", "Kimsuky", "Leafminer", "Leviathan", "Magic Hound", "MuddyWater", "OilRig", "PLATINUM", "Sandworm Team", "Silence", "TEMP.Veles", "Threat Group-3390", "Whitefly"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1546.012", "mitre_attack_technique": "Image File Execution Options Injection", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["TEMP.Veles"]}, {"mitre_attack_id": "T1546", "mitre_attack_technique": "Event Triggered Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation"]}, "detection_names": ["ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Rod Soto", "detections": [{"name": "AWS SAML Access by Provider User and Principal", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "AWS SAML Update identity provider", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "O365 Add App Role Assignment Grant User", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Account"}, {"mitre_attack_technique": "Create Account"}]}}, {"name": "O365 Added Service Principal", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Account"}, {"mitre_attack_technique": "Create Account"}]}}, {"name": "O365 Excessive SSO logon errors", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Authentication Process"}]}}, {"name": "O365 New Federated Domain Added", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Account"}, {"mitre_attack_technique": "Create Account"}]}}, {"name": "Detect Mimikatz Via PowerShell And EventCode 4703", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}]}}, {"name": "Certutil exe certificate extraction", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}, {"name": "Detect Mimikatz Using Loaded Images", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Registry Keys Used For Privilege Escalation", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Image File Execution Options Injection"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}]}, {"name": "Cobalt Strike", "id": "bcfd17e8-5461-400a-80a2-3b7d1459220c", "version": 1, "date": "2021-02-16", "author": "Michael Haag, Splunk", "description": "Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility.", "narrative": "This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Cobalt Strike. Cobalt Strike has many ways to be enhanced by using aggressor scripts, malleable C2 profiles, default attack packages, and much more. For endpoint behavior, Cobalt Strike is most commonly identified via named pipes, spawn to processes, and DLL function names. Many additional variables are provided for in memory operation of the beacon implant. On the network, depending on the malleable C2 profile used, it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt Strike. Not every query may be specific to Cobalt Strike the tool, but the methodologies and techniques used by it.\\\nSplunk Threat Research reviewed all publicly available instances of Malleabe C2 Profiles and generated a list of the most commonly used spawnto and pipenames.\\\n`Spawnto_x86` and `spawnto_x64` is the process that Cobalt Strike will spawn and injects shellcode into.\\\nPipename sets the named pipe name used in Cobalt Strikes Beacon SMB C2 traffic.\\\nWith that, new detections were generated focused on these spawnto processes spawning without command line arguments. Similar, the named pipes most commonly used by Cobalt Strike added as a detection. In generating content for Cobalt Strike, the following is considered:\\\n- Is it normal for spawnto_ value to have no command line arguments? No command line arguments and a network connection?\\\n- What is the default, or normal, process lineage for spawnto_ value?\\\n- Does the spawnto_ value make network connections?\\\n- Is it normal for spawnto_ value to load jscript, vbscript, Amsi.dll, and clr.dll?\\\nWhile investigating a detection related to this Analytic Story, keep in mind the parent process, process path, and any file modifications that may occur. Tuning may need to occur to remove any false positives.", "references": ["https://www.cobaltstrike.com/", "https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/", "https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/", "https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html", "https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html", "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence", "https://github.com/zer0yu/Awesome-CobaltStrike"], "tags": {"name": "Cobalt Strike", "analytic_story": "Cobalt Strike", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1560.001", "mitre_attack_technique": "Archive via Utility", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT1", "APT28", "APT29", "APT3", "APT33", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Chimera", "CopyKittens", "Earth Lusca", "FIN8", "Fox Kitten", "GALLIUM", "Gallmaker", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "MuddyWater", "Mustang Panda", "Sowbug", "Turla", "menuPass"]}, {"mitre_attack_id": "T1560", "mitre_attack_technique": "Archive Collected Data", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT28", "APT32", "Axiom", "Dragonfly", "FIN6", "Ke3chang", "Lazarus Group", "Leviathan", "Patchwork", "menuPass"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1055", "mitre_attack_technique": "Process Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT32", "APT37", "APT41", "Cobalt Group", "Kimsuky", "PLATINUM", "Silence", "Turla"]}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.010", "mitre_attack_technique": "Regsvr32", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "Blue Mockingbird", "Cobalt Group", "Deep Panda", "Inception", "Kimsuky", "Lazarus Group", "Leviathan", "TA551", "WIRTE"]}, {"mitre_attack_id": "T1218.011", "mitre_attack_technique": "Rundll32", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "CopyKittens", "Gamaredon Group", "HAFNIUM", "Kimsuky", "Lazarus Group", "LazyScripter", "Magic Hound", "MuddyWater", "Sandworm Team", "TA505", "TA551"]}, {"mitre_attack_id": "T1548", "mitre_attack_technique": "Abuse Elevation Control Mechanism", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1127", "mitre_attack_technique": "Trusted Developer Utilities Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1036.003", "mitre_attack_technique": "Rename System Utilities", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT32", "GALLIUM", "Lazarus Group", "menuPass"]}, {"mitre_attack_id": "T1127.001", "mitre_attack_technique": "MSBuild", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Collection", "Defense Evasion", "Execution", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - Anomalous usage of 7zip - Rule", "ESCU - CMD Echo Pipe - Escalation - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - GPUpdate with no Command Line Arguments with Network - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - SearchProtocolHost with no Command Line with Network - Rule", "ESCU - Services Escalate Exe - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - DLLHost with no Command Line Arguments with Network - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Anomalous usage of 7zip", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Archive via Utility"}, {"mitre_attack_technique": "Archive Collected Data"}]}}, {"name": "CMD Echo Pipe - Escalation", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "Windows Command Shell"}, {"mitre_attack_technique": "Windows Service"}, {"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Cobalt Strike Named Pipes", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Detect Regsvr32 Application Control Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvr32"}]}}, {"name": "GPUpdate with no Command Line Arguments with Network", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Rundll32 with no Command Line Arguments with Network", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "SearchProtocolHost with no Command Line with Network", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Services Escalate Exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Suspicious DLLHost no Command Line Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Suspicious GPUpdate no Command Line Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Suspicious microsoft workflow compiler rename", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}, {"mitre_attack_technique": "Rename System Utilities"}]}}, {"name": "Suspicious msbuild path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}, {"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "MSBuild"}]}}, {"name": "Suspicious MSBuild Rename", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}, {"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "MSBuild"}]}}, {"name": "Suspicious Rundll32 StartW", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Suspicious Rundll32 no Command Line Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Suspicious SearchProtocolHost no Command Line Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "DLLHost with no Command Line Arguments with Network", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}]}, {"name": "ColdRoot MacOS RAT", "id": "bd91a2bc-d20b-4f44-a982-1bea98e86390", "version": 1, "date": "2019-01-09", "author": "Jose Hernandez, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more.", "narrative": "Conventional wisdom holds that Apple's MacOS operating system is significantly less vulnerable to attack than Windows machines. While that point is debatable, it is true that attacks against MacOS systems are much less common. However, this fact does not mean that Macs are impervious to breaches. To the contrary, research has shown that that Mac malware is increasing at an alarming rate. According to AV-test, in 2018, there were 86,865 new MacOS malware variants, up from 27,338 the year before&#151;a 31% increase. In contrast, the independent research firm found that new Windows malware had increased from 65.17M to 76.86M during that same period, less than half the rate of growth. The bottom line is that while the numbers look a lot smaller than Windows, it's definitely time to take Mac security more seriously.\\\nThis Analytic Story addresses the ColdRoot remote access trojan (RAT), which was uploaded to Github in 2016, but was still escaping detection by the first quarter of 2018, when a new, more feature-rich variant was discovered masquerading as an Apple audio driver. Among other capabilities, the Pascal-based ColdRoot can heist passwords from users' keychains and remotely control infected machines without detection. In the initial report of his findings, Patrick Wardle, Chief Research Officer for Digita Security, explained that the new ColdRoot RAT could start and kill processes on the breached system, spawn new remote-desktop sessions, take screen captures and assemble them into a live stream of the victim's desktop, and more.\\\nSearches in this Analytic Story leverage the capabilities of OSquery to address ColdRoot detection from several different angles, such as looking for the existence of associated files and processes, and monitoring for signs of an installed keylogger.", "references": ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"], "tags": {"name": "ColdRoot MacOS RAT", "analytic_story": "ColdRoot MacOS RAT", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [], "mitre_attack_tactics": [], "datamodels": ["Endpoint"], "kill_chain_phases": ["Command & Control", "Installation"]}, "detection_names": ["ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - MacOS - Re-opened Applications - Rule", "ESCU - Processes Tapping Keyboard Events - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Jose Hernandez", "detections": [{"name": "Osquery pack - ColdRoot detection", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}, {"name": "MacOS - Re-opened Applications", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}, {"name": "Processes Tapping Keyboard Events", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}]}, {"name": "Collection and Staging", "id": "8e03c61e-13c4-4dcd-bfbe-5ce5a8dc031a", "version": 1, "date": "2020-02-03", "author": "Rico Valdez, Splunk", "description": "Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. ", "narrative": "A common adversary goal is to identify and exfiltrate data of value from a target organization. This data may include email conversations and addresses, confidential company information, links to network design/infrastructure, important dates, and so on.\\\n Attacks are composed of three activities: identification, collection, and staging data for exfiltration. Identification typically involves scanning systems and observing user activity. Collection can involve the transfer of large amounts of data from various repositories. Staging/preparation includes moving data to a central location and compressing (and optionally encoding and/or encrypting) it. All of these activities provide opportunities for defenders to identify their presence. \\\nUse the searches to detect and monitor suspicious behavior related to these activities.", "references": ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"], "tags": {"name": "Collection and Staging", "analytic_story": "Collection and Staging", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1560.001", "mitre_attack_technique": "Archive via Utility", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT1", "APT28", "APT29", "APT3", "APT33", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Chimera", "CopyKittens", "Earth Lusca", "FIN8", "Fox Kitten", "GALLIUM", "Gallmaker", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "MuddyWater", "Mustang Panda", "Sowbug", "Turla", "menuPass"]}, {"mitre_attack_id": "T1560", "mitre_attack_technique": "Archive Collected Data", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT28", "APT32", "Axiom", "Dragonfly", "FIN6", "Ke3chang", "Lazarus Group", "Leviathan", "Patchwork", "menuPass"]}, {"mitre_attack_id": "T1114", "mitre_attack_technique": "Email Collection", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["Magic Hound", "Silent Librarian"]}, {"mitre_attack_id": "T1114.001", "mitre_attack_technique": "Local Email Collection", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT1", "Chimera", "Magic Hound"]}, {"mitre_attack_id": "T1114.002", "mitre_attack_technique": "Remote Email Collection", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT1", "APT28", "APT29", "Chimera", "Dragonfly", "FIN4", "HAFNIUM", "Ke3chang", "Kimsuky", "Leafminer", "Magic Hound"]}], "mitre_attack_tactics": ["Collection", "Defense Evasion"], "datamodels": ["Endpoint", "Network_Traffic"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Detect Renamed 7-Zip - Rule", "ESCU - Detect Renamed WinRAR - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Rico Valdez", "detections": [{"name": "Suspicious writes to System Volume Information", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "Detect Renamed 7-Zip", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Archive via Utility"}, {"mitre_attack_technique": "Archive Collected Data"}]}}, {"name": "Detect Renamed WinRAR", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Archive via Utility"}, {"mitre_attack_technique": "Archive Collected Data"}]}}, {"name": "Suspicious writes to windows Recycle Bin", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "Email files written outside of the Outlook directory", "source": "application", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Email Collection"}, {"mitre_attack_technique": "Local Email Collection"}]}}, {"name": "Email servers sending high volume traffic to hosts", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Email Collection"}, {"mitre_attack_technique": "Remote Email Collection"}]}}, {"name": "Hosts receiving high volume of network traffic from email server", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Email Collection"}, {"mitre_attack_technique": "Email Collection"}]}}]}, {"name": "Command and Control", "id": "943773c6-c4de-4f38-89a8-0b92f98804d8", "version": 1, "date": "2018-06-01", "author": "Rico Valdez, Splunk", "description": "Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.", "narrative": "Threat actors typically architect and implement an infrastructure to use in various ways during the course of their attack campaigns. In some cases, they leverage this infrastructure for scanning and performing reconnaissance activities. In others, they may use this infrastructure to launch actual attacks. One of the most important functions of this infrastructure is to establish servers that will communicate with implants on compromised endpoints. These servers establish a command and control channel that is used to proxy data between the compromised endpoint and the attacker. These channels relay commands from the attacker to the compromised endpoint and the output of those commands back to the attacker.\\\nBecause this communication is so critical for an adversary, they often use techniques designed to hide the true nature of the communications. There are many different techniques used to establish and communicate over these channels. This Analytic Story provides searches that look for a variety of the techniques used for these channels, as well as indications that these channels are active, by examining logs associated with border control devices and network-access control lists.", "references": ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"], "tags": {"name": "Command and Control", "analytic_story": "Command and Control", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1048.003", "mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["APT32", "APT33", "FIN6", "FIN8", "Lazarus Group", "OilRig", "Thrip", "Wizard Spider"]}, {"mitre_attack_id": "T1071.004", "mitre_attack_technique": "DNS", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT18", "APT39", "APT41", "Chimera", "Cobalt Group", "FIN7", "Ke3chang", "LazyScripter", "OilRig", "Tropic Trooper"]}, {"mitre_attack_id": "T1048", "mitre_attack_technique": "Exfiltration Over Alternative Protocol", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1219", "mitre_attack_technique": "Remote Access Software", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["Carbanak", "Cobalt Group", "DarkVishnya", "Evilnum", "GOLD SOUTHFIELD", "Kimsuky", "MuddyWater", "Mustang Panda", "RTM", "Sandworm Team", "TeamTNT", "Thrip"]}, {"mitre_attack_id": "T1568.002", "mitre_attack_technique": "Domain Generation Algorithms", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT41", "TA551"]}, {"mitre_attack_id": "T1095", "mitre_attack_technique": "Non-Application Layer Protocol", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT29", "APT3", "BITTER", "BackdoorDiplomacy", "FIN6", "HAFNIUM", "PLATINUM"]}, {"mitre_attack_id": "T1071", "mitre_attack_technique": "Application Layer Protocol", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["Dragonfly", "Magic Hound", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1071.001", "mitre_attack_technique": "Web Protocols", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Chimera", "Cobalt Group", "Confucius", "Dark Caracal", "FIN4", "FIN8", "Gamaredon Group", "HAFNIUM", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Mustang Panda", "OilRig", "Orangeworm", "Rancor", "Rocke", "Sandworm Team", "Sidewinder", "SilverTerrier", "Stealth Falcon", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "WIRTE", "Windshift", "Wizard Spider"]}, {"mitre_attack_id": "T1189", "mitre_attack_technique": "Drive-by Compromise", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT19", "APT28", "APT32", "APT37", "APT38", "Andariel", "Axiom", "BRONZE BUTLER", "Dark Caracal", "Darkhotel", "Dragonfly", "Earth Lusca", "Elderwood", "Lazarus Group", "Leafminer", "Leviathan", "Machete", "Magic Hound", "PLATINUM", "PROMETHIUM", "Patchwork", "RTM", "Threat Group-3390", "Transparent Tribe", "Turla", "Windigo", "Windshift"]}], "mitre_attack_tactics": ["Command And Control", "Exfiltration", "Initial Access"], "datamodels": ["Endpoint", "Network_Resolution", "Network_Traffic"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Delivery", "Exploitation"]}, "detection_names": ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Windows Remote Access Software Hunt - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect DGA domains using pretrained model in DSDL - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect suspicious DNS TXT records using pretrained model in DSDL - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule"], "investigation_names": ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"], "baseline_names": ["ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Count of Unique IPs Connecting to Ports"], "author_company": "Splunk", "author_name": "Rico Valdez", "detections": [{"name": "Clients Connecting to Multiple DNS Servers", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}]}}, {"name": "Detect Long DNS TXT Record Response", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}]}}, {"name": "Detection of DNS Tunnels", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}]}}, {"name": "DNS Query Requests Resolved by Unauthorized DNS Servers", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DNS"}]}}, {"name": "DNS Exfiltration Using Nslookup App", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}, {"name": "Excessive Usage of NSLOOKUP App", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}, {"name": "Windows Remote Access Software Hunt", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Access Software"}]}}, {"name": "Detect Spike in blocked Outbound Traffic from your AWS", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "Detect DGA domains using pretrained model in DSDL", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Generation Algorithms"}]}}, {"name": "Detect Large Outbound ICMP Packets", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Non-Application Layer Protocol"}]}}, {"name": "Detect suspicious DNS TXT records using pretrained model in DSDL", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Generation Algorithms"}]}}, {"name": "DNS Query Length Outliers - MLTK", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DNS"}, {"mitre_attack_technique": "Application Layer Protocol"}]}}, {"name": "Excessive DNS Failures", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DNS"}, {"mitre_attack_technique": "Application Layer Protocol"}]}}, {"name": "Prohibited Network Traffic Allowed", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}, {"name": "Protocol or Port Mismatch", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}, {"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}, {"name": "TOR Traffic", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Application Layer Protocol"}, {"mitre_attack_technique": "Web Protocols"}]}}, {"name": "Detect hosts connecting to dynamic domain providers", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Drive-by Compromise"}]}}, {"name": "DNS Query Length With High Standard Deviation", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}, {"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}, {"name": "Multiple Archive Files Http Post Traffic", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}, {"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}, {"name": "Plain HTTP POST Exfiltrated Data", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}, {"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}]}, {"name": "Compromised User Account", "id": "19669154-e9d1-4a01-b144-e6592a078092", "version": 1, "date": "2023-01-19", "author": "Mauricio Velazco, Bhavin Patel, Splunk", "description": "Monitor for activities and techniques associated with Compromised User Account attacks.", "narrative": "Compromised User Account occurs when cybercriminals gain unauthorized access to accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization. This analytic storic groups detections that can help security operations teams identify the potential signs of Compromised User Accounts.", "references": ["https://www.proofpoint.com/us/threat-reference/compromised-account"], "tags": {"name": "Compromised User Account", "analytic_story": "Compromised User Account", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1078.004", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Ke3chang", "LAPSUS$"]}, {"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1185", "mitre_attack_technique": "Browser Session Hijacking", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1586", "mitre_attack_technique": "Compromise Accounts", "mitre_attack_tactics": ["Resource Development"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1586.003", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Resource Development"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1621", "mitre_attack_technique": "Multi-Factor Authentication Request Generation", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "LAPSUS$"]}, {"mitre_attack_id": "T1201", "mitre_attack_technique": "Password Policy Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["Chimera", "OilRig", "Turla"]}, {"mitre_attack_id": "T1110", "mitre_attack_technique": "Brute Force", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT38", "APT39", "DarkVishnya", "Dragonfly", "FIN5", "Fox Kitten", "HEXANE", "Lazarus Group", "OilRig", "Turla"]}, {"mitre_attack_id": "T1110.003", "mitre_attack_technique": "Password Spraying", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Chimera", "HEXANE", "Lazarus Group", "Leafminer", "Sandworm Team", "Silent Librarian"]}, {"mitre_attack_id": "T1110.004", "mitre_attack_technique": "Credential Stuffing", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Chimera"]}, {"mitre_attack_id": "T1556", "mitre_attack_technique": "Modify Authentication Process", "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1556.006", "mitre_attack_technique": "Multi-Factor Authentication", "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1535", "mitre_attack_technique": "Unused/Unsupported Cloud Regions", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1110.001", "mitre_attack_technique": "Password Guessing", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28"]}], "mitre_attack_tactics": ["Collection", "Credential Access", "Defense Evasion", "Discovery", "Initial Access", "Persistence", "Privilege Escalation", "Resource Development"], "datamodels": ["Authentication", "Change"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Reconnaissance"]}, "detection_names": ["ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - AWS Concurrent Sessions From Different Ips - Rule", "ESCU - AWS Console Login Failed During MFA Challenge - Rule", "ESCU - AWS High Number Of Failed Authentications For User - Rule", "ESCU - AWS High Number Of Failed Authentications From Ip - Rule", "ESCU - AWS Multiple Users Failing To Authenticate From Ip - Rule", "ESCU - AWS New MFA Method Registered For User - Rule", "ESCU - AWS Password Policy Changes - Rule", "ESCU - AWS Successful Console Authentication From Multiple IPs - Rule", "ESCU - Azure AD Concurrent Sessions From Different Ips - Rule", "ESCU - Azure AD High Number Of Failed Authentications For User - Rule", "ESCU - Azure AD High Number Of Failed Authentications From Ip - Rule", "ESCU - Azure AD New MFA Method Registered For User - Rule", "ESCU - Azure AD Successful Authentication From Different Ips - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Bhavin Patel, Splunk", "author_name": "Mauricio Velazco", "detections": [{"name": "Abnormally High Number Of Cloud Infrastructure API Calls", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "AWS Concurrent Sessions From Different Ips", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Browser Session Hijacking"}]}}, {"name": "AWS Console Login Failed During MFA Challenge", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Multi-Factor Authentication Request Generation"}]}}, {"name": "AWS High Number Of Failed Authentications For User", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Policy Discovery"}]}}, {"name": "AWS High Number Of Failed Authentications From Ip", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Brute Force"}, {"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Credential Stuffing"}]}}, {"name": "AWS Multiple Users Failing To Authenticate From Ip", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Brute Force"}, {"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Credential Stuffing"}]}}, {"name": "AWS New MFA Method Registered For User", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Authentication Process"}, {"mitre_attack_technique": "Multi-Factor Authentication"}]}}, {"name": "AWS Password Policy Changes", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Policy Discovery"}]}}, {"name": "AWS Successful Console Authentication From Multiple IPs", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}, {"name": "Azure AD Concurrent Sessions From Different Ips", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Browser Session Hijacking"}]}}, {"name": "Azure AD High Number Of Failed Authentications For User", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Brute Force"}, {"mitre_attack_technique": "Password Guessing"}]}}, {"name": "Azure AD High Number Of Failed Authentications From Ip", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Brute Force"}, {"mitre_attack_technique": "Password Guessing"}, {"mitre_attack_technique": "Password Spraying"}]}}, {"name": "Azure AD New MFA Method Registered For User", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Authentication Process"}, {"mitre_attack_technique": "Multi-Factor Authentication"}]}}, {"name": "Azure AD Successful Authentication From Different Ips", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Brute Force"}, {"mitre_attack_technique": "Password Guessing"}, {"mitre_attack_technique": "Password Spraying"}]}}, {"name": "Detect AWS Console Login by User from New City", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}, {"name": "Detect AWS Console Login by User from New Country", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}, {"name": "Detect AWS Console Login by User from New Region", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}]}, {"name": "Credential Dumping", "id": "854d78bf-d0e2-4f4e-b05c-640905f86d7a", "version": 3, "date": "2020-02-04", "author": "Rico Valdez, Splunk", "description": "Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping.", "narrative": "Credential dumping&#151;gathering credentials from a target system, often hashed or encrypted&#151;is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\\\nOnce attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\\\nThe detection searches in this Analytic Story monitor access to the Local Security Authority Subsystem Service (LSASS) process, the usage of shadowcopies for credential dumping and some other techniques for credential dumping.", "references": ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"], "tags": {"name": "Credential Dumping", "analytic_story": "Credential Dumping", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.001", "mitre_attack_technique": "LSASS Memory", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT1", "APT28", "APT3", "APT32", "APT33", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Cleaver", "Earth Lusca", "FIN6", "FIN8", "Fox Kitten", "GALLIUM", "HAFNIUM", "Indrik Spider", "Ke3chang", "Kimsuky", "Leafminer", "Leviathan", "Magic Hound", "MuddyWater", "OilRig", "PLATINUM", "Sandworm Team", "Silence", "TEMP.Veles", "Threat Group-3390", "Whitefly"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003.003", "mitre_attack_technique": "NTDS", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "Chimera", "Dragonfly", "FIN6", "Fox Kitten", "HAFNIUM", "Ke3chang", "LAPSUS$", "Mustang Panda", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1112", "mitre_attack_technique": "Modify Registry", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "APT38", "APT41", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN8", "Gamaredon Group", "Gorgon Group", "Kimsuky", "Magic Hound", "Patchwork", "Silence", "TA505", "Threat Group-3390", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1078.003", "mitre_attack_technique": "Local Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT29", "APT32", "FIN10", "HAFNIUM", "Kimsuky", "PROMETHIUM", "Tropic Trooper", "Turla"]}, {"mitre_attack_id": "T1552.001", "mitre_attack_technique": "Credentials In Files", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT3", "APT33", "Fox Kitten", "Kimsuky", "Leafminer", "MuddyWater", "OilRig", "TA505", "TeamTNT"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Execution", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": ["Authentication", "Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Reconnaissance"]}, "detection_names": ["ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Enable WDigest UseLogonCredential Registry - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Extraction of Registry Hives - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Potential password in username - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Windows Credential Dumping LSASS Memory Createdump - Rule", "ESCU - Windows Hunting System Account Targeting Lsass - Rule", "ESCU - Windows Mimikatz Binary Execution - Rule", "ESCU - Windows Non-System Account Targeting Lsass - Rule", "ESCU - Windows Possible Credential Dumping - Rule"], "investigation_names": ["ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Rico Valdez", "detections": [{"name": "Dump LSASS via procdump Rename", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}]}}, {"name": "Unsigned Image Loaded by LSASS", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}]}}, {"name": "Access LSASS Memory for Dump Creation", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Attempted Credential Dump From Registry via Reg exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Create Remote Thread into LSASS", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Creation of lsass Dump with Taskmgr", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Creation of Shadow Copy", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "NTDS"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Creation of Shadow Copy with wmic and powershell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "NTDS"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Credential Dumping via Copy Command from Shadow Copy", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "NTDS"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Credential Dumping via Symlink to Shadow Copy", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "NTDS"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Detect Copy of ShadowCopy with Script Block Logging", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Detect Credential Dumping through LSASS access", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Detect Mimikatz Using Loaded Images", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Dump LSASS via comsvcs DLL", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Dump LSASS via procdump", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Enable WDigest UseLogonCredential Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Esentutl SAM Copy", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Extraction of Registry Hives", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Ntdsutil Export NTDS", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "NTDS"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Potential password in username", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Local Accounts"}, {"mitre_attack_technique": "Credentials In Files"}]}}, {"name": "SAM Database File Access Attempt", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "SecretDumps Offline NTDS Dumping Tool", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "NTDS"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Set Default PowerShell Execution Policy To Unrestricted or Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Windows Credential Dumping LSASS Memory Createdump", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}]}}, {"name": "Windows Hunting System Account Targeting Lsass", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Windows Mimikatz Binary Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Windows Non-System Account Targeting Lsass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Windows Possible Credential Dumping", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}]}, {"name": "CVE-2022-40684 Fortinet Appliance Auth bypass", "id": "55721831-577e-41be-beef-bdc03c81486a", "version": 1, "date": "2022-10-14", "author": "Michael Haag, Splunk", "description": "Fortinet recently patched a critical authentication bypass vulnerability in their FortiOS, FortiProxy, and FortiSwitchManager projects CVE-2022-40684.", "narrative": "FortiOS exposes a management web portal that allows a user configure the system. Additionally, a user can SSH into the system which exposes a locked down CLI interface. Any HTTP requests to the management interface of the system that match the conditions above should be cause for concern. An attacker can use this vulnerability to do just about anything they want to the vulnerable system. This includes changing network configurations, adding new users, and initiating packet captures. Note that this is not the only way to exploit this vulnerability and there may be other sets of conditions that work. For instance, a modified version of this exploit uses the User-Agent Node.js. This exploit seems to follow a trend among recently discovered enterprise software vulnerabilities where HTTP headers are improperly validated or overly trusted. (ref Horizon3.ai)", "references": ["https://www.wordfence.com/blog/2022/10/threat-advisory-cve-2022-40684-fortinet-appliance-auth-bypass/", "https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/", "https://github.com/horizon3ai/CVE-2022-40684", "https://attackerkb.com/topics/QWOxGIKkGx/cve-2022-40684/rapid7-analysis", "https://www.greynoise.io/blog/fortios-authentication-bypass"], "tags": {"name": "CVE-2022-40684 Fortinet Appliance Auth bypass", "analytic_story": "CVE-2022-40684 Fortinet Appliance Auth bypass", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}], "mitre_attack_tactics": ["Initial Access"], "datamodels": ["Web"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Fortinet Appliance Auth bypass - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Fortinet Appliance Auth bypass", "source": "web", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}]}, {"name": "CyclopsBLink", "id": "7c75b1c8-dfff-46f1-8250-e58df91b6fd9", "version": 1, "date": "2022-04-07", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the cyclopsblink malware including firewall modification, spawning more process, botnet c2 communication, defense evasion and etc. Cyclops Blink is a Linux ELF executable compiled for 32-bit x86 and PowerPC architecture that has targeted several network devices. The complete list of targeted devices is unknown at this time, but WatchGuard FireBox has specifically been listed as a target. The modular malware consists of core components and modules that are deployed as child processes using the Linux API fork. At this point, four modules have been identified that download and upload files, gather system information and contain updating mechanisms for the malware itself. Additional modules can be downloaded and executed from the command and control (C2) server.", "narrative": "Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption is the goal.", "references": ["https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf", "https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html"], "tags": {"name": "CyclopsBLink", "analytic_story": "Cyclops BLink", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1562.004", "mitre_attack_technique": "Disable or Modify System Firewall", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "APT38", "Carbanak", "Dragonfly", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1036.004", "mitre_attack_technique": "Masquerade Task or Service", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT32", "APT41", "BITTER", "BackdoorDiplomacy", "Carbanak", "FIN6", "FIN7", "Fox Kitten", "Higaisa", "Kimsuky", "Lazarus Group", "Naikon", "PROMETHIUM", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}], "mitre_attack_tactics": ["Defense Evasion"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Linux Iptables Firewall Modification - Rule", "ESCU - Linux Kworker Process In Writable Process Path - Rule", "ESCU - Linux Stdout Redirection To Dev Null File - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Linux Iptables Firewall Modification", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify System Firewall"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Linux Kworker Process In Writable Process Path", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerade Task or Service"}, {"mitre_attack_technique": "Masquerading"}]}}, {"name": "Linux Stdout Redirection To Dev Null File", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify System Firewall"}, {"mitre_attack_technique": "Impair Defenses"}]}}]}, {"name": "DarkCrystal RAT", "id": "639e6006-0885-4847-9394-ddc2902629bf", "version": 1, "date": "2022-07-26", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DcRat malware including ddos, spawning more process, botnet c2 communication, defense evasion and etc. The DcRat malware is known commercial backdoor that was first released in 2018. This tool was sold in underground forum and known to be one of the cheapest commercial RATs. DcRat is modular and bespoke plugin framework make it a very flexible option, helpful for a range of nefearious uses.", "narrative": "Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption is the goal.", "references": ["https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor", "https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat"], "tags": {"name": "DarkCrystal RAT", "analytic_story": "DarkCrystal RAT", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1105", "mitre_attack_technique": "Ingress Tool Transfer", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "Chimera", "Cobalt Group", "Confucius", "Darkhotel", "Dragonfly", "Elderwood", "Ember Bear", "Evilnum", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "IndigoZebra", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "Rancor", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Turla", "Volatile Cedar", "WIRTE", "Whitefly", "Windshift", "Winnti Group", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1027", "mitre_attack_technique": "Obfuscated Files or Information", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "Aquatic Panda", "BITTER", "BackdoorDiplomacy", "BlackOasis", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Earth Lusca", "Elderwood", "Ember Bear", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Group5", "HEXANE", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leafminer", "Leviathan", "Magic Hound", "Mofang", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Putter Panda", "Rocke", "Sandworm Team", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Transparent Tribe", "Tropic Trooper", "Turla", "Whitefly", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1566", "mitre_attack_technique": "Phishing", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["Axiom", "GOLD SOUTHFIELD"]}, {"mitre_attack_id": "T1566.001", "mitre_attack_technique": "Spearphishing Attachment", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "IndigoZebra", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1592.001", "mitre_attack_technique": "Hardware", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1592", "mitre_attack_technique": "Gather Victim Host Information", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1590.005", "mitre_attack_technique": "IP Addresses", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": ["Andariel", "HAFNIUM"]}, {"mitre_attack_id": "T1590", "mitre_attack_technique": "Gather Victim Network Information", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": ["HAFNIUM"]}, {"mitre_attack_id": "T1485", "mitre_attack_technique": "Data Destruction", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "Gamaredon Group", "LAPSUS$", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1529", "mitre_attack_technique": "System Shutdown/Reboot", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT37", "APT38", "Lazarus Group"]}, {"mitre_attack_id": "T1124", "mitre_attack_technique": "System Time Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["BRONZE BUTLER", "Chimera", "Darkhotel", "Higaisa", "Lazarus Group", "Sidewinder", "The White Company", "Turla", "ZIRCONIUM"]}], "mitre_attack_tactics": ["Command And Control", "Defense Evasion", "Discovery", "Execution", "Impact", "Initial Access", "Persistence", "Privilege Escalation", "Reconnaissance"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawn CMD Process - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Windows Command Shell DCRat ForkBomb Payload - Rule", "ESCU - Windows Gather Victim Host Information Camera - Rule", "ESCU - Windows Gather Victim Network Info Through Ip Check Web Services - Rule", "ESCU - Windows High File Deletion Frequency - Rule", "ESCU - Windows Ingress Tool Transfer Using Explorer - Rule", "ESCU - Windows System LogOff Commandline - Rule", "ESCU - Windows System Reboot CommandLine - Rule", "ESCU - Windows System Shutdown CommandLine - Rule", "ESCU - Windows System Time Discovery W32tm Delay - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Any Powershell DownloadFile", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "CMD Carry Out String Command Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Command Shell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Executables Or Script Creation In Suspicious Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "Malicious PowerShell Process - Encoded Command", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Obfuscated Files or Information"}]}}, {"name": "Malicious PowerShell Process - Execution Policy Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Office Document Executing Macro Code", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Spawn CMD Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Scheduled Task Deleted Or Created via CMD", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Suspicious Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Suspicious Scheduled Task from Public Directory", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Windows Command Shell DCRat ForkBomb Payload", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Command Shell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Windows Gather Victim Host Information Camera", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Hardware"}, {"mitre_attack_technique": "Gather Victim Host Information"}]}}, {"name": "Windows Gather Victim Network Info Through Ip Check Web Services", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "IP Addresses"}, {"mitre_attack_technique": "Gather Victim Network Information"}]}}, {"name": "Windows High File Deletion Frequency", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Windows Ingress Tool Transfer Using Explorer", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Windows System LogOff Commandline", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Shutdown/Reboot"}]}}, {"name": "Windows System Reboot CommandLine", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Shutdown/Reboot"}]}}, {"name": "Windows System Shutdown CommandLine", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Shutdown/Reboot"}]}}, {"name": "Windows System Time Discovery W32tm Delay", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Time Discovery"}]}}, {"name": "WinEvent Windows Task Scheduler Event Action Started", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}]}}, {"name": "Winword Spawning Cmd", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Winword Spawning PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}]}, {"name": "Data Destruction", "id": "4ae5c0d1-cebd-47d1-bfce-71bf096e38aa", "version": 1, "date": "2022-02-14", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the data destruction, including deleting files, overwriting files, wiping disk and encrypting files.", "narrative": "Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption is the goal.", "references": ["https://attack.mitre.org/techniques/T1485/", "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/", "https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware"], "tags": {"name": "Data Destruction", "analytic_story": "Data Destruction", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021.002", "mitre_attack_technique": "SMB/Windows Admin Shares", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT39", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "FIN8", "Fox Kitten", "Ke3chang", "Lazarus Group", "Moses Staff", "Orangeworm", "Sandworm Team", "Threat Group-1314", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1485", "mitre_attack_technique": "Data Destruction", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "Gamaredon Group", "LAPSUS$", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1070.004", "mitre_attack_technique": "File Deletion", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT3", "APT32", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Chimera", "Cobalt Group", "Dragonfly", "Evilnum", "FIN10", "FIN5", "FIN6", "FIN8", "Gamaredon Group", "Group5", "Kimsuky", "Lazarus Group", "Magic Hound", "Mustang Panda", "OilRig", "Patchwork", "Rocke", "Sandworm Team", "Silence", "TEMP.Veles", "TeamTNT", "The White Company", "Threat Group-3390", "Tropic Trooper", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1070", "mitre_attack_technique": "Indicator Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Lazarus Group"]}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.010", "mitre_attack_technique": "Regsvr32", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "Blue Mockingbird", "Cobalt Group", "Deep Panda", "Inception", "Kimsuky", "Lazarus Group", "Leviathan", "TA551", "WIRTE"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1112", "mitre_attack_technique": "Modify Registry", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "APT38", "APT41", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN8", "Gamaredon Group", "Gorgon Group", "Kimsuky", "Magic Hound", "Patchwork", "Silence", "TA505", "Threat Group-3390", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1561.002", "mitre_attack_technique": "Disk Structure Wipe", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT37", "APT38", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1561", "mitre_attack_technique": "Disk Wipe", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Defense Evasion", "Execution", "Impact", "Lateral Movement", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Executable File Written in Administrative SMB Share - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Linux DD File Overwrite - Rule", "ESCU - Linux Deleting Critical Directory Using RM Command - Rule", "ESCU - Linux High Frequency Of File Deletion In Boot Folder - Rule", "ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows File Without Extension In Critical Folder - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Raw Access To Disk Volume Partition - Rule", "ESCU - Windows Raw Access To Master Boot Record Drive - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "CMD Carry Out String Command Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Command Shell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Executable File Written in Administrative SMB Share", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "SMB/Windows Admin Shares"}]}}, {"name": "Executables Or Script Creation In Suspicious Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "Linux DD File Overwrite", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Linux Deleting Critical Directory Using RM Command", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Linux High Frequency Of File Deletion In Boot Folder", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}, {"mitre_attack_technique": "File Deletion"}, {"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "Regsvr32 Silent and Install Param Dll Loading", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvr32"}]}}, {"name": "Suspicious Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Windows Disable Memory Crash Dump", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Windows File Without Extension In Critical Folder", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Windows Modify Show Compress Color And Info Tip Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Raw Access To Disk Volume Partition", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disk Structure Wipe"}, {"mitre_attack_technique": "Disk Wipe"}]}}, {"name": "Windows Raw Access To Master Boot Record Drive", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disk Structure Wipe"}, {"mitre_attack_technique": "Disk Wipe"}]}}]}, {"name": "Data Exfiltration", "id": "66b0fe0c-1351-11eb-adc1-0242ac120002", "version": 1, "date": "2020-10-21", "author": "Shannon Davis, Splunk", "description": "The stealing of data by an adversary.", "narrative": "Exfiltration comes in many flavors.  Adversaries can collect data over encrypted or non-encrypted channels.  They can utilise Command and Control channels that are already in place to exfiltrate data.  They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data.  Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place.", "references": ["https://attack.mitre.org/tactics/TA0010/"], "tags": {"name": "Data Exfiltration", "analytic_story": "Data Exfiltration", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1537", "mitre_attack_technique": "Transfer Data to Cloud Account", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1114", "mitre_attack_technique": "Email Collection", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["Magic Hound", "Silent Librarian"]}, {"mitre_attack_id": "T1114.003", "mitre_attack_technique": "Email Forwarding Rule", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["Kimsuky", "LAPSUS$", "Silent Librarian"]}, {"mitre_attack_id": "T1048", "mitre_attack_technique": "Exfiltration Over Alternative Protocol", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1105", "mitre_attack_technique": "Ingress Tool Transfer", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "Chimera", "Cobalt Group", "Confucius", "Darkhotel", "Dragonfly", "Elderwood", "Ember Bear", "Evilnum", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "IndigoZebra", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "Rancor", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Turla", "Volatile Cedar", "WIRTE", "Whitefly", "Windshift", "Winnti Group", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1114.001", "mitre_attack_technique": "Local Email Collection", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT1", "Chimera", "Magic Hound"]}, {"mitre_attack_id": "T1566", "mitre_attack_technique": "Phishing", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["Axiom", "GOLD SOUTHFIELD"]}, {"mitre_attack_id": "T1568.002", "mitre_attack_technique": "Domain Generation Algorithms", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT41", "TA551"]}, {"mitre_attack_id": "T1041", "mitre_attack_technique": "Exfiltration Over C2 Channel", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["APT3", "APT32", "APT39", "Chimera", "Confucius", "GALLIUM", "Gamaredon Group", "Higaisa", "Ke3chang", "Kimsuky", "Lazarus Group", "Leviathan", "MuddyWater", "Sandworm Team", "Stealth Falcon", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1048.003", "mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["APT32", "APT33", "FIN6", "FIN8", "Lazarus Group", "OilRig", "Thrip", "Wizard Spider"]}], "mitre_attack_tactics": ["Collection", "Command And Control", "Exfiltration", "Initial Access"], "datamodels": ["Endpoint", "Network_Resolution", "Network_Traffic"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Exploitation"]}, "detection_names": ["ESCU - Detect shared ec2 snapshot - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Linux Curl Upload File - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Gdrive suspicious file sharing - Rule", "ESCU - Detect DGA domains using pretrained model in DSDL - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Shannon Davis", "detections": [{"name": "Detect shared ec2 snapshot", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Transfer Data to Cloud Account"}]}}, {"name": "O365 PST export alert", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Email Collection"}]}}, {"name": "O365 Suspicious Admin Email Forwarding", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Email Forwarding Rule"}, {"mitre_attack_technique": "Email Collection"}]}}, {"name": "O365 Suspicious User Email Forwarding", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Email Forwarding Rule"}, {"mitre_attack_technique": "Email Collection"}]}}, {"name": "DNS Exfiltration Using Nslookup App", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}, {"name": "Excessive Usage of NSLOOKUP App", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}, {"name": "Linux Curl Upload File", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Mailsniper Invoke functions", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Email Collection"}, {"mitre_attack_technique": "Local Email Collection"}]}}, {"name": "Gdrive suspicious file sharing", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}]}}, {"name": "Detect DGA domains using pretrained model in DSDL", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Generation Algorithms"}]}}, {"name": "Detect SNICat SNI Exfiltration", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over C2 Channel"}]}}, {"name": "Multiple Archive Files Http Post Traffic", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}, {"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}, {"name": "Plain HTTP POST Exfiltrated Data", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}, {"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}]}, {"name": "Data Protection", "id": "91c676cf-0b23-438d-abee-f6335e1fce33", "version": 1, "date": "2017-09-14", "author": "Bhavin Patel, Splunk", "description": "Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration.", "narrative": "Attackers can leverage a variety of resources to compromise or exfiltrate enterprise data. Common exfiltration techniques include remote-access channels via low-risk, high-payoff active-collections operations and close-access operations using insiders and removable media. While this Analytic Story is not a comprehensive listing of all the methods by which attackers can exfiltrate data, it provides a useful starting point.", "references": ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"], "tags": {"name": "Data Protection", "analytic_story": "Data Protection", "category": ["Abuse"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1048.003", "mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["APT32", "APT33", "FIN6", "FIN8", "Lazarus Group", "OilRig", "Thrip", "Wizard Spider"]}, {"mitre_attack_id": "T1189", "mitre_attack_technique": "Drive-by Compromise", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT19", "APT28", "APT32", "APT37", "APT38", "Andariel", "Axiom", "BRONZE BUTLER", "Dark Caracal", "Darkhotel", "Dragonfly", "Earth Lusca", "Elderwood", "Lazarus Group", "Leafminer", "Leviathan", "Machete", "Magic Hound", "PLATINUM", "PROMETHIUM", "Patchwork", "RTM", "Threat Group-3390", "Transparent Tribe", "Turla", "Windigo", "Windshift"]}], "mitre_attack_tactics": ["Exfiltration", "Initial Access"], "datamodels": ["Change_Analysis", "Network_Resolution"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Installation"]}, "detection_names": ["ESCU - Detect USB device insertion - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule"], "investigation_names": ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Detect USB device insertion", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}, {"name": "Detection of DNS Tunnels", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}]}}, {"name": "Detect hosts connecting to dynamic domain providers", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Drive-by Compromise"}]}}]}, {"name": "Deobfuscate-Decode Files or Information", "id": "0bd01a54-8cbe-11eb-abcd-acde48001122", "version": 1, "date": "2021-03-24", "author": "Michael Haag, Splunk", "description": "Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.", "narrative": "An example of obfuscated files is `Certutil.exe` usage to encode a portable executable to a certificate file, which is base64 encoded, to hide the originating file. There are many utilities cross-platform to encode using XOR, using compressed .cab files to hide contents and scripting languages that may perform similar native Windows tasks. Triaging an event related will require the capability to review related process events and file modifications. Using a tool such as CyberChef will assist with identifying the encoding that was used, and potentially assist with decoding the contents.", "references": ["https://attack.mitre.org/techniques/T1140/"], "tags": {"name": "Deobfuscate-Decode Files or Information", "analytic_story": "Deobfuscate-Decode Files or Information", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1140", "mitre_attack_technique": "Deobfuscate/Decode Files or Information", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT39", "BRONZE BUTLER", "Darkhotel", "Earth Lusca", "Gamaredon Group", "Gorgon Group", "Higaisa", "Ke3chang", "Kimsuky", "Lazarus Group", "Leviathan", "Molerats", "MuddyWater", "OilRig", "Rocke", "Sandworm Team", "TA505", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "WIRTE", "ZIRCONIUM", "menuPass"]}], "mitre_attack_tactics": ["Defense Evasion"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - CertUtil With Decode Argument - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "CertUtil With Decode Argument", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Deobfuscate/Decode Files or Information"}]}}]}, {"name": "AWS Cryptomining", "id": "ced74200-8465-4bc3-bd2c-9a782eec6750", "version": 1, "date": "2018-03-08", "author": "David Dorsey, Splunk", "description": "Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior.", "narrative": "Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \\\nCryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS). It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \\\nWhen malicious miners appropriate a cloud instance, often spinning up hundreds of new instances, the costs can become astronomical for the account holder. So, it is critically important to monitor your systems for suspicious activities that could indicate that your network has been infiltrated. \\\nThis Analytic Story is focused on detecting suspicious new instances in your EC2 environment to help prevent such a disaster. It contains detection searches that will detect when a previously unused instance type or AMI is used. It also contains support searches to build lookup files to ensure proper execution of the detection searches.", "references": ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"], "tags": {"name": "AWS Cryptomining", "analytic_story": "AWS Cryptomining", "category": ["Cloud Security"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1078.004", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Ke3chang", "LAPSUS$"]}, {"mitre_attack_id": "T1535", "mitre_attack_technique": "Unused/Unsupported Cloud Regions", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": [], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"], "investigation_names": ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"], "baseline_names": ["ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Previously Seen EC2 AMIs", "ESCU - Previously Seen EC2 Instance Types", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Previously Seen AWS Regions"], "author_company": "Splunk", "author_name": "David Dorsey", "detections": [{"name": "Abnormally High AWS Instances Launched by User", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}]}}, {"name": "Abnormally High AWS Instances Launched by User - MLTK", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}]}}, {"name": "EC2 Instance Started In Previously Unseen Region", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}, {"name": "EC2 Instance Started With Previously Unseen AMI", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "EC2 Instance Started With Previously Unseen Instance Type", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "EC2 Instance Started With Previously Unseen User", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}]}}]}, {"name": "AWS Suspicious Provisioning Activities", "id": "3338b567-3804-4261-9889-cf0ca4753c7f", "version": 1, "date": "2018-03-16", "author": "David Dorsey, Splunk", "description": "Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network.", "narrative": "Because most enterprise AWS activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary. \\\nThis Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further.", "references": ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"], "tags": {"name": "AWS Suspicious Provisioning Activities", "analytic_story": "AWS Suspicious Provisioning Activities", "category": ["Cloud Security"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1535", "mitre_attack_technique": "Unused/Unsupported Cloud Regions", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Defense Evasion"], "datamodels": [], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule"], "investigation_names": ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get All AWS Activity From Region - Response Task"], "baseline_names": ["ESCU - Previously Seen AWS Provisioning Activity Sources"], "author_company": "Splunk", "author_name": "David Dorsey", "detections": [{"name": "AWS Cloud Provisioning From Previously Unseen City", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}, {"name": "AWS Cloud Provisioning From Previously Unseen Country", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}, {"name": "AWS Cloud Provisioning From Previously Unseen IP Address", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "AWS Cloud Provisioning From Previously Unseen Region", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}]}, {"name": "Common Phishing Frameworks", "id": "9a64ab44-9214-4639-8163-7eaa2621bd61", "version": 1, "date": "2019-04-29", "author": "Splunk Research Team, Splunk", "description": "Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email. ", "narrative": "As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Because phishing is a technique that relies on human psychology, you will never be able to eliminate this vulnerability 100%. But you can use automated detection to significantly reduce the risks.\\\nThis Analytic Story focuses on detecting signs of MiTM attacks enabled by [EvilGinx2](https://github.com/kgretzky/evilginx2), a toolkit that sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect. Searches in this story look for signs of MiTM attacks enabled by EvilGinx2.", "references": ["https://github.com/kgretzky/evilginx2", "https://attack.mitre.org/techniques/T1192/", "https://breakdev.org/evilginx-advanced-phishing-with-two-factor-authentication-bypass/"], "tags": {"name": "Common Phishing Frameworks", "analytic_story": "Common Phishing Frameworks", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1566.003", "mitre_attack_technique": "Spearphishing via Service", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT29", "Ajax Security Team", "Dark Caracal", "EXOTIC LILY", "FIN6", "Lazarus Group", "Magic Hound", "OilRig", "Windshift"]}], "mitre_attack_tactics": ["Initial Access"], "datamodels": ["Network_Resolution"], "kill_chain_phases": ["Command & Control", "Delivery"]}, "detection_names": ["ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule"], "investigation_names": ["ESCU - Get Certificate logs for a domain - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Splunk Research Team", "detections": [{"name": "Detect DNS requests to Phishing Sites leveraging EvilGinx2", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing via Service"}]}}]}, {"name": "Container Implantation Monitoring and Investigation", "id": "aa0e28b1-0521-4b6f-9d2a-7b87e34af246", "version": 1, "date": "2020-02-20", "author": "Rod Soto, Rico Valdez, Splunk", "description": "Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company's repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry.", "narrative": "Container Registrys provide a way for organizations to keep customized images of their development and infrastructure environment in private. However if these repositories are misconfigured or priviledge users credentials are compromise, attackers can potentially upload implanted containers which can be deployed across the organization. These searches allow operator to monitor who, when and what was uploaded to container registry.", "references": ["https://github.com/splunk/cloud-datamodel-security-research"], "tags": {"name": "Container Implantation Monitoring and Investigation", "analytic_story": "Container Implantation Monitoring and Investigation", "category": ["Cloud Security"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [], "mitre_attack_tactics": [], "datamodels": [], "kill_chain_phases": []}, "detection_names": [], "investigation_names": [], "baseline_names": [], "author_company": "Rico Valdez, Splunk", "author_name": "Rod Soto", "detections": []}, {"name": "Host Redirection", "id": "2e8948a5-5239-406b-b56b-6c50fe268af4", "version": 1, "date": "2017-09-14", "author": "Rico Valdez, Splunk", "description": "Detect evidence of tactics used to redirect traffic from a host to a destination other than the one intended--potentially one that is part of an adversary's attack infrastructure. An example is redirecting communications regarding patches and updates or misleading users into visiting a malicious website.", "narrative": "Attackers will often attempt to manipulate client communications for nefarious purposes. In some cases, an attacker may endeavor to modify a local host file to redirect communications with resources (such as antivirus or system-update services) to prevent clients from receiving patches or updates. In other cases, an attacker might use this tactic to have the client connect to a site that looks like the intended site, but instead installs malware or collects information from the victim. Additionally, an attacker may redirect a victim in order to execute a MITM attack and observe communications.", "references": ["https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-hijacks/"], "tags": {"name": "Host Redirection", "analytic_story": "Host Redirection", "category": ["Abuse"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1048.003", "mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["APT32", "APT33", "FIN6", "FIN8", "Lazarus Group", "OilRig", "Thrip", "Wizard Spider"]}, {"mitre_attack_id": "T1071.004", "mitre_attack_technique": "DNS", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT18", "APT39", "APT41", "Chimera", "Cobalt Group", "FIN7", "Ke3chang", "LazyScripter", "OilRig", "Tropic Trooper"]}], "mitre_attack_tactics": ["Command And Control", "Exfiltration"], "datamodels": ["Network_Resolution"], "kill_chain_phases": ["Command & Control"]}, "detection_names": ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Windows hosts file modification - Rule"], "investigation_names": ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Rico Valdez", "detections": [{"name": "Clients Connecting to Multiple DNS Servers", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}]}}, {"name": "DNS Query Requests Resolved by Unauthorized DNS Servers", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DNS"}]}}, {"name": "Windows hosts file modification", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}]}, {"name": "Kubernetes Sensitive Role Activity", "id": "8b3984d2-17b6-47e9-ba43-a3376e70fdcc", "version": 1, "date": "2020-05-20", "author": "Rod Soto, Splunk", "description": "This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces.", "narrative": "Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive roles within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes role activities", "references": ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"], "tags": {"name": "Kubernetes Sensitive Role Activity", "analytic_story": "Kubernetes Sensitive Role Activity", "category": ["Cloud Security"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [], "mitre_attack_tactics": [], "datamodels": [], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Kubernetes AWS detect most active service accounts by pod - Rule", "ESCU - Kubernetes AWS detect RBAC authorization by account - Rule", "ESCU - Kubernetes AWS detect sensitive role access - Rule", "ESCU - Kubernetes Azure active service accounts by pod namespace - Rule", "ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule", "ESCU - Kubernetes GCP detect most active service accounts by pod - Rule", "ESCU - Kubernetes GCP detect sensitive role access - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Rod Soto", "detections": [{"name": "Kubernetes AWS detect most active service accounts by pod", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Kubernetes AWS detect RBAC authorization by account", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Kubernetes AWS detect sensitive role access", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Kubernetes Azure active service accounts by pod namespace", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Kubernetes Azure detect RBAC authorization by account", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Kubernetes Azure detect sensitive role access", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Kubernetes GCP detect RBAC authorizations by account", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Kubernetes GCP detect most active service accounts by pod", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Kubernetes GCP detect sensitive role access", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}]}, {"name": "Lateral Movement", "id": "399d65dc-1f08-499b-a259-abd9051f38ad", "version": 2, "date": "2020-02-04", "author": "David Dorsey, Splunk", "description": " DEPRECATED IN FAVOR OF ACTIVE DIRECTORY LATERAL MOVEMENT. Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts.", "narrative": "Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation. Indications of lateral movement can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash, or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or \"crown jewels\" to a persistent threat actor. An adversary can use lateral movement for multiple purposes, including remote execution of tools, pivoting to additional systems, obtaining access to specific information or files, access to additional credentials, exfiltrating data, or delivering a secondary effect. Adversaries may use legitimate credentials alongside inherent network and operating-system functionality to remotely connect to other systems and remain under the radar of network defenders. If there is evidence of lateral movement, it is imperative for analysts to collect evidence of the associated offending hosts. For example, an attacker might leverage host A to gain access to host B. From there, the attacker may try to move laterally to host C. In this example, the analyst should gather as much information as possible from all three hosts. It is also important to collect authentication logs for each host, to ensure that the offending accounts are well-documented. Analysts should account for all processes to ensure that the attackers did not install unauthorized software.", "references": ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"], "tags": {"name": "Lateral Movement", "analytic_story": "Lateral Movement", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [], "mitre_attack_tactics": [], "datamodels": [], "kill_chain_phases": []}, "detection_names": [], "investigation_names": ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "David Dorsey", "detections": []}, {"name": "Monitor Backup Solution", "id": "abe807c7-1eb6-4304-ac32-6e7aacdb891d", "version": 1, "date": "2017-09-12", "author": "David Dorsey, Splunk", "description": "Address common concerns when monitoring your backup processes. These searches can help you reduce risks from ransomware, device theft, or denial of physical access to a host by backing up data on endpoints.", "narrative": "Having backups is a standard best practice that helps ensure continuity of business operations.  Having mature backup processes can also help you reduce the risks of many security-related incidents and streamline your response processes. The detection searches in this Analytic Story will help you identify systems that have backup failures, as well as systems that have not been backed up for an extended period of time. The story will also return the notable event history and all of the backup logs for an endpoint.", "references": ["https://www.carbonblack.com/2016/03/04/tracking-locky-ransomware-using-carbon-black/"], "tags": {"name": "Monitor Backup Solution", "analytic_story": "Monitor Backup Solution", "category": ["Best Practices"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Compliance", "mitre_attack_enrichments": [], "mitre_attack_tactics": [], "datamodels": [], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Extended Period Without Successful Netbackup Backups - Rule", "ESCU - Unsuccessful Netbackup backups - Rule"], "investigation_names": ["ESCU - All backup logs for host - Response Task", "ESCU - Get Notable History - Response Task"], "baseline_names": ["ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups"], "author_company": "Splunk", "author_name": "David Dorsey", "detections": [{"name": "Extended Period Without Successful Netbackup Backups", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Unsuccessful Netbackup backups", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}]}, {"name": "Monitor for Unauthorized Software", "id": "8892a655-6205-43f7-abba-06460e38c8ae", "version": 1, "date": "2017-09-15", "author": "David Dorsey, Splunk", "description": "Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment. ", "narrative": "It is critical to identify unauthorized software and processes running on enterprise endpoints and determine whether they are likely to be malicious. This Analytic Story requires the user to populate the Interesting Processes table within Enterprise Security with prohibited processes. An included support search will augment this data, adding information on processes thought to be malicious. This search requires data from endpoint detection-and-response solutions, endpoint data sources (such as Sysmon), or Windows Event Logs--assuming that the Active Directory administrator has enabled process tracking within the System Event Audit Logs.\\\nIt is important to investigate any software identified as suspicious, in order to understand how it was installed or executed. Analyzing authentication logs or any historic notable events might elicit additional investigative leads of interest. For best results, schedule the search to run every two weeks. ", "references": ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"], "tags": {"name": "Monitor for Unauthorized Software", "analytic_story": "Monitor for Unauthorized Software", "category": ["Best Practices"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Compliance", "mitre_attack_enrichments": [{"mitre_attack_id": "T1036.005", "mitre_attack_technique": "Match Legitimate Name or Location", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT1", "APT28", "APT29", "APT32", "APT39", "APT41", "Aoqin Dragon", "BRONZE BUTLER", "BackdoorDiplomacy", "Blue Mockingbird", "Carbanak", "Chimera", "Darkhotel", "Earth Lusca", "FIN7", "Ferocious Kitten", "Fox Kitten", "Gamaredon Group", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Poseidon Group", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "Sowbug", "TEMP.Veles", "TeamTNT", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Whitefly", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1595", "mitre_attack_technique": "Active Scanning", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Reconnaissance"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Installation"]}, "detection_names": ["ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Attacker Tools On Endpoint - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"], "baseline_names": ["ESCU - Add Prohibited Processes to Enterprise Security"], "author_company": "Splunk", "author_name": "David Dorsey", "detections": [{"name": "Prohibited Software On Endpoint", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Attacker Tools On Endpoint", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Match Legitimate Name or Location"}, {"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "OS Credential Dumping"}, {"mitre_attack_technique": "Active Scanning"}]}}]}, {"name": "Spectre And Meltdown Vulnerabilities", "id": "6d3306f6-bb2b-4219-8609-8efad64032f2", "version": 1, "date": "2018-01-08", "author": "David Dorsey, Splunk", "description": "Assess and mitigate your systems' vulnerability to Spectre and Meltdown exploitation with the searches in this Analytic Story.", "narrative": "Meltdown and Spectre exploit critical vulnerabilities in modern CPUs that allow unintended access to data in memory. This Analytic Story will help you identify the systems can be patched for these vulnerabilities, as well as those that still need to be patched.", "references": ["https://meltdownattack.com/"], "tags": {"name": "Spectre And Meltdown Vulnerabilities", "analytic_story": "Spectre And Meltdown Vulnerabilities", "category": ["Vulnerability"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [], "mitre_attack_tactics": [], "datamodels": ["Vulnerabilities"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Spectre and Meltdown Vulnerable Systems - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task"], "baseline_names": ["ESCU - Systems Ready for Spectre-Meltdown Windows Patch"], "author_company": "Splunk", "author_name": "David Dorsey", "detections": [{"name": "Spectre and Meltdown Vulnerable Systems", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}]}, {"name": "Suspicious AWS EC2 Activities", "id": "2e8948a5-5239-406b-b56b-6c50f1268af3", "version": 1, "date": "2018-02-09", "author": "Bhavin Patel, Splunk", "description": "Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it.", "narrative": "AWS CloudTrail is an AWS service that helps you enable governance, compliance, and risk auditing within your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Console, AWS command-line interface, and AWS SDKs and APIs to ensure that your EC2 instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your AWS EC2 instances and helps you respond and investigate those activities.", "references": ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"], "tags": {"name": "Suspicious AWS EC2 Activities", "analytic_story": "Suspicious AWS EC2 Activities", "category": ["Cloud Security"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1078.004", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Ke3chang", "LAPSUS$"]}, {"mitre_attack_id": "T1535", "mitre_attack_technique": "Unused/Unsupported Cloud Regions", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": [], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"], "investigation_names": ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"], "baseline_names": ["ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Previously Seen AWS Regions"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Abnormally High AWS Instances Launched by User", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}]}}, {"name": "Abnormally High AWS Instances Launched by User - MLTK", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}]}}, {"name": "Abnormally High AWS Instances Terminated by User", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}]}}, {"name": "Abnormally High AWS Instances Terminated by User - MLTK", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}]}}, {"name": "EC2 Instance Started In Previously Unseen Region", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}, {"name": "EC2 Instance Started With Previously Unseen User", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}]}}]}, {"name": "Unusual AWS EC2 Modifications", "id": "73de57ef-0dfc-411f-b1e7-fa24428aeae0", "version": 1, "date": "2018-04-09", "author": "David Dorsey, Splunk", "description": "Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation.", "narrative": "A common attack technique is to infiltrate a cloud instance and make modifications. The adversary can then secure access to your infrastructure or hide their activities. So it's important to stay alert to changes that may indicate that your environment has been compromised. \\\n Searches within this Analytic Story can help you detect the presence of a threat by monitoring for EC2 instances that have been created or changed--either by users that have never previously performed these activities or by known users who modify or create instances in a way that have not been done before. This story also provides investigative searches that help you go deeper once you detect suspicious behavior.", "references": ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"], "tags": {"name": "Unusual AWS EC2 Modifications", "analytic_story": "Unusual AWS EC2 Modifications", "category": ["Cloud Security"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1078.004", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Ke3chang", "LAPSUS$"]}], "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": [], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule"], "investigation_names": ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task"], "baseline_names": ["ESCU - Previously Seen EC2 Modifications By User"], "author_company": "Splunk", "author_name": "David Dorsey", "detections": [{"name": "EC2 Instance Modified With Previously Unseen User", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}]}}]}, {"name": "Web Fraud Detection", "id": "18bb45b9-7684-45c6-9e97-1fdd0d98c0a7", "version": 1, "date": "2018-10-08", "author": "Jim Apger, Splunk", "description": "Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets.", "narrative": "The Federal Bureau of Investigations (FBI) defines Internet fraud as the use of Internet services or software with Internet access to defraud victims or to otherwise take advantage of them. According to the Bureau, Internet crime schemes are used to steal millions of dollars each year from victims and continue to plague the Internet through various methods. The agency includes phishing scams, data breaches, Denial of Service (DOS) attacks, email account compromise, malware, spoofing, and ransomware in this category.\\\nThese crimes are not the fraud itself, but rather the attack techniques commonly employed by fraudsters in their pursuit of data that enables them to commit malicious actssuch as obtaining and using stolen credit cards. They represent a serious problem that is steadily increasing and not likely to go away anytime soon.\\\nWhen developing a strategy for preventing fraud in your environment, its important to  look across all of your web services for evidence that attackers are abusing enterprise resources to enumerate systems, harvest data for secondary fraudulent activity, or abuse terms of service.This Analytic Story looks for evidence of common Internet attack techniques that could be indicative of web fraud in your environmentincluding account harvesting, anomalous user clickspeed, and password sharing across accounts, to name just a few.\\\nThe account-harvesting search focuses on web pages used for user-account registration. It detects the creation of a large number of user accounts using the same email domain name, a type of activity frequently seen in advance of a fraud campaign.\\\nThe anomalous clickspeed search looks for users who are moving through your website at a faster-than-normal speed or with a perfect click cadence (high periodicity or low standard deviation), which could indicate that the user is a script, not an actual human.\\\nAnother search detects incidents wherein a single password is used across multiple accounts, which may indicate that a fraudster has infiltrated your environment and embedded a common password within a script.", "references": ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718"], "tags": {"name": "Web Fraud Detection", "analytic_story": "Web Fraud Detection", "category": ["Abuse"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Fraud Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1136", "mitre_attack_technique": "Create Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["Indrik Spider", "Sandworm Team"]}, {"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}], "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": [], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Password Sharing Across Accounts - Rule"], "investigation_names": ["ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Web Session Information via session id - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Jim Apger", "detections": [{"name": "Web Fraud - Account Harvesting", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create Account"}]}}, {"name": "Web Fraud - Anomalous User Clickspeed", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "Web Fraud - Password Sharing Across Accounts", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}]}, {"name": "Detect Zerologon Attack", "id": "5d14a962-569e-4578-939f-f386feb63ce4", "version": 1, "date": "2020-09-18", "author": "Rod Soto, Jose Hernandez, Stan Miskowicz, David Dorsey, Shannon Davis Splunk", "description": "Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack is attackers can now provide themselves high privileges and take over Domain Controller. The included searches in this Analytic Story are designed to identify attempts to reset Domain Controller Computer Account via exploit code remotely or via the use of tool Mimikatz as payload carrier.", "narrative": "This attack is a privilege escalation technique, where attacker targets a Netlogon secure channel connection to a domain controller, using Netlogon Remote Protocol (MS-NRPC). This vulnerability exposes vulnerable Windows Domain Controllers to be targeted via unaunthenticated RPC calls which eventually reset Domain Contoller computer account ($) providing the attacker the opportunity to exfil domain controller credential secrets and assign themselve high privileges that can lead to domain controller and potentially complete network takeover. The detection searches in this Analytic Story use Windows Event viewer events and Sysmon events to detect attack execution, these searches monitor access to the Local Security Authority Subsystem Service (LSASS) process which is an indicator of the use of Mimikatz tool which has bee updated to carry this attack payload.", "references": ["https://attack.mitre.org/wiki/Technique/T1003", "https://github.com/SecuraBV/CVE-2020-1472", "https://www.secura.com/blog/zero-logon", "https://nvd.nist.gov/vuln/detail/CVE-2020-1472"], "tags": {"name": "Detect Zerologon Attack", "analytic_story": "Detect Zerologon Attack", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.001", "mitre_attack_technique": "LSASS Memory", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT1", "APT28", "APT3", "APT32", "APT33", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Cleaver", "Earth Lusca", "FIN6", "FIN8", "Fox Kitten", "GALLIUM", "HAFNIUM", "Indrik Spider", "Ke3chang", "Kimsuky", "Leafminer", "Leviathan", "Magic Hound", "MuddyWater", "OilRig", "PLATINUM", "Sandworm Team", "Silence", "TEMP.Veles", "Threat Group-3390", "Whitefly"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1210", "mitre_attack_technique": "Exploitation of Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT28", "Dragonfly", "Earth Lusca", "FIN7", "Fox Kitten", "MuddyWater", "Threat Group-3390", "Tonto Team", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}], "mitre_attack_tactics": ["Credential Access", "Initial Access", "Lateral Movement"], "datamodels": [], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Windows Possible Credential Dumping - Rule", "ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Zerologon via Zeek - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task"], "baseline_names": [], "author_company": "Jose Hernandez, Stan Miskowicz, David Dorsey, Shannon Davis Splunk", "author_name": "Rod Soto", "detections": [{"name": "Detect Credential Dumping through LSASS access", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Detect Mimikatz Using Loaded Images", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Windows Possible Credential Dumping", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Detect Computer Changed with Anonymous Account", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation of Remote Services"}]}}, {"name": "Detect Zerologon via Zeek", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}]}, {"name": "Dev Sec Ops", "id": "0ca8c38e-631e-4b81-940c-f9c5450ce41e", "version": 1, "date": "2021-08-18", "author": "Patrick Bareiss, Splunk", "description": "This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor.", "narrative": "DevSecOps is a collaborative framework, which thinks about application and infrastructure security from the start. This means that security tools are part of the continuous integration and continuous deployment pipeline. In this analytics story, we focused on detections around the tools used in this framework such as GitHub as a version control system, GDrive for the documentation, CircleCI as the CI/CD pipeline, Kubernetes as the container execution engine and multiple security tools such as Semgrep and Kube-Hunter.", "references": ["https://www.redhat.com/en/topics/devops/what-is-devsecops"], "tags": {"name": "Dev Sec Ops", "analytic_story": "Dev Sec Ops", "category": ["Cloud Security"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1204.003", "mitre_attack_technique": "Malicious Image", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1204", "mitre_attack_technique": "User Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["LAPSUS$"]}, {"mitre_attack_id": "T1554", "mitre_attack_technique": "Compromise Client Software Binary", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1195.002", "mitre_attack_technique": "Compromise Software Supply Chain", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT29", "APT41", "Cobalt Group", "Dragonfly", "GOLD SOUTHFIELD", "Sandworm Team", "Threat Group-3390"]}, {"mitre_attack_id": "T1195", "mitre_attack_technique": "Supply Chain Compromise", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1199", "mitre_attack_technique": "Trusted Relationship", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "GOLD SOUTHFIELD", "LAPSUS$", "POLONIUM", "Sandworm Team", "Threat Group-3390", "menuPass"]}, {"mitre_attack_id": "T1195.001", "mitre_attack_technique": "Compromise Software Dependencies and Development Tools", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1566.001", "mitre_attack_technique": "Spearphishing Attachment", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "IndigoZebra", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1566", "mitre_attack_technique": "Phishing", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["Axiom", "GOLD SOUTHFIELD"]}, {"mitre_attack_id": "T1048.003", "mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["APT32", "APT33", "FIN6", "FIN8", "Lazarus Group", "OilRig", "Thrip", "Wizard Spider"]}, {"mitre_attack_id": "T1048", "mitre_attack_technique": "Exfiltration Over Alternative Protocol", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1212", "mitre_attack_technique": "Exploitation for Credential Access", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1526", "mitre_attack_technique": "Cloud Service Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1567.002", "mitre_attack_technique": "Exfiltration to Cloud Storage", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["Chimera", "Confucius", "Earth Lusca", "FIN7", "HAFNIUM", "HEXANE", "Kimsuky", "Lazarus Group", "Leviathan", "POLONIUM", "Threat Group-3390", "Turla", "ZIRCONIUM"]}, {"mitre_attack_id": "T1567", "mitre_attack_technique": "Exfiltration Over Web Service", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["APT28"]}], "mitre_attack_tactics": ["Credential Access", "Discovery", "Execution", "Exfiltration", "Initial Access", "Persistence"], "datamodels": [], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - AWS ECR Container Scanning Findings High - Rule", "ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule", "ESCU - AWS ECR Container Scanning Findings Medium - Rule", "ESCU - AWS ECR Container Upload Outside Business Hours - Rule", "ESCU - AWS ECR Container Upload Unknown User - Rule", "ESCU - Circle CI Disable Security Job - Rule", "ESCU - Correlation by Repository and Risk - Rule", "ESCU - Correlation by User and Risk - Rule", "ESCU - GitHub Actions Disable Security Workflow - Rule", "ESCU - Github Commit Changes In Master - Rule", "ESCU - Github Commit In Develop - Rule", "ESCU - GitHub Dependabot Alert - Rule", "ESCU - GitHub Pull Request from Unknown User - Rule", "ESCU - GSuite Email Suspicious Attachment - Rule", "ESCU - Gsuite Email Suspicious Subject With Attachment - Rule", "ESCU - Gsuite Email With Known Abuse Web Service Link - Rule", "ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule", "ESCU - Gsuite Suspicious Shared File Name - Rule", "ESCU - Kubernetes Nginx Ingress LFI - Rule", "ESCU - Kubernetes Nginx Ingress RFI - Rule", "ESCU - Kubernetes Scanner Image Pulling - Rule", "ESCU - Circle CI Disable Security Step - Rule", "ESCU - Gsuite Drive Share In External Email - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Patrick Bareiss", "detections": [{"name": "AWS ECR Container Scanning Findings High", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Malicious Image"}, {"mitre_attack_technique": "User Execution"}]}}, {"name": "AWS ECR Container Scanning Findings Low Informational Unknown", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Malicious Image"}, {"mitre_attack_technique": "User Execution"}]}}, {"name": "AWS ECR Container Scanning Findings Medium", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Malicious Image"}, {"mitre_attack_technique": "User Execution"}]}}, {"name": "AWS ECR Container Upload Outside Business Hours", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Malicious Image"}, {"mitre_attack_technique": "User Execution"}]}}, {"name": "AWS ECR Container Upload Unknown User", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Malicious Image"}, {"mitre_attack_technique": "User Execution"}]}}, {"name": "Circle CI Disable Security Job", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Client Software Binary"}]}}, {"name": "Correlation by Repository and Risk", "source": "cloud", "type": "Correlation", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Malicious Image"}, {"mitre_attack_technique": "User Execution"}]}}, {"name": "Correlation by User and Risk", "source": "cloud", "type": "Correlation", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Malicious Image"}, {"mitre_attack_technique": "User Execution"}]}}, {"name": "GitHub Actions Disable Security Workflow", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Software Supply Chain"}, {"mitre_attack_technique": "Supply Chain Compromise"}]}}, {"name": "Github Commit Changes In Master", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Trusted Relationship"}]}}, {"name": "Github Commit In Develop", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Trusted Relationship"}]}}, {"name": "GitHub Dependabot Alert", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Software Dependencies and Development Tools"}, {"mitre_attack_technique": "Supply Chain Compromise"}]}}, {"name": "GitHub Pull Request from Unknown User", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Software Dependencies and Development Tools"}, {"mitre_attack_technique": "Supply Chain Compromise"}]}}, {"name": "GSuite Email Suspicious Attachment", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}]}}, {"name": "Gsuite Email Suspicious Subject With Attachment", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}]}}, {"name": "Gsuite Email With Known Abuse Web Service Link", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}]}}, {"name": "Gsuite Outbound Email With Attachment To External Domain", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}, {"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}, {"name": "Gsuite Suspicious Shared File Name", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}]}}, {"name": "Kubernetes Nginx Ingress LFI", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation for Credential Access"}]}}, {"name": "Kubernetes Nginx Ingress RFI", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation for Credential Access"}]}}, {"name": "Kubernetes Scanner Image Pulling", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Service Discovery"}]}}, {"name": "Circle CI Disable Security Step", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Client Software Binary"}]}}, {"name": "Gsuite Drive Share In External Email", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration to Cloud Storage"}, {"mitre_attack_technique": "Exfiltration Over Web Service"}]}}]}, {"name": "DHS Report TA18-074A", "id": "0c016e5c-88be-4e2c-8c6c-c2b55b4fb4ef", "version": 2, "date": "2020-01-22", "author": "Rico Valdez, Splunk", "description": "Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more.", "narrative": "The frequency of nation-state cyber attacks has increased significantly over the last decade. Employing numerous tactics and techniques, these attacks continue to escalate in complexity. \\\nThere is a wide range of motivations for these state-sponsored hacks, including stealing valuable corporate, military, or diplomatic data&#1151;all of which could confer advantages in various arenas. They may also target critical infrastructure. \\\nOne joint Technical Alert (TA) issued by the Department of Homeland and the FBI in mid-March of 2018 attributed some cyber activity targeting utility infrastructure to operatives sponsored by the Russian government. The hackers executed spearfishing attacks, installed malware, employed watering-hole domains, and more. While they caused no physical damage, the attacks provoked fears that a nation-state could turn off water, redirect power, or compromise a nuclear power plant.\\\nSuspicious activities--spikes in SMB traffic, processes that launch netsh (to modify the network configuration), suspicious registry modifications, and many more--may all be events you may wish to investigate further. While the use of these technique may be an indication that a nation-state actor is attempting to compromise your environment, it is important to note that these techniques are often employed by other groups, as well.", "references": ["https://www.us-cert.gov/ncas/alerts/TA18-074A"], "tags": {"name": "DHS Report TA18-074A", "analytic_story": "DHS Report TA18-074A", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1136.001", "mitre_attack_technique": "Local Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT3", "APT39", "APT41", "Dragonfly", "Fox Kitten", "Kimsuky", "Leafminer", "Magic Hound", "TeamTNT"]}, {"mitre_attack_id": "T1136", "mitre_attack_technique": "Create Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["Indrik Spider", "Sandworm Team"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021.002", "mitre_attack_technique": "SMB/Windows Admin Shares", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT39", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "FIN8", "Fox Kitten", "Ke3chang", "Lazarus Group", "Moses Staff", "Orangeworm", "Sandworm Team", "Threat Group-1314", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1569", "mitre_attack_technique": "System Services", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1569.002", "mitre_attack_technique": "Service Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT32", "APT38", "APT39", "APT41", "Blue Mockingbird", "Chimera", "FIN6", "Ke3chang", "Silence", "Wizard Spider"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1562.004", "mitre_attack_technique": "Disable or Modify System Firewall", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "APT38", "Carbanak", "Dragonfly", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1547.001", "mitre_attack_technique": "Registry Run Keys / Startup Folder", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Dark Caracal", "Darkhotel", "Dragonfly", "FIN10", "FIN6", "FIN7", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Putter Panda", "RTM", "Rocke", "Sidewinder", "Silence", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1204", "mitre_attack_technique": "User Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["LAPSUS$"]}, {"mitre_attack_id": "T1204.002", "mitre_attack_technique": "Malicious File", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT-C-36", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "Ajax Security Team", "Andariel", "Aoqin Dragon", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "Dark Caracal", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Earth Lusca", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HEXANE", "Higaisa", "Inception", "IndigoZebra", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "PROMETHIUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Whitefly", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1112", "mitre_attack_technique": "Modify Registry", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "APT38", "APT41", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN8", "Gamaredon Group", "Gorgon Group", "Kimsuky", "Magic Hound", "Patchwork", "Silence", "TA505", "Threat Group-3390", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1071.002", "mitre_attack_technique": "File Transfer Protocols", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT41", "Kimsuky", "SilverTerrier"]}, {"mitre_attack_id": "T1071", "mitre_attack_technique": "Application Layer Protocol", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["Dragonfly", "Magic Hound", "Rocke", "TeamTNT"]}], "mitre_attack_tactics": ["Command And Control", "Defense Evasion", "Execution", "Lateral Movement", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint", "Network_Traffic"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Exploitation", "Installation"]}, "detection_names": ["ESCU - First time seen command line argument - Rule", "ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"], "baseline_names": ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"], "author_company": "Splunk", "author_name": "Rico Valdez", "detections": [{"name": "First time seen command line argument", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Windows Command Shell"}]}}, {"name": "Create local admin accounts using net exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Local Account"}, {"mitre_attack_technique": "Create Account"}]}}, {"name": "Detect New Local Admin account", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Local Account"}, {"mitre_attack_technique": "Create Account"}]}}, {"name": "Detect PsExec With accepteula Flag", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "SMB/Windows Admin Shares"}]}}, {"name": "Detect Renamed PSExec", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Services"}, {"mitre_attack_technique": "Service Execution"}]}}, {"name": "Malicious PowerShell Process - Execution Policy Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Processes launching netsh", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify System Firewall"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Registry Keys Used For Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Registry Run Keys / Startup Folder"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Sc exe Manipulating Windows Services", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Service"}, {"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Scheduled Task Deleted Or Created via CMD", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Single Letter Process On Endpoint", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "User Execution"}, {"mitre_attack_technique": "Malicious File"}]}}, {"name": "Suspicious Reg exe Process", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Detect Outbound SMB Traffic", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File Transfer Protocols"}, {"mitre_attack_technique": "Application Layer Protocol"}]}}, {"name": "SMB Traffic Spike", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "SMB/Windows Admin Shares"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "SMB Traffic Spike - MLTK", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "SMB/Windows Admin Shares"}, {"mitre_attack_technique": "Remote Services"}]}}]}, {"name": "Disabling Security Tools", "id": "fcc27099-46a0-46b0-a271-5c7dab56b6f1", "version": 2, "date": "2020-02-04", "author": "Rico Valdez, Splunk", "description": "Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others.", "narrative": "Attackers employ a variety of tactics in order to avoid detection and operate without barriers. This often involves modifying the configuration of security tools to get around them or explicitly disabling them to prevent them from running. This Analytic Story includes searches that look for activity consistent with attackers attempting to disable various security mechanisms. Such activity may involve monitoring for suspicious registry activity, as this is where much of the configuration for Windows and various other programs reside, or explicitly attempting to shut down security-related services. Other times, attackers attempt various tricks to prevent specific programs from running, such as adding the certificates with which the security tools are signed to a block list (which would prevent them from running).", "references": ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://web.archive.org/web/20220425194457/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"], "tags": {"name": "Disabling Security Tools", "analytic_story": "Disabling Security Tools", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1553.004", "mitre_attack_technique": "Install Root Certificate", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1553", "mitre_attack_technique": "Subvert Trust Controls", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Axiom"]}, {"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1562.004", "mitre_attack_technique": "Disable or Modify System Firewall", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "APT38", "Carbanak", "Dragonfly", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1112", "mitre_attack_technique": "Modify Registry", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "APT38", "APT41", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN8", "Gamaredon Group", "Gorgon Group", "Kimsuky", "Magic Hound", "Patchwork", "Silence", "TA505", "Threat Group-3390", "Turla", "Wizard Spider"]}], "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Installation"]}, "detection_names": ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"], "baseline_names": ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"], "author_company": "Splunk", "author_name": "Rico Valdez", "detections": [{"name": "Attempt To Add Certificate To Untrusted Store", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Install Root Certificate"}, {"mitre_attack_technique": "Subvert Trust Controls"}]}}, {"name": "Attempt To Stop Security Service", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Processes launching netsh", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify System Firewall"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Sc exe Manipulating Windows Services", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Service"}, {"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Suspicious Reg exe Process", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Unload Sysmon Filter Driver", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}]}, {"name": "DNS Amplification Attacks", "id": "a563972b-d2e2-4978-b6ca-6e83e24af4d3", "version": 1, "date": "2016-09-13", "author": "Bhavin Patel, Splunk", "description": "DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it responds to `ANY` queries. This Analytic Story can help you detect attackers who may be abusing your company's DNS infrastructure to launch amplification attacks, causing Denial of Service to other victims.", "narrative": "The Domain Name System (DNS) is the protocol used to map domain names to IP addresses. It has been proven to work very well for its intended function. However if DNS is misconfigured, servers can be abused by attackers to levy amplification or redirection attacks against victims. Because DNS responses to `ANY` queries are so much larger than the queries themselves--and can be made with a UDP packet, which does not require a handshake--attackers can spoof the source address of the packet and cause much more data to be sent to the victim than if they sent the traffic themselves. The `ANY` requests are will be larger than normal DNS server requests, due to the fact that the server provides significant details, such as MX records and associated IP addresses. A large volume of this traffic can result in a DOS on the victim's machine. This misconfiguration leads to two possible victims, the first being the DNS servers participating in an attack and the other being the hosts that are the targets of the DOS attack.\\\nThe search in this story can help you to detect if attackers are abusing your company's DNS infrastructure to launch DNS amplification attacks causing Denial of Service to other victims.", "references": ["https://www.us-cert.gov/ncas/alerts/TA13-088A", "https://www.imperva.com/learn/application-security/dns-amplification/"], "tags": {"name": "DNS Amplification Attacks", "analytic_story": "DNS Amplification Attacks", "category": ["Abuse"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1498", "mitre_attack_technique": "Network Denial of Service", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT28"]}, {"mitre_attack_id": "T1498.002", "mitre_attack_technique": "Reflection Amplification", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Impact"], "datamodels": ["Network_Resolution"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Large Volume of DNS ANY Queries - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Large Volume of DNS ANY Queries", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Network Denial of Service"}, {"mitre_attack_technique": "Reflection Amplification"}]}}]}, {"name": "DNS Hijacking", "id": "8169f17b-ef68-4b59-aa28-586907301221", "version": 1, "date": "2020-02-04", "author": "Bhavin Patel, Splunk", "description": "Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records.", "narrative": "Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.\\\nThe gravity and extent of the importance of securing DNS from attacks is undeniable. The fallout of compromised DNS can be disastrous. Not only can hackers bring down an entire business, they can intercept confidential information, emails, and login credentials, as well. \\\nOn January 22, 2019, the US Department of Homeland Security 2019's Cybersecurity and Infrastructure Security Agency (CISA) raised awareness of some high-profile DNS hijacking attacks against infrastructure, both in the United States and abroad. It issued Emergency Directive 19-01 (see https://cyber.dhs.gov/ed/19-01/), which summarized the activity and required government agencies to take the following four actions, all within 10 days: \\\n1. For all .gov or other agency-managed domains, audit public DNS records on all authoritative and secondary DNS servers, verify that they resolve to the intended location or report them to CISA.\\\n1. Update the passwords for all accounts on systems that can make changes to each agency 2019's DNS records.\\\n1. Implement multi-factor authentication (MFA) for all accounts on systems that can make changes to each agency's 2019 DNS records or, if impossible, provide CISA with the names of systems, the reasons why MFA cannot be enabled within the required timeline, and an ETA for when it can be enabled.\\\n1. CISA will begin regular delivery of newly added certificates to Certificate Transparency (CT) logs for agency domains via the Cyber Hygiene service. Upon receipt, agencies must immediately begin monitoring CT log data for certificates issued that they did not request. If an agency confirms that a certificate was unauthorized, it must report the certificate to the issuing certificate authority and to CISA. Of course, it makes sense to put equivalent actions in place within your environment, as well. \\\nIn DNS hijacking, the attacker assumes control over an account or makes use of a DNS service exploit to make changes to DNS records. Once they gain access, attackers can substitute their own MX records, name-server records, and addresses, redirecting emails and traffic through their infrastructure, where they can read, copy, or modify information seen. They can also generate valid encryption certificates to help them avoid browser-certificate checks. In one notable attack on the Internet service provider, GoDaddy, the hackers altered Sender Policy Framework (SPF) records a relatively minor change that did not inflict excessive damage but allowed for more effective spam campaigns.\\\nThe searches in this Analytic Story help you detect and investigate activities that may indicate that DNS hijacking has taken place within your environment.", "references": ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"], "tags": {"name": "DNS Hijacking", "analytic_story": "DNS Hijacking", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1048.003", "mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["APT32", "APT33", "FIN6", "FIN8", "Lazarus Group", "OilRig", "Thrip", "Wizard Spider"]}, {"mitre_attack_id": "T1071.004", "mitre_attack_technique": "DNS", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT18", "APT39", "APT41", "Chimera", "Cobalt Group", "FIN7", "Ke3chang", "LazyScripter", "OilRig", "Tropic Trooper"]}, {"mitre_attack_id": "T1568.002", "mitre_attack_technique": "Domain Generation Algorithms", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT41", "TA551"]}, {"mitre_attack_id": "T1189", "mitre_attack_technique": "Drive-by Compromise", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT19", "APT28", "APT32", "APT37", "APT38", "Andariel", "Axiom", "BRONZE BUTLER", "Dark Caracal", "Darkhotel", "Dragonfly", "Earth Lusca", "Elderwood", "Lazarus Group", "Leafminer", "Leviathan", "Machete", "Magic Hound", "PLATINUM", "PROMETHIUM", "Patchwork", "RTM", "Threat Group-3390", "Transparent Tribe", "Turla", "Windigo", "Windshift"]}], "mitre_attack_tactics": ["Command And Control", "Exfiltration", "Initial Access"], "datamodels": ["Network_Resolution"], "kill_chain_phases": ["Actions on Objectives", "Command & Control"]}, "detection_names": ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect DGA domains using pretrained model in DSDL - Rule", "ESCU - Detect suspicious DNS TXT records using pretrained model in DSDL - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule"], "investigation_names": ["ESCU - Get DNS Server History for a host - Response Task"], "baseline_names": ["ESCU - Discover DNS records"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Clients Connecting to Multiple DNS Servers", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}]}}, {"name": "DNS Query Requests Resolved by Unauthorized DNS Servers", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DNS"}]}}, {"name": "DNS record changed", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DNS"}]}}, {"name": "Detect DGA domains using pretrained model in DSDL", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Generation Algorithms"}]}}, {"name": "Detect suspicious DNS TXT records using pretrained model in DSDL", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Generation Algorithms"}]}}, {"name": "Detect hosts connecting to dynamic domain providers", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Drive-by Compromise"}]}}]}, {"name": "sAMAccountName Spoofing and Domain Controller Impersonation", "id": "0244fdee-61be-11ec-900e-acde48001122", "version": 1, "date": "2021-12-20", "author": "Mauricio Velazco, Splunk", "description": "Monitor for activities and techniques associated with the exploitation of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) vulnerabilities.", "narrative": "On November 9, 2021, Microsoft released patches to address two vulnerabilities that affect Windows Active Directory networks, sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287). On December 10, 2021, security researchers Charlie Clark and Andrew Schwartz released a blog post where they shared how to weaponise these vulnerabilities in a target network an the initial detection opportunities. When successfully exploited, CVE-2021-42278 and CVE-2021-42287 allow an adversary, who has stolen the credentials of a low priviled domain user, to obtain a Kerberos Service ticket for a Domain Controller computer account. The only requirement is to have network connectivity to a domain controller. This attack vector effectivelly allows attackers to escalate their privileges in an Active Directory from a regular domain user account and take control of a domain controller. While patches have been released to address these vulnerabilities, deploying detection controls for this attack may help help defenders identify attackers attempting exploitation.", "references": ["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287", "https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html"], "tags": {"name": "sAMAccountName Spoofing and Domain Controller Impersonation", "analytic_story": "sAMAccountName Spoofing and Domain Controller Impersonation", "category": ["Privilege Escalation"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1078.002", "mitre_attack_technique": "Domain Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT29", "APT3", "Chimera", "Indrik Spider", "Naikon", "Sandworm Team", "TA505", "Threat Group-1314", "Wizard Spider"]}], "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Suspicious Computer Account Name Change - Rule", "ESCU - Suspicious Kerberos Service Ticket Request - Rule", "ESCU - Suspicious Ticket Granting Ticket Request - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Mauricio Velazco", "detections": [{"name": "Suspicious Computer Account Name Change", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Domain Accounts"}]}}, {"name": "Suspicious Kerberos Service Ticket Request", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Domain Accounts"}]}}, {"name": "Suspicious Ticket Granting Ticket Request", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Domain Accounts"}]}}]}, {"name": "Domain Trust Discovery", "id": "e6f30f14-8daf-11eb-a017-acde48001122", "version": 1, "date": "2021-03-25", "author": "Michael Haag, Splunk", "description": "Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments.", "narrative": "Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain. Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct SID-History Injection, Pass the Ticket, and Kerberoasting. Domain trusts can be enumerated using the DSEnumerateDomainTrusts() Win32 API call, .NET methods, and LDAP. The Windows utility Nltest is known to be used by adversaries to enumerate domain trusts.", "references": ["https://attack.mitre.org/techniques/T1482/"], "tags": {"name": "Domain Trust Discovery", "analytic_story": "Domain Trust Discovery", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1482", "mitre_attack_technique": "Domain Trust Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "Chimera", "Earth Lusca", "FIN8"]}, {"mitre_attack_id": "T1018", "mitre_attack_technique": "Remote System Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "APT3", "APT32", "APT39", "BRONZE BUTLER", "Chimera", "Deep Panda", "Dragonfly", "Earth Lusca", "FIN5", "FIN6", "FIN8", "Fox Kitten", "GALLIUM", "HEXANE", "Indrik Spider", "Ke3chang", "Leafminer", "Naikon", "Rocke", "Sandworm Team", "Silence", "Threat Group-3390", "Turla", "Wizard Spider", "menuPass"]}], "mitre_attack_tactics": ["Discovery"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - DSQuery Domain Discovery - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Windows AdFind Exe - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "DSQuery Domain Discovery", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Trust Discovery"}]}}, {"name": "NLTest Domain Trust Discovery", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Trust Discovery"}]}}, {"name": "Windows AdFind Exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}]}, {"name": "Double Zero Destructor", "id": "f56e8c00-3224-4955-9a6e-924ec7da1df7", "version": 1, "date": "2022-03-25", "author": "Teoderick Contreras, Rod Soto, Splunk", "description": "Double Zero Destructor is a destructive payload that enumerates Domain Controllers and executes killswitch if detected. Overwrites files with Zero blocks or using MS Windows API calls such as NtFileOpen, NtFSControlFile. This payload also deletes registry hives HKCU,HKLM, HKU, HKLM BCD.", "narrative": "Double zero destructor enumerates domain controllers, delete registry hives and overwrites files using zero blocks and API calls.", "references": ["https://cert.gov.ua/article/38088", "https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html"], "tags": {"name": "Double Zero Destructor", "analytic_story": "Double Zero Destructor", "category": ["Data Destruction", "Malware", "Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1112", "mitre_attack_technique": "Modify Registry", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "APT38", "APT41", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN8", "Gamaredon Group", "Gorgon Group", "Kimsuky", "Magic Hound", "Patchwork", "Silence", "TA505", "Threat Group-3390", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}], "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Windows Deleted Registry By A Non Critical Process File Path - Rule", "ESCU - Windows Terminating Lsass Process - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Rod Soto, Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Executables Or Script Creation In Suspicious Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "Suspicious Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Windows Deleted Registry By A Non Critical Process File Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Terminating Lsass Process", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}]}, {"name": "Dynamic DNS", "id": "8169f17b-ef68-4b59-aae8-586907301221", "version": 2, "date": "2018-09-06", "author": "Bhavin Patel, Splunk", "description": "Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists.", "narrative": "Dynamic DNS services (DDNS) are legitimate low-cost or free services that allow users to rapidly update domain resolutions to IP infrastructure. While their usage can be benign, malicious actors can abuse DDNS to host harmful payloads or interactive-command-and-control infrastructure. These attackers will manually update or automate domain resolution changes by routing dynamic domains to IP addresses that circumvent firewall blocks and deny lists and frustrate a network defender's analytic and investigative processes. These searches will look for DNS queries made from within your infrastructure to suspicious dynamic domains and then investigate more deeply, when appropriate. While this list of top-level dynamic domains is not exhaustive, it can be dynamically updated as new suspicious dynamic domains are identified.", "references": ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"], "tags": {"name": "Dynamic DNS", "analytic_story": "Dynamic DNS", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1071.001", "mitre_attack_technique": "Web Protocols", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Chimera", "Cobalt Group", "Confucius", "Dark Caracal", "FIN4", "FIN8", "Gamaredon Group", "HAFNIUM", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Mustang Panda", "OilRig", "Orangeworm", "Rancor", "Rocke", "Sandworm Team", "Sidewinder", "SilverTerrier", "Stealth Falcon", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "WIRTE", "Windshift", "Wizard Spider"]}, {"mitre_attack_id": "T1048", "mitre_attack_technique": "Exfiltration Over Alternative Protocol", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1568.002", "mitre_attack_technique": "Domain Generation Algorithms", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT41", "TA551"]}, {"mitre_attack_id": "T1189", "mitre_attack_technique": "Drive-by Compromise", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT19", "APT28", "APT32", "APT37", "APT38", "Andariel", "Axiom", "BRONZE BUTLER", "Dark Caracal", "Darkhotel", "Dragonfly", "Earth Lusca", "Elderwood", "Lazarus Group", "Leafminer", "Leviathan", "Machete", "Magic Hound", "PLATINUM", "PROMETHIUM", "Patchwork", "RTM", "Threat Group-3390", "Transparent Tribe", "Turla", "Windigo", "Windshift"]}], "mitre_attack_tactics": ["Command And Control", "Exfiltration", "Initial Access"], "datamodels": ["Endpoint", "Network_Resolution", "Web"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Exploitation"]}, "detection_names": ["ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Detect DGA domains using pretrained model in DSDL - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule"], "investigation_names": ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Detect web traffic to dynamic domain providers", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Web Protocols"}]}}, {"name": "DNS Exfiltration Using Nslookup App", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}, {"name": "Excessive Usage of NSLOOKUP App", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}, {"name": "Detect DGA domains using pretrained model in DSDL", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Generation Algorithms"}]}}, {"name": "Detect hosts connecting to dynamic domain providers", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Drive-by Compromise"}]}}]}, {"name": "Emotet Malware  DHS Report TA18-201A ", "id": "bb9f5ed2-916e-4364-bb6d-91c310efcf52", "version": 1, "date": "2020-01-27", "author": "Bhavin Patel, Splunk", "description": "Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment.", "narrative": "The trojan downloader known as Emotet first surfaced in 2014, when it was discovered targeting the banking industry to steal credentials. However, according to a joint technical alert (TA) issued by three government agencies (https://www.us-cert.gov/ncas/alerts/TA18-201A), Emotet has evolved far beyond those beginnings to become what a ThreatPost article called a threat-delivery service(see https://threatpost.com/emotet-malware-evolves-beyond-banking-to-threat-delivery-service/134342/).  For example, in early 2018, Emotet was found to be using its loader function to spread the Quakbot and Ransomware variants. \\\nAccording to the TA, the the malware continues to be among the most costly and destructive malware affecting the private and public sectors. Researchers have linked it to the threat group Mealybug, which has also been on the security communitys radar since 2014.\\\nThe searches in this Analytic Story will help you find executables that are rarely used in your environment, specific registry paths that malware often uses to ensure survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that Emotet or other malware has compromised your environment. ", "references": ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"], "tags": {"name": "Emotet Malware  DHS Report TA18-201A ", "analytic_story": "Emotet Malware  DHS Report TA18-201A ", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1547.001", "mitre_attack_technique": "Registry Run Keys / Startup Folder", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Dark Caracal", "Darkhotel", "Dragonfly", "FIN10", "FIN6", "FIN7", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Putter Panda", "RTM", "Rocke", "Sidewinder", "Silence", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1566.001", "mitre_attack_technique": "Spearphishing Attachment", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "IndigoZebra", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1566", "mitre_attack_technique": "Phishing", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["Axiom", "GOLD SOUTHFIELD"]}, {"mitre_attack_id": "T1072", "mitre_attack_technique": "Software Deployment Tools", "mitre_attack_tactics": ["Execution", "Lateral Movement"], "mitre_attack_groups": ["APT32", "Silence", "Threat Group-1314"]}, {"mitre_attack_id": "T1021.002", "mitre_attack_technique": "SMB/Windows Admin Shares", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT39", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "FIN8", "Fox Kitten", "Ke3chang", "Lazarus Group", "Moses Staff", "Orangeworm", "Sandworm Team", "Threat Group-1314", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Execution", "Initial Access", "Lateral Movement", "Persistence", "Privilege Escalation"], "datamodels": ["Email", "Endpoint", "Network_Traffic"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Delivery", "Exploitation", "Installation"]}, "detection_names": ["ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule"], "investigation_names": ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"], "baseline_names": ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Add Prohibited Processes to Enterprise Security"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Prohibited Software On Endpoint", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Detect Use of cmd exe to Launch Script Interpreters", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "Windows Command Shell"}]}}, {"name": "Registry Keys Used For Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Registry Run Keys / Startup Folder"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Email Attachments With Lots Of Spaces", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "Suspicious Email Attachment Extensions", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}]}}, {"name": "Detection of tools built by NirSoft", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Software Deployment Tools"}]}}, {"name": "SMB Traffic Spike", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "SMB/Windows Admin Shares"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "SMB Traffic Spike - MLTK", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "SMB/Windows Admin Shares"}, {"mitre_attack_technique": "Remote Services"}]}}]}, {"name": "F5 BIG-IP Vulnerability CVE-2022-1388", "id": "0367b177-f8d6-4c4b-a62d-86f52a590bff", "version": 1, "date": "2022-05-10", "author": "Michael Haag, Splunk", "description": "CVE-2022-1388 is a unauthenticated remote code execution vulnerablity against BIG-IP iControl REST API.", "narrative": "CVE-2022-1388 is a critical vulnerability (CVSS 9.8) in the management interface of F5 Networks'' BIG-IP solution that enables an unauthenticated attacker to gain remote code execution on the system through bypassing F5''s iControl REST authentication. The vulnerability was first discovered by F5''s internal product security team and disclosed publicly on May 4, 2022, per Randori. This vulnerability,CVE-2022-1388, may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only per F5 article K23605346. Is CVE-2022-1388 Exploitable? Yes. There are now multiple POC scripts available and reports of threat actors scanning and potentially exploiting the vulnerablity. Per Randori the specific interface needed to exploit this vulnerability is rarely publicly exposed, and the risk to most organizations of exploitation by an unauthenticated external actor is low.", "references": ["https://github.com/dk4trin/templates-nuclei/blob/main/CVE-2022-1388.yaml", "https://www.randori.com/blog/vulnerability-analysis-cve-2022-1388/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1388", "https://twitter.com/da_667/status/1523770267327250438?s=20&t=-JnB_aNWuJFsmcOmxGUWLQ", "https://github.com/horizon3ai/CVE-2022-1388/blob/main/CVE-2022-1388.py"], "tags": {"name": "F5 BIG-IP Vulnerability CVE-2022-1388", "analytic_story": "F5 BIG-IP Vulnerability CVE-2022-1388", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}], "mitre_attack_tactics": ["Initial Access"], "datamodels": ["Web"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - F5 BIG-IP iControl REST Vulnerability CVE-2022-1388 - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "F5 BIG-IP iControl REST Vulnerability CVE-2022-1388", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}]}, {"name": "F5 TMUI RCE CVE-2020-5902", "id": "7678c968-d46e-11ea-87d0-0242ac130003", "version": 1, "date": "2020-08-02", "author": "Shannon Davis, Splunk", "description": "Uncover activity consistent with CVE-2020-5902. Discovered by Positive Technologies researchers, this vulnerability affects F5 BIG-IP, BIG-IQ. and Traffix SDC devices (vulnerable versions in F5 support link below). This vulnerability allows unauthenticated users, along with authenticated users, who have access to the configuration utility to execute system commands, create/delete files, disable services, and/or execute Java code.  This vulnerability can result in full system compromise.", "narrative": "A client is able to perform a remote code execution on an exposed and vulnerable system. The detection search in this Analytic Story uses syslog to detect the malicious behavior. Syslog is going to be the best detection method, as any systems using SSL to protect their management console will make detection via wire data difficult.  The searches included used Splunk Connect For Syslog (https://splunkbase.splunk.com/app/4740/), and used a custom destination port to help define the data as F5 data (covered in https://splunk-connect-for-syslog.readthedocs.io/en/master/sources/F5/)", "references": ["https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/", "https://support.f5.com/csp/article/K52145254", "https://blog.cloudflare.com/cve-2020-5902-helping-to-protect-against-the-f5-tmui-rce-vulnerability/"], "tags": {"name": "F5 TMUI RCE CVE-2020-5902", "analytic_story": "F5 TMUI RCE CVE-2020-5902", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}], "mitre_attack_tactics": ["Initial Access"], "datamodels": [], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Shannon Davis", "detections": [{"name": "Detect F5 TMUI RCE CVE-2020-5902", "source": "web", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}]}, {"name": "FIN7", "id": "df2b00d3-06ba-49f1-b253-b19cef19b569", "version": 1, "date": "2021-09-14", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the FIN7 JS Implant and JSSLoader, including looking for Image Loading of ldap and wmi modules, associated with its payload, data collection and script execution.", "narrative": "FIN7 is a Russian criminal advanced persistent threat group that has primarily targeted the U.S. retail, restaurant, and hospitality sectors since mid-2015. A portion of FIN7 is run out of the front company Combi Security. It has been called one of the most successful criminal hacking groups in the world. this passed few day FIN7 tools and implant are seen in the wild where its code is updated. the FIN& is known to use the spear phishing attack as a entry to targetted network or host that will drop its staging payload like the JS and JSSloader. Now this artifacts and implants seen downloading other malware like cobaltstrike and event ransomware to encrypt host.", "references": ["https://en.wikipedia.org/wiki/FIN7", "https://threatpost.com/fin7-windows-11-release/169206/", "https://www.proofpoint.com/us/blog/threat-insight/jssloader-recoded-and-reloaded"], "tags": {"name": "FIN7", "analytic_story": "FIN7", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1033", "mitre_attack_technique": "System Owner/User Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT37", "APT38", "APT39", "APT41", "Chimera", "Dragonfly", "Earth Lusca", "FIN10", "GALLIUM", "Gamaredon Group", "HEXANE", "Ke3chang", "Lazarus Group", "Magic Hound", "MuddyWater", "OilRig", "Patchwork", "Sandworm Team", "Sidewinder", "Stealth Falcon", "Threat Group-3390", "Tropic Trooper", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1059.007", "mitre_attack_technique": "JavaScript", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT32", "Cobalt Group", "Earth Lusca", "Ember Bear", "Evilnum", "FIN6", "FIN7", "Higaisa", "Indrik Spider", "Kimsuky", "LazyScripter", "Leafminer", "Molerats", "MuddyWater", "Sidewinder", "Silence", "TA505", "Turla"]}, {"mitre_attack_id": "T1555", "mitre_attack_technique": "Credentials from Password Stores", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "APT33", "APT39", "Evilnum", "FIN6", "HEXANE", "Leafminer", "MuddyWater", "OilRig", "Stealth Falcon"]}, {"mitre_attack_id": "T1555.003", "mitre_attack_technique": "Credentials from Web Browsers", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "APT3", "APT33", "APT37", "Ajax Security Team", "FIN6", "HEXANE", "Inception", "Kimsuky", "LAPSUS$", "Leafminer", "Molerats", "MuddyWater", "OilRig", "Patchwork", "Sandworm Team", "Stealth Falcon", "TA505", "ZIRCONIUM"]}, {"mitre_attack_id": "T1566", "mitre_attack_technique": "Phishing", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["Axiom", "GOLD SOUTHFIELD"]}, {"mitre_attack_id": "T1566.001", "mitre_attack_technique": "Spearphishing Attachment", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "IndigoZebra", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1059.005", "mitre_attack_technique": "Visual Basic", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT32", "APT33", "APT37", "APT38", "APT39", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Earth Lusca", "FIN4", "FIN7", "Gamaredon Group", "Gorgon Group", "HEXANE", "Higaisa", "Inception", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "Transparent Tribe", "Turla", "WIRTE", "Windshift"]}, {"mitre_attack_id": "T1055", "mitre_attack_technique": "Process Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT32", "APT37", "APT41", "Cobalt Group", "Kimsuky", "PLATINUM", "Silence", "Turla"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1134.004", "mitre_attack_technique": "Parent PID Spoofing", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1134", "mitre_attack_technique": "Access Token Manipulation", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["Blue Mockingbird", "FIN6"]}, {"mitre_attack_id": "T1220", "mitre_attack_technique": "XSL Script Processing", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Cobalt Group", "Higaisa", "Lazarus Group"]}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Discovery", "Execution", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Check Elevated CMD using whoami - Rule", "ESCU - Cmdline Tool Not Executed In CMD Shell - Rule", "ESCU - Jscript Execution Using Cscript App - Rule", "ESCU - MS Scripting Process Loading Ldap Module - Rule", "ESCU - MS Scripting Process Loading WMI Module - Rule", "ESCU - Non Chrome Process Accessing Chrome Default Dir - Rule", "ESCU - Non Firefox Process Access Firefox Profile Dir - Rule", "ESCU - Office Application Drop Executable - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Vbscript Execution Using Wscript App - Rule", "ESCU - Wscript Or Cscript Suspicious Child Process - Rule", "ESCU - XSL Script Execution With WMIC - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Check Elevated CMD using whoami", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Owner/User Discovery"}]}}, {"name": "Cmdline Tool Not Executed In CMD Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "JavaScript"}]}}, {"name": "Jscript Execution Using Cscript App", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "JavaScript"}]}}, {"name": "MS Scripting Process Loading Ldap Module", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "JavaScript"}]}}, {"name": "MS Scripting Process Loading WMI Module", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "JavaScript"}]}}, {"name": "Non Chrome Process Accessing Chrome Default Dir", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Credentials from Password Stores"}, {"mitre_attack_technique": "Credentials from Web Browsers"}]}}, {"name": "Non Firefox Process Access Firefox Profile Dir", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Credentials from Password Stores"}, {"mitre_attack_technique": "Credentials from Web Browsers"}]}}, {"name": "Office Application Drop Executable", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Spawning Wmic", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Vbscript Execution Using Wscript App", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Visual Basic"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Wscript Or Cscript Suspicious Child Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}, {"mitre_attack_technique": "Create or Modify System Process"}, {"mitre_attack_technique": "Parent PID Spoofing"}, {"mitre_attack_technique": "Access Token Manipulation"}]}}, {"name": "XSL Script Execution With WMIC", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "XSL Script Processing"}]}}]}, {"name": "Fortinet FortiNAC CVE-2022-39952", "id": "2833a527-3b7f-41af-a950-39f7bbaff819", "version": 1, "date": "2023-02-21", "author": "Michael Haag, Splunk", "description": "On Thursday, 16 February 2022, Fortinet released a PSIRT that details CVE-2022-39952, a critical vulnerability affecting its FortiNAC product (Horizon3.ai).", "narrative": "This vulnerability, discovered by Gwendal Guegniaud of Fortinet, allows an unauthenticated attacker to write arbitrary files on the system and as a result obtain remote code execution in the context of the root user (Horizon3.ai). Impacting FortiNAC, is tracked as CVE-2022-39952 and has a CVSS v3 score of 9.8 (critical). FortiNAC is a network access control solution that helps organizations gain real time network visibility, enforce security policies, and detect and mitigate threats. An external control of file name or path vulnerability CWE-73 in FortiNAC webserver may allow an unauthenticated attacker to perform arbitrary write on the system, reads the security advisory.", "references": ["https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/", "https://viz.greynoise.io/tag/fortinac-rce-attempt?days=30", "https://www.bleepingcomputer.com/news/security/fortinet-fixes-critical-rce-flaws-in-fortinac-and-fortiweb/"], "tags": {"name": "Fortinet FortiNAC CVE-2022-39952", "analytic_story": "Fortinet FortiNAC CVE-2022-39952", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}], "mitre_attack_tactics": ["Initial Access"], "datamodels": ["Web"], "kill_chain_phases": ["Exploitation", "Installation"]}, "detection_names": ["ESCU - Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952 - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952", "source": "web", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}]}, {"name": "GCP Account Takeover", "id": "8601caff-414f-4c6d-9a04-75b66778869d", "version": 1, "date": "2022-10-12", "author": "Mauricio Velazco, Bhavin Patel, Splunk", "description": "Monitor for activities and techniques associated with Account Takover attacks against Google Cloud Platform tenants.", "narrative": "Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization. This analytic storic groups detections that can help security operations teams identify the potential compromise of Azure Active Directory accounts.", "references": ["https://cloud.google.com/gcp", "https://cloud.google.com/architecture/identity/overview-google-authentication", "https://attack.mitre.org/techniques/T1586/", "https://www.imperva.com/learn/application-security/account-takeover-ato/", "https://www.barracuda.com/glossary/account-takeover"], "tags": {"name": "GCP Account Takeover", "analytic_story": "GCP Account Takeover", "category": ["Account Compromise"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1586", "mitre_attack_technique": "Compromise Accounts", "mitre_attack_tactics": ["Resource Development"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1586.003", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Resource Development"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1078.004", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Ke3chang", "LAPSUS$"]}, {"mitre_attack_id": "T1621", "mitre_attack_technique": "Multi-Factor Authentication Request Generation", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "LAPSUS$"]}, {"mitre_attack_id": "T1556", "mitre_attack_technique": "Modify Authentication Process", "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1110", "mitre_attack_technique": "Brute Force", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT38", "APT39", "DarkVishnya", "Dragonfly", "FIN5", "Fox Kitten", "HEXANE", "Lazarus Group", "OilRig", "Turla"]}, {"mitre_attack_id": "T1110.003", "mitre_attack_technique": "Password Spraying", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Chimera", "HEXANE", "Lazarus Group", "Leafminer", "Sandworm Team", "Silent Librarian"]}, {"mitre_attack_id": "T1110.004", "mitre_attack_technique": "Credential Stuffing", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Chimera"]}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation", "Resource Development"], "datamodels": [], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation"]}, "detection_names": ["ESCU - GCP Authentication Failed During MFA Challenge - Rule", "ESCU - GCP Multi-Factor Authentication Disabled - Rule", "ESCU - GCP Multiple Failed MFA Requests For User - Rule", "ESCU - GCP Multiple Users Failing To Authenticate From Ip - Rule", "ESCU - GCP Successful Single-Factor Authentication - Rule", "ESCU - GCP Unusual Number of Failed Authentications From Ip - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Bhavin Patel, Splunk", "author_name": "Mauricio Velazco", "detections": [{"name": "GCP Authentication Failed During MFA Challenge", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Multi-Factor Authentication Request Generation"}]}}, {"name": "GCP Multi-Factor Authentication Disabled", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Modify Authentication Process"}]}}, {"name": "GCP Multiple Failed MFA Requests For User", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Multi-Factor Authentication Request Generation"}, {"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}]}}, {"name": "GCP Multiple Users Failing To Authenticate From Ip", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Brute Force"}, {"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Credential Stuffing"}]}}, {"name": "GCP Successful Single-Factor Authentication", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}]}}, {"name": "GCP Unusual Number of Failed Authentications From Ip", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Brute Force"}, {"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Credential Stuffing"}]}}]}, {"name": "GCP Cross Account Activity", "id": "0432039c-ef41-4b03-b157-450c25dad1e6", "version": 1, "date": "2020-09-01", "author": "Rod Soto, Splunk", "description": "Track when a user assumes an IAM role in another GCP account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity.", "narrative": "Google Cloud Platform (GCP) admins manage access to GCP resources and services across the enterprise using GCP Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage GCP users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as Compute instances, the GCP Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are potentially assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\\\nIn between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\\\nThis Analytic Story includes searches that will help you monitor your GCP Audit logs logs for evidence of suspicious cross-account activity.  For example, while accessing multiple GCP accounts and roles may be perfectly valid behavior, it may be suspicious when an account requests privileges of an account it has not accessed in the past. After identifying suspicious activities, you can use the provided investigative searches to help you probe more deeply.", "references": ["https://cloud.google.com/iam/docs/understanding-service-accounts"], "tags": {"name": "GCP Cross Account Activity", "analytic_story": "GCP Cross Account Activity", "category": ["Cloud Security"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}], "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": [], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - gcp detect oauth token abuse - Rule", "ESCU - GCP Detect gcploit framework - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Rod Soto", "detections": [{"name": "GCP Detect accounts with high risk roles by project", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "GCP Detect high risk permissions by resource and account", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "gcp detect oauth token abuse", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "GCP Detect gcploit framework", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}]}, {"name": "HAFNIUM Group", "id": "beae2ab0-7c3f-11eb-8b63-acde48001122", "version": 1, "date": "2021-03-03", "author": "Michael Haag, Splunk", "description": "HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVEs in the wild - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.", "narrative": "On Tuesday, March 2, 2021, Microsoft released a set of security patches for its mail server, Microsoft Exchange. These patches respond to a group of vulnerabilities known to impact Exchange 2013, 2016, and 2019. It is important to note that an Exchange 2010 security update has also been issued, though the CVEs do not reference that version as being vulnerable.\\\nWhile the CVEs do not shed much light on the specifics of the vulnerabilities or exploits, the first vulnerability (CVE-2021-26855) has a remote network attack vector that allows the attacker, a group Microsoft named HAFNIUM, to authenticate as the Exchange server. Three additional vulnerabilities (CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) were also identified as part of this activity. When chained together along with CVE-2021-26855 for initial access, the attacker would have complete control over the Exchange server. This includes the ability to run code as SYSTEM and write to any path on the server.\\\nThe following Splunk detections assist with identifying the HAFNIUM groups tradecraft and methodology.", "references": ["https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html", "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/", "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/", "https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/"], "tags": {"name": "HAFNIUM Group", "analytic_story": "HAFNIUM Group", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.001", "mitre_attack_technique": "LSASS Memory", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT1", "APT28", "APT3", "APT32", "APT33", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Cleaver", "Earth Lusca", "FIN6", "FIN8", "Fox Kitten", "GALLIUM", "HAFNIUM", "Indrik Spider", "Ke3chang", "Kimsuky", "Leafminer", "Leviathan", "Magic Hound", "MuddyWater", "OilRig", "PLATINUM", "Sandworm Team", "Silence", "TEMP.Veles", "Threat Group-3390", "Whitefly"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1105", "mitre_attack_technique": "Ingress Tool Transfer", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "Chimera", "Cobalt Group", "Confucius", "Darkhotel", "Dragonfly", "Elderwood", "Ember Bear", "Evilnum", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "IndigoZebra", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "Rancor", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Turla", "Volatile Cedar", "WIRTE", "Whitefly", "Windshift", "Winnti Group", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1505", "mitre_attack_technique": "Server Software Component", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1505.003", "mitre_attack_technique": "Web Shell", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT38", "APT39", "BackdoorDiplomacy", "Deep Panda", "Dragonfly", "Fox Kitten", "GALLIUM", "HAFNIUM", "Kimsuky", "Leviathan", "Magic Hound", "Moses Staff", "OilRig", "Sandworm Team", "TEMP.Veles", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Volatile Cedar"]}, {"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}, {"mitre_attack_id": "T1136.001", "mitre_attack_technique": "Local Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT3", "APT39", "APT41", "Dragonfly", "Fox Kitten", "Kimsuky", "Leafminer", "Magic Hound", "TeamTNT"]}, {"mitre_attack_id": "T1136", "mitre_attack_technique": "Create Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["Indrik Spider", "Sandworm Team"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021.002", "mitre_attack_technique": "SMB/Windows Admin Shares", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT39", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "FIN8", "Fox Kitten", "Ke3chang", "Lazarus Group", "Moses Staff", "Orangeworm", "Sandworm Team", "Threat Group-1314", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1569", "mitre_attack_technique": "System Services", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1569.002", "mitre_attack_technique": "Service Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT32", "APT38", "APT39", "APT41", "Blue Mockingbird", "Chimera", "FIN6", "Ke3chang", "Silence", "Wizard Spider"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1003.003", "mitre_attack_technique": "NTDS", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "Chimera", "Dragonfly", "FIN6", "Fox Kitten", "HAFNIUM", "Ke3chang", "LAPSUS$", "Mustang Panda", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1114", "mitre_attack_technique": "Email Collection", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["Magic Hound", "Silent Librarian"]}, {"mitre_attack_id": "T1114.002", "mitre_attack_technique": "Remote Email Collection", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT1", "APT28", "APT29", "Chimera", "Dragonfly", "FIN4", "HAFNIUM", "Ke3chang", "Kimsuky", "Leafminer", "Magic Hound"]}], "mitre_attack_tactics": ["Collection", "Command And Control", "Credential Access", "Execution", "Initial Access", "Lateral Movement", "Persistence"], "datamodels": ["Endpoint", "Network_Traffic"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Exploitation", "Installation"]}, "detection_names": ["ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Exchange Web Shell - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Nishang PowershellTCPOneLine - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - PowerShell - Connect To Internet With Hidden Window - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Dump LSASS via procdump Rename", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}]}}, {"name": "Any Powershell DownloadString", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Detect Exchange Web Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "Web Shell"}, {"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Detect New Local Admin account", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Local Account"}, {"mitre_attack_technique": "Create Account"}]}}, {"name": "Detect PsExec With accepteula Flag", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "SMB/Windows Admin Shares"}]}}, {"name": "Detect Renamed PSExec", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Services"}, {"mitre_attack_technique": "Service Execution"}]}}, {"name": "Dump LSASS via comsvcs DLL", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Dump LSASS via procdump", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Malicious PowerShell Process - Execution Policy Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Nishang PowershellTCPOneLine", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Ntdsutil Export NTDS", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "NTDS"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "PowerShell - Connect To Internet With Hidden Window", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Set Default PowerShell Execution Policy To Unrestricted or Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Unified Messaging Service Spawning a Process", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "W3WP Spawning Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "Web Shell"}]}}, {"name": "Email servers sending high volume traffic to hosts", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Email Collection"}, {"mitre_attack_technique": "Remote Email Collection"}]}}]}, {"name": "Hermetic Wiper", "id": "b7511c2e-9a10-11ec-99e3-acde48001122", "version": 1, "date": "2022-03-02", "author": "Teoderick Contreras, Rod Soto, Michael Haag, Splunk", "description": "This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive malware targeting Ukrainian organizations also known as \"Hermetic Wiper\". This analytic story looks for abuse of Regsvr32, executables written in administrative SMB Share, suspicious processes, disabling of memory crash dump and more.", "narrative": "Hermetic Wiper is destructive malware operation found by Sentinel One targeting multiple organizations in Ukraine. This malicious payload corrupts Master Boot Records, uses signed drivers and manipulates NTFS attributes for file destruction.", "references": ["https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/", "https://www.cisa.gov/uscert/ncas/alerts/aa22-057a"], "tags": {"name": "Hermetic Wiper", "analytic_story": "Hermetic Wiper", "category": ["Data Destruction", "Malware", "Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1204.002", "mitre_attack_technique": "Malicious File", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT-C-36", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "Ajax Security Team", "Andariel", "Aoqin Dragon", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "Dark Caracal", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Earth Lusca", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HEXANE", "Higaisa", "Inception", "IndigoZebra", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "PROMETHIUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Whitefly", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1547.014", "mitre_attack_technique": "Active Setup", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1105", "mitre_attack_technique": "Ingress Tool Transfer", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "Chimera", "Cobalt Group", "Confucius", "Darkhotel", "Dragonfly", "Elderwood", "Ember Bear", "Evilnum", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "IndigoZebra", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "Rancor", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Turla", "Volatile Cedar", "WIRTE", "Whitefly", "Windshift", "Winnti Group", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1546.001", "mitre_attack_technique": "Change Default File Association", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Kimsuky"]}, {"mitre_attack_id": "T1546", "mitre_attack_technique": "Event Triggered Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1562.006", "mitre_attack_technique": "Indicator Blocking", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1127", "mitre_attack_technique": "Trusted Developer Utilities Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021.002", "mitre_attack_technique": "SMB/Windows Admin Shares", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT39", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "FIN8", "Fox Kitten", "Ke3chang", "Lazarus Group", "Moses Staff", "Orangeworm", "Sandworm Team", "Threat Group-1314", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1558", "mitre_attack_technique": "Steal or Forge Kerberos Tickets", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1558.003", "mitre_attack_technique": "Kerberoasting", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "FIN7", "Wizard Spider"]}, {"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}, {"mitre_attack_id": "T1037", "mitre_attack_technique": "Boot or Logon Initialization Scripts", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Rocke"]}, {"mitre_attack_id": "T1037.001", "mitre_attack_technique": "Logon Script (Windows)", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "Cobalt Group"]}, {"mitre_attack_id": "T1027", "mitre_attack_technique": "Obfuscated Files or Information", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "Aquatic Panda", "BITTER", "BackdoorDiplomacy", "BlackOasis", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Earth Lusca", "Elderwood", "Ember Bear", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Group5", "HEXANE", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leafminer", "Leviathan", "Magic Hound", "Mofang", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Putter Panda", "Rocke", "Sandworm Team", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Transparent Tribe", "Tropic Trooper", "Turla", "Whitefly", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1574.002", "mitre_attack_technique": "DLL Side-Loading", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT41", "BRONZE BUTLER", "BlackTech", "Chimera", "Earth Lusca", "GALLIUM", "Higaisa", "Lazarus Group", "MuddyWater", "Mustang Panda", "Naikon", "Patchwork", "SideCopy", "Sidewinder", "Threat Group-3390", "Tropic Trooper", "menuPass"]}, {"mitre_attack_id": "T1574", "mitre_attack_technique": "Hijack Execution Flow", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1546.008", "mitre_attack_technique": "Accessibility Features", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT29", "APT3", "APT41", "Axiom", "Deep Panda", "Fox Kitten"]}, {"mitre_attack_id": "T1021.003", "mitre_attack_technique": "Distributed Component Object Model", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021.006", "mitre_attack_technique": "Windows Remote Management", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT29", "Chimera", "Threat Group-3390", "Wizard Spider"]}, {"mitre_attack_id": "T1047", "mitre_attack_technique": "Windows Management Instrumentation", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT29", "APT32", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "Earth Lusca", "FIN6", "FIN7", "FIN8", "GALLIUM", "Gamaredon Group", "Indrik Spider", "Lazarus Group", "Leviathan", "Magic Hound", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "Stealth Falcon", "Threat Group-3390", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1218.014", "mitre_attack_technique": "MMC", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1027.005", "mitre_attack_technique": "Indicator Removal from Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT3", "Deep Panda", "GALLIUM", "OilRig", "Patchwork", "TEMP.Veles", "Turla"]}, {"mitre_attack_id": "T1546.015", "mitre_attack_technique": "Component Object Model Hijacking", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28"]}, {"mitre_attack_id": "T1055", "mitre_attack_technique": "Process Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT32", "APT37", "APT41", "Cobalt Group", "Kimsuky", "PLATINUM", "Silence", "Turla"]}, {"mitre_attack_id": "T1592", "mitre_attack_technique": "Gather Victim Host Information", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1546.012", "mitre_attack_technique": "Image File Execution Options Injection", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["TEMP.Veles"]}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.010", "mitre_attack_technique": "Regsvr32", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "Blue Mockingbird", "Cobalt Group", "Deep Panda", "Inception", "Kimsuky", "Lazarus Group", "Leviathan", "TA551", "WIRTE"]}, {"mitre_attack_id": "T1134", "mitre_attack_technique": "Access Token Manipulation", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["Blue Mockingbird", "FIN6"]}, {"mitre_attack_id": "T1134.001", "mitre_attack_technique": "Token Impersonation/Theft", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "FIN8"]}, {"mitre_attack_id": "T1546.002", "mitre_attack_technique": "Screensaver", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547.003", "mitre_attack_technique": "Time Providers", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1505", "mitre_attack_technique": "Server Software Component", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1505.003", "mitre_attack_technique": "Web Shell", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT38", "APT39", "BackdoorDiplomacy", "Deep Panda", "Dragonfly", "Fox Kitten", "GALLIUM", "HAFNIUM", "Kimsuky", "Leviathan", "Magic Hound", "Moses Staff", "OilRig", "Sandworm Team", "TEMP.Veles", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Volatile Cedar"]}, {"mitre_attack_id": "T1485", "mitre_attack_technique": "Data Destruction", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "Gamaredon Group", "LAPSUS$", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1112", "mitre_attack_technique": "Modify Registry", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "APT38", "APT41", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN8", "Gamaredon Group", "Gorgon Group", "Kimsuky", "Magic Hound", "Patchwork", "Silence", "TA505", "Threat Group-3390", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1561.002", "mitre_attack_technique": "Disk Structure Wipe", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT37", "APT38", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1561", "mitre_attack_technique": "Disk Wipe", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1566.001", "mitre_attack_technique": "Spearphishing Attachment", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "IndigoZebra", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1566", "mitre_attack_technique": "Phishing", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["Axiom", "GOLD SOUTHFIELD"]}, {"mitre_attack_id": "T1068", "mitre_attack_technique": "Exploitation for Privilege Escalation", "mitre_attack_tactics": ["Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT33", "BITTER", "Cobalt Group", "FIN6", "FIN8", "LAPSUS$", "PLATINUM", "Threat Group-3390", "Tonto Team", "Turla", "Whitefly", "ZIRCONIUM"]}, {"mitre_attack_id": "T1547.012", "mitre_attack_technique": "Print Processors", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}], "mitre_attack_tactics": ["Command And Control", "Credential Access", "Defense Evasion", "Execution", "Impact", "Initial Access", "Lateral Movement", "Persistence", "Privilege Escalation", "Reconnaissance"], "datamodels": ["Email", "Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Delivery", "Exploitation", "Installation", "Reconnaissance"]}, "detection_names": ["ESCU - Suspicious Powershell Command-Line Arguments - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Active Setup Registry Autostart - Rule", "ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Change Default File Association - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Executable File Written in Administrative SMB Share - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Linux Java Spawning Shell - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - MSI Module Loaded by Non-System Binary - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Possible Lateral Movement PowerShell Spawn - Rule", "ESCU - PowerShell 4104 Hunting - Rule", "ESCU - PowerShell - Connect To Internet With Hidden Window - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - PowerShell Loading DotNET into Memory via Reflection - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule", "ESCU - Runas Execution in CommandLine - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows File Without Extension In Critical Folder - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Raw Access To Disk Volume Partition - Rule", "ESCU - Windows Raw Access To Master Boot Record Drive - Rule", "ESCU - WMI Recon Running Process Or Services - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Print Processor Registry Autostart - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Rod Soto, Michael Haag, Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Suspicious Powershell Command-Line Arguments", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "PowerShell"}]}}, {"name": "Uncommon Processes On Endpoint", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Malicious File"}]}}, {"name": "Active Setup Registry Autostart", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Active Setup"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Any Powershell DownloadFile", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Any Powershell DownloadString", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Change Default File Association", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Change Default File Association"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "CMD Carry Out String Command Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Command Shell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Detect Empire with PowerShell Script Block Logging", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Detect Mimikatz With PowerShell Script Block Logging", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "OS Credential Dumping"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "ETW Registry Disabled", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Blocking"}, {"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Executable File Written in Administrative SMB Share", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "SMB/Windows Admin Shares"}]}}, {"name": "Executables Or Script Creation In Suspicious Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "Kerberoasting spn request with RC4 encryption", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}, {"mitre_attack_technique": "Kerberoasting"}]}}, {"name": "Linux Java Spawning Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Logon Script Event Trigger Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Boot or Logon Initialization Scripts"}, {"mitre_attack_technique": "Logon Script (Windows)"}]}}, {"name": "Malicious PowerShell Process - Encoded Command", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Obfuscated Files or Information"}]}}, {"name": "Malicious PowerShell Process With Obfuscation Techniques", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "MSI Module Loaded by Non-System Binary", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DLL Side-Loading"}, {"mitre_attack_technique": "Hijack Execution Flow"}]}}, {"name": "Overwriting Accessibility Binaries", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Event Triggered Execution"}, {"mitre_attack_technique": "Accessibility Features"}]}}, {"name": "Possible Lateral Movement PowerShell Spawn", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "Distributed Component Object Model"}, {"mitre_attack_technique": "Windows Remote Management"}, {"mitre_attack_technique": "Windows Management Instrumentation"}, {"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Windows Service"}, {"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "MMC"}]}}, {"name": "PowerShell 4104 Hunting", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "PowerShell - Connect To Internet With Hidden Window", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "PowerShell Domain Enumeration", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Powershell Enable SMB1Protocol Feature", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Obfuscated Files or Information"}, {"mitre_attack_technique": "Indicator Removal from Tools"}]}}, {"name": "Powershell Execute COM Object", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Component Object Model Hijacking"}, {"mitre_attack_technique": "Event Triggered Execution"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Powershell Fileless Process Injection via GetProcAddress", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "Process Injection"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Powershell Fileless Script Contains Base64 Encoded Content", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "Obfuscated Files or Information"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "PowerShell Loading DotNET into Memory via Reflection", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Powershell Processing Stream Of Data", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Powershell Using memory As Backing Store", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Recon AVProduct Through Pwh or WMI", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Gather Victim Host Information"}]}}, {"name": "Recon Using WMI Class", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Gather Victim Host Information"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Registry Keys Used For Privilege Escalation", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Image File Execution Options Injection"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "Regsvr32 Silent and Install Param Dll Loading", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvr32"}]}}, {"name": "Runas Execution in CommandLine", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Access Token Manipulation"}, {"mitre_attack_technique": "Token Impersonation/Theft"}]}}, {"name": "Screensaver Event Trigger Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Event Triggered Execution"}, {"mitre_attack_technique": "Screensaver"}]}}, {"name": "Set Default PowerShell Execution Policy To Unrestricted or Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Suspicious Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Time Provider Persistence Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Time Providers"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Unloading AMSI via Reflection", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Impair Defenses"}, {"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "W3WP Spawning Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "Web Shell"}]}}, {"name": "Windows Disable Memory Crash Dump", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Windows File Without Extension In Critical Folder", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Windows Modify Show Compress Color And Info Tip Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Raw Access To Disk Volume Partition", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disk Structure Wipe"}, {"mitre_attack_technique": "Disk Wipe"}]}}, {"name": "Windows Raw Access To Master Boot Record Drive", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disk Structure Wipe"}, {"mitre_attack_technique": "Disk Wipe"}]}}, {"name": "WMI Recon Running Process Or Services", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Gather Victim Host Information"}]}}, {"name": "Email Attachments With Lots Of Spaces", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "Suspicious Email Attachment Extensions", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}]}}, {"name": "Child Processes of Spoolsv exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation for Privilege Escalation"}]}}, {"name": "Print Processor Registry Autostart", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Print Processors"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}]}, {"name": "Hidden Cobra Malware", "id": "baf7580b-d4b4-4774-8173-7d198e9da335", "version": 2, "date": "2020-01-22", "author": "Rico Valdez, Splunk", "description": "Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A.", "narrative": "North Korea's government-sponsored \"cyber army\" has been slowly building momentum and gaining sophistication over the last 15 years or so. As a result, the group's activity, which the US government refers to as \"Hidden Cobra,\" has surreptitiously crept onto the collective radar as a preeminent global threat.\\\nThese state-sponsored actors are thought to be responsible for everything from a hack on a South Korean nuclear plant to an attack on Sony in anticipation of its release of the movie \"The Interview\" at the end of 2014. They're also notorious for cyberespionage. In recent years, the group seems to be focused on financial crimes, such as cryptojacking.\\\nIn June of 2018, The Department of Homeland Security, together with the FBI and other U.S. government partners, issued Technical Alert (TA-18-149A) to advise the public about two variants of North Korean malware. One variant, dubbed \"Joanap,\" is a multi-stage peer-to-peer botnet that allows North Korean state actors to exfiltrate data, download and execute secondary payloads, and initialize proxy communications. The other variant, \"Brambul,\" is a Windows32 SMB worm that is dropped into a victim network. When executed, the malware attempts to spread laterally within a victim's local subnet, connecting via the SMB protocol and initiating brute-force password attacks. It reports details to the Hidden Cobra actors via email, so they can use the information for secondary remote operations.\\\nAmong other searches in this Analytic Story is a detection search that looks for the creation or deletion of hidden shares, such as, \"adnim$,\" which the Hidden Cobra malware creates on the target system. Another looks for the creation of three malicious files associated with the malware. You can also use a search in this story to investigate activity that indicates that malware is sending email back to the attackers.", "references": ["https://web.archive.org/web/20191220004307/https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://web.archive.org/web/20220421112536/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"], "tags": {"name": "Hidden Cobra Malware", "analytic_story": "Hidden Cobra Malware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1070", "mitre_attack_technique": "Indicator Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Lazarus Group"]}, {"mitre_attack_id": "T1070.005", "mitre_attack_technique": "Network Share Connection Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Threat Group-3390"]}, {"mitre_attack_id": "T1021.001", "mitre_attack_technique": "Remote Desktop Protocol", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT1", "APT29", "APT3", "APT39", "APT41", "Axiom", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "HEXANE", "Kimsuky", "Lazarus Group", "Leviathan", "Magic Hound", "OilRig", "Patchwork", "Silence", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1071.002", "mitre_attack_technique": "File Transfer Protocols", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT41", "Kimsuky", "SilverTerrier"]}, {"mitre_attack_id": "T1071", "mitre_attack_technique": "Application Layer Protocol", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["Dragonfly", "Magic Hound", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1071.004", "mitre_attack_technique": "DNS", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT18", "APT39", "APT41", "Chimera", "Cobalt Group", "FIN7", "Ke3chang", "LazyScripter", "OilRig", "Tropic Trooper"]}, {"mitre_attack_id": "T1021.002", "mitre_attack_technique": "SMB/Windows Admin Shares", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT39", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "FIN8", "Fox Kitten", "Ke3chang", "Lazarus Group", "Moses Staff", "Orangeworm", "Sandworm Team", "Threat Group-1314", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1048.003", "mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["APT32", "APT33", "FIN6", "FIN8", "Lazarus Group", "OilRig", "Thrip", "Wizard Spider"]}, {"mitre_attack_id": "T1048", "mitre_attack_technique": "Exfiltration Over Alternative Protocol", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["TeamTNT"]}], "mitre_attack_tactics": ["Command And Control", "Defense Evasion", "Execution", "Exfiltration", "Lateral Movement"], "datamodels": ["Endpoint", "Network_Resolution", "Network_Traffic"], "kill_chain_phases": ["Actions on Objectives", "Command & Control"]}, "detection_names": ["ESCU - First time seen command line argument - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - Create or delete windows shares using net exe - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule"], "investigation_names": ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"], "baseline_names": ["ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Previously seen command line arguments"], "author_company": "Splunk", "author_name": "Rico Valdez", "detections": [{"name": "First time seen command line argument", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Windows Command Shell"}]}}, {"name": "Suspicious File Write", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Create or delete windows shares using net exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}, {"mitre_attack_technique": "Network Share Connection Removal"}]}}, {"name": "Remote Desktop Process Running On System", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Desktop Protocol"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "Detect Outbound SMB Traffic", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File Transfer Protocols"}, {"mitre_attack_technique": "Application Layer Protocol"}]}}, {"name": "DNS Query Length Outliers - MLTK", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DNS"}, {"mitre_attack_technique": "Application Layer Protocol"}]}}, {"name": "Remote Desktop Network Traffic", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Desktop Protocol"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "SMB Traffic Spike", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "SMB/Windows Admin Shares"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "SMB Traffic Spike - MLTK", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "SMB/Windows Admin Shares"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "DNS Query Length With High Standard Deviation", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}, {"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}]}, {"name": "IIS Components", "id": "0fbde550-8252-43ab-a26a-03976f55b58b", "version": 1, "date": "2022-12-19", "author": "Michael Haag, Splunk", "description": "Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence.", "narrative": "IIS provides several mechanisms to extend the functionality of the web servers. For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. Extensions and filters are deployed as DLL files that export three functions - Get{Extension/Filter}Version, Http{Extension/Filter}Proc, and (optionally) Terminate{Extension/Filter}. IIS modules may also be installed to extend IIS web servers.\\\nAdversaries may install malicious ISAPI extensions and filters to observe and/or modify traffic, execute commands on compromised machines, or proxy command and control traffic. ISAPI extensions and filters may have access to all IIS web requests and responses. For example, an adversary may abuse these mechanisms to modify HTTP responses in order to distribute malicious commands/content to previously comprised hosts.\\\nAdversaries may also install malicious IIS modules to observe and/or modify traffic. IIS 7.0 introduced modules that provide the same unrestricted access to HTTP requests and responses as ISAPI extensions and filters. IIS modules can be written as a DLL that exports RegisterModule, or as a .NET application that interfaces with ASP.NET APIs to access IIS HTTP requests. (reference MITRE)", "references": ["https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/", "https://attack.mitre.org/techniques/T1505/004/", "https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf", "https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/", "https://www.secureworks.com/research/bronze-union", "https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html"], "tags": {"name": "IIS Components", "analytic_story": "IIS Components", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1562.002", "mitre_attack_technique": "Disable Windows Event Logging", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Sandworm Team", "Threat Group-3390"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1505", "mitre_attack_technique": "Server Software Component", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1505.004", "mitre_attack_technique": "IIS Components", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Defense Evasion", "Persistence"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Installation"]}, "detection_names": ["ESCU - Windows Disable Windows Event Logging Disable HTTP Logging - Rule", "ESCU - Windows IIS Components Add New Module - Rule", "ESCU - Windows IIS Components Get-WebGlobalModule Module Query - Rule", "ESCU - Windows IIS Components Module Failed to Load - Rule", "ESCU - Windows IIS Components New Module Added - Rule", "ESCU - Windows PowerShell Add Module to Global Assembly Cache - Rule", "ESCU - Windows PowerShell Disable HTTP Logging - Rule", "ESCU - Windows PowerShell IIS Components WebGlobalModule Usage - Rule", "ESCU - Windows Server Software Component GACUtil Install to GAC - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Windows Disable Windows Event Logging Disable HTTP Logging", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable Windows Event Logging"}, {"mitre_attack_technique": "Impair Defenses"}, {"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "IIS Components"}]}}, {"name": "Windows IIS Components Add New Module", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "IIS Components"}]}}, {"name": "Windows IIS Components Get-WebGlobalModule Module Query", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "IIS Components"}, {"mitre_attack_technique": "Server Software Component"}]}}, {"name": "Windows IIS Components Module Failed to Load", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "IIS Components"}]}}, {"name": "Windows IIS Components New Module Added", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "IIS Components"}]}}, {"name": "Windows PowerShell Add Module to Global Assembly Cache", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "IIS Components"}]}}, {"name": "Windows PowerShell Disable HTTP Logging", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Impair Defenses"}, {"mitre_attack_technique": "Disable Windows Event Logging"}, {"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "IIS Components"}]}}, {"name": "Windows PowerShell IIS Components WebGlobalModule Usage", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "IIS Components"}]}}, {"name": "Windows Server Software Component GACUtil Install to GAC", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "IIS Components"}]}}]}, {"name": "Industroyer2", "id": "7ff7db2b-b001-498e-8fe8-caf2dbc3428a", "version": 1, "date": "2022-04-21", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the Industroyer2 attack, including file writes associated with its payload, lateral movement, persistence, privilege escalation and data destruction.", "narrative": "Industroyer2 is part of continuous attack to ukraine targeting energy facilities. This malware is a windows binary that implement IEC-104 protocol to communicate with industrial equipments. This attack consist of several destructive linux script component to wipe or delete several linux critical files, powershell for domain enumeration and caddywiper to wipe boot sector of the targeted host.", "references": ["https://cert.gov.ua/article/39518", "https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/"], "tags": {"name": "Industroyer2", "analytic_story": "Industroyer2", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1087.002", "mitre_attack_technique": "Domain Account", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "BRONZE BUTLER", "Chimera", "Dragonfly", "FIN6", "Fox Kitten", "Ke3chang", "LAPSUS$", "Lazarus Group", "MuddyWater", "OilRig", "Poseidon Group", "Sandworm Team", "Turla", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1087", "mitre_attack_technique": "Account Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29"]}, {"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1003.001", "mitre_attack_technique": "LSASS Memory", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT1", "APT28", "APT3", "APT32", "APT33", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Cleaver", "Earth Lusca", "FIN6", "FIN8", "Fox Kitten", "GALLIUM", "HAFNIUM", "Indrik Spider", "Ke3chang", "Kimsuky", "Leafminer", "Leviathan", "Magic Hound", "MuddyWater", "OilRig", "PLATINUM", "Sandworm Team", "Silence", "TEMP.Veles", "Threat Group-3390", "Whitefly"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021.002", "mitre_attack_technique": "SMB/Windows Admin Shares", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT39", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "FIN8", "Fox Kitten", "Ke3chang", "Lazarus Group", "Moses Staff", "Orangeworm", "Sandworm Team", "Threat Group-1314", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1021.003", "mitre_attack_technique": "Distributed Component Object Model", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1047", "mitre_attack_technique": "Windows Management Instrumentation", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT29", "APT32", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "Earth Lusca", "FIN6", "FIN7", "FIN8", "GALLIUM", "Gamaredon Group", "Indrik Spider", "Lazarus Group", "Leviathan", "Magic Hound", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "Stealth Falcon", "Threat Group-3390", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1053.003", "mitre_attack_technique": "Cron", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT38", "Rocke"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1485", "mitre_attack_technique": "Data Destruction", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "Gamaredon Group", "LAPSUS$", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1489", "mitre_attack_technique": "Service Stop", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["Indrik Spider", "Lazarus Group", "Wizard Spider"]}, {"mitre_attack_id": "T1070.004", "mitre_attack_technique": "File Deletion", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT3", "APT32", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Chimera", "Cobalt Group", "Dragonfly", "Evilnum", "FIN10", "FIN5", "FIN6", "FIN8", "Gamaredon Group", "Group5", "Kimsuky", "Lazarus Group", "Magic Hound", "Mustang Panda", "OilRig", "Patchwork", "Rocke", "Sandworm Team", "Silence", "TEMP.Veles", "TeamTNT", "The White Company", "Threat Group-3390", "Tropic Trooper", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1070", "mitre_attack_technique": "Indicator Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Lazarus Group"]}, {"mitre_attack_id": "T1016", "mitre_attack_technique": "System Network Configuration Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT1", "APT19", "APT3", "APT32", "APT41", "Chimera", "Darkhotel", "Dragonfly", "Earth Lusca", "GALLIUM", "HEXANE", "Higaisa", "Ke3chang", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "SideCopy", "Sidewinder", "Stealth Falcon", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1592", "mitre_attack_technique": "Gather Victim Host Information", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1562.004", "mitre_attack_technique": "Disable or Modify System Firewall", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "APT38", "Carbanak", "Dragonfly", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Discovery", "Execution", "Impact", "Lateral Movement", "Persistence", "Privilege Escalation", "Reconnaissance"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - AdsiSearcher Account Discovery - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Executable File Written in Administrative SMB Share - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Linux Adding Crontab Using List Parameter - Rule", "ESCU - Linux DD File Overwrite - Rule", "ESCU - Linux Deleting Critical Directory Using RM Command - Rule", "ESCU - Linux Disable Services - Rule", "ESCU - Linux High Frequency Of File Deletion In Boot Folder - Rule", "ESCU - Linux Shred Overwrite Command - Rule", "ESCU - Linux Stop Services - Rule", "ESCU - Linux System Network Discovery - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Schtasks Run Task On Demand - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Windows Hidden Schedule Task Settings - Rule", "ESCU - Windows Linked Policies In ADSI Discovery - Rule", "ESCU - Windows Processes Killed By Industroyer2 Malware - Rule", "ESCU - Windows Root Domain linked policies Discovery - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Linux Stdout Redirection To Dev Null File - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "AdsiSearcher Account Discovery", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Account Discovery"}]}}, {"name": "Attempted Credential Dump From Registry via Reg exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Dump LSASS via comsvcs DLL", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Executable File Written in Administrative SMB Share", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "SMB/Windows Admin Shares"}]}}, {"name": "Executables Or Script Creation In Suspicious Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "Impacket Lateral Movement Commandline Parameters", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "SMB/Windows Admin Shares"}, {"mitre_attack_technique": "Distributed Component Object Model"}, {"mitre_attack_technique": "Windows Management Instrumentation"}, {"mitre_attack_technique": "Windows Service"}]}}, {"name": "Linux Adding Crontab Using List Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cron"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux DD File Overwrite", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Linux Deleting Critical Directory Using RM Command", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Linux Disable Services", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Service Stop"}]}}, {"name": "Linux High Frequency Of File Deletion In Boot Folder", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}, {"mitre_attack_technique": "File Deletion"}, {"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "Linux Shred Overwrite Command", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Linux Stop Services", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Service Stop"}]}}, {"name": "Linux System Network Discovery", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Configuration Discovery"}]}}, {"name": "Recon Using WMI Class", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Gather Victim Host Information"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Schtasks Run Task On Demand", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Suspicious Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Windows Hidden Schedule Task Settings", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Windows Linked Policies In ADSI Discovery", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Account Discovery"}]}}, {"name": "Windows Processes Killed By Industroyer2 Malware", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Service Stop"}]}}, {"name": "Windows Root Domain linked policies Discovery", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Account Discovery"}]}}, {"name": "WinEvent Scheduled Task Created Within Public Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "WinEvent Windows Task Scheduler Event Action Started", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}]}}, {"name": "Linux Stdout Redirection To Dev Null File", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify System Firewall"}, {"mitre_attack_technique": "Impair Defenses"}]}}]}, {"name": "Information Sabotage", "id": "b71ba595-ef80-4e39-8b66-887578a7a71b", "version": 1, "date": "2021-11-17", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might correlate to insider threat specially in terms of information sabotage.", "narrative": "Information sabotage is the type of crime many people associate with insider threat. Where the current or former employees, contractors, or business partners intentionally exceeded or misused an authorized level of access to networks, systems, or data with the intention of harming a specific individual, the organization, or the organization's data, systems, and/or daily business operations.", "references": ["https://insights.sei.cmu.edu/blog/insider-threat-deep-dive-it-sabotage/"], "tags": {"name": "Information Sabotage", "analytic_story": "Information Sabotage", "category": ["Abuse"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Splunk Behavioral Analytics"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1537", "mitre_attack_technique": "Transfer Data to Cloud Account", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Exfiltration"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - High Frequency Copy Of Files In Network Share - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "High Frequency Copy Of Files In Network Share", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Transfer Data to Cloud Account"}]}}]}, {"name": "Ingress Tool Transfer", "id": "b3782036-8cbd-11eb-9d8e-acde48001122", "version": 1, "date": "2021-03-24", "author": "Michael Haag, Splunk", "description": "Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP.", "narrative": "Ingress tool transfer is a Technique under tactic Command and Control. Behaviors will include the use of living off the land binaries to download implants or binaries over alternate communication ports. It is imperative to baseline applications on endpoints to understand what generates network activity, to where, and what is its native behavior. These utilities, when abused, will write files to disk in world writeable paths.\\ During triage, review the reputation of the remote public destination IP or domain. Capture any files written to disk and perform analysis. Review other parrallel processes for additional behaviors.", "references": ["https://attack.mitre.org/techniques/T1105/"], "tags": {"name": "Ingress Tool Transfer", "analytic_story": "Ingress Tool Transfer", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1105", "mitre_attack_technique": "Ingress Tool Transfer", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "Chimera", "Cobalt Group", "Confucius", "Darkhotel", "Dragonfly", "Elderwood", "Ember Bear", "Evilnum", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "IndigoZebra", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "Rancor", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Turla", "Volatile Cedar", "WIRTE", "Whitefly", "Windshift", "Winnti Group", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1197", "mitre_attack_technique": "BITS Jobs", "mitre_attack_tactics": ["Defense Evasion", "Persistence"], "mitre_attack_groups": ["APT39", "APT41", "Leviathan", "Patchwork"]}, {"mitre_attack_id": "T1090", "mitre_attack_technique": "Proxy", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT41", "Blue Mockingbird", "CopyKittens", "Earth Lusca", "Fox Kitten", "LAPSUS$", "POLONIUM", "Sandworm Team", "Turla", "Windigo"]}, {"mitre_attack_id": "T1095", "mitre_attack_technique": "Non-Application Layer Protocol", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT29", "APT3", "BITTER", "BackdoorDiplomacy", "FIN6", "HAFNIUM", "PLATINUM"]}], "mitre_attack_tactics": ["Command And Control", "Defense Evasion", "Execution", "Persistence"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Installation"]}, "detection_names": ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Curl Download and Bash Execution - Rule", "ESCU - Linux Curl Upload File - Rule", "ESCU - Linux Ingress Tool Transfer Hunting - Rule", "ESCU - Linux Ingress Tool Transfer with Curl - Rule", "ESCU - Linux Proxy Socks Curl - Rule", "ESCU - Wget Download and Bash Execution - Rule", "ESCU - Windows Curl Download to Suspicious Path - Rule", "ESCU - Windows Curl Upload to Remote Destination - Rule", "ESCU - Suspicious Curl Network Connection - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Any Powershell DownloadFile", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Any Powershell DownloadString", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "BITSAdmin Download File", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "BITS Jobs"}, {"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "CertUtil Download With URLCache and Split Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "CertUtil Download With VerifyCtl and Split Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Curl Download and Bash Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Linux Curl Upload File", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Linux Ingress Tool Transfer Hunting", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Linux Ingress Tool Transfer with Curl", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Linux Proxy Socks Curl", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Proxy"}, {"mitre_attack_technique": "Non-Application Layer Protocol"}]}}, {"name": "Wget Download and Bash Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Windows Curl Download to Suspicious Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Windows Curl Upload to Remote Destination", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Suspicious Curl Network Connection", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}]}, {"name": "Insider Threat", "id": "c633df29-a950-4c4c-a0f8-02be6730797c", "version": 1, "date": "2022-05-19", "author": "Jose Hernandez, Splunk", "description": "Monitor for activities and techniques associated with insider threats and specifically focusing on malicious insiders operating with in a corporate environment.", "narrative": "Insider Threats are best defined by CISA: \"Insider threat incidents are possible in any sector or organization. An insider threat is typically a current or former employee, third-party contractor, or business partner. In their present or former role, the person has or had access to an organization's network systems, data, or premises, and uses their access (sometimes unwittingly). To combat the insider threat, organizations can implement a proactive, prevention-focused mitigation program to detect and identify threats, assess risk, and manage that risk - before an incident occurs.\" An insider is any person who has or had authorized access to or knowledge of an organization's resources, including personnel, facilities, information, equipment, networks, and systems. These are the common insiders that create insider threats: Departing Employees, Security Evaders, Malicious Insiders, and Negligent Employees. This story aims at detecting the malicious insider.", "references": ["https://www.imperva.com/learn/application-security/insider-threats/", "https://www.cisa.gov/defining-insider-threats", "https://www.code42.com/glossary/types-of-insider-threats/", "https://github.com/Insider-Threat/Insider-Threat", "https://ctid.mitre-engenuity.org/our-work/insider-ttp-kb/"], "tags": {"name": "Insider Threat", "analytic_story": "Insider Threat", "category": ["Adversary Tactics", "Account Compromise", "Lateral Movement", "Privilege Escalation"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Splunk Behavioral Analytics"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1048.003", "mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["APT32", "APT33", "FIN6", "FIN8", "Lazarus Group", "OilRig", "Thrip", "Wizard Spider"]}, {"mitre_attack_id": "T1048", "mitre_attack_technique": "Exfiltration Over Alternative Protocol", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1537", "mitre_attack_technique": "Transfer Data to Cloud Account", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1110.003", "mitre_attack_technique": "Password Spraying", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Chimera", "HEXANE", "Lazarus Group", "Leafminer", "Sandworm Team", "Silent Librarian"]}, {"mitre_attack_id": "T1110", "mitre_attack_technique": "Brute Force", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT38", "APT39", "DarkVishnya", "Dragonfly", "FIN5", "Fox Kitten", "HEXANE", "Lazarus Group", "OilRig", "Turla"]}, {"mitre_attack_id": "T1078.003", "mitre_attack_technique": "Local Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT29", "APT32", "FIN10", "HAFNIUM", "Kimsuky", "PROMETHIUM", "Tropic Trooper", "Turla"]}, {"mitre_attack_id": "T1552.001", "mitre_attack_technique": "Credentials In Files", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT3", "APT33", "Fox Kitten", "Kimsuky", "Leafminer", "MuddyWater", "OilRig", "TA505", "TeamTNT"]}, {"mitre_attack_id": "T1219", "mitre_attack_technique": "Remote Access Software", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["Carbanak", "Cobalt Group", "DarkVishnya", "Evilnum", "GOLD SOUTHFIELD", "Kimsuky", "MuddyWater", "Mustang Panda", "RTM", "Sandworm Team", "TeamTNT", "Thrip"]}, {"mitre_attack_id": "T1567.002", "mitre_attack_technique": "Exfiltration to Cloud Storage", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["Chimera", "Confucius", "Earth Lusca", "FIN7", "HAFNIUM", "HEXANE", "Kimsuky", "Lazarus Group", "Leviathan", "POLONIUM", "Threat Group-3390", "Turla", "ZIRCONIUM"]}, {"mitre_attack_id": "T1567", "mitre_attack_technique": "Exfiltration Over Web Service", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["APT28"]}], "mitre_attack_tactics": ["Command And Control", "Credential Access", "Defense Evasion", "Exfiltration", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": ["Authentication", "Endpoint"], "kill_chain_phases": ["Command & Control", "Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule", "ESCU - High Frequency Copy Of Files In Network Share - Rule", "ESCU - Multiple Users Failing To Authenticate From Process - Rule", "ESCU - Potential password in username - Rule", "ESCU - Windows Remote Access Software Hunt - Rule", "ESCU - Windows Users Authenticate Using Explicit Credentials - Rule", "ESCU - Gsuite Drive Share In External Email - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Jose Hernandez", "detections": [{"name": "Gsuite Outbound Email With Attachment To External Domain", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}, {"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}, {"name": "High Frequency Copy Of Files In Network Share", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Transfer Data to Cloud Account"}]}}, {"name": "Multiple Users Failing To Authenticate From Process", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Brute Force"}]}}, {"name": "Potential password in username", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Local Accounts"}, {"mitre_attack_technique": "Credentials In Files"}]}}, {"name": "Windows Remote Access Software Hunt", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Access Software"}]}}, {"name": "Windows Users Authenticate Using Explicit Credentials", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Spraying"}, {"mitre_attack_technique": "Brute Force"}]}}, {"name": "Gsuite Drive Share In External Email", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration to Cloud Storage"}, {"mitre_attack_technique": "Exfiltration Over Web Service"}]}}]}, {"name": "JBoss Vulnerability", "id": "1f5294cb-b85f-4c2d-9c58-ffcf248f52bd", "version": 1, "date": "2017-09-14", "author": "Bhavin Patel, Splunk", "description": "In March of 2016, adversaries were seen using JexBoss--an open-source utility used for testing and exploiting JBoss application servers. These searches help detect evidence of these attacks, such as network connections to external resources or web services spawning atypical child processes, among others.", "narrative": "This Analytic Story looks for probing and exploitation attempts targeting JBoss application servers. While the vulnerabilities associated with this story are rather dated, they were leveraged in a spring 2016 campaign in connection with the Samsam ransomware variant. Incidents involving this ransomware are unique, in that they begin with attacks against vulnerable services, rather than the phishing or drive-by attacks more common with ransomware. In this case, vulnerable JBoss applications appear to be the target of choice.\\\nIt is helpful to understand how often a notable event generated by this story occurs, as well as the commonalities between some of these events, both of which may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. It may also help to understand whether the issue is restricted to a single user/system or whether it is broader in scope.\\\nWhen looking at the target of the behavior uncovered by the event, you should note the sensitivity of the user and or/system to help determine the potential impact. It is also helpful to identify other recent events involving the target. This can help tie different events together and give further situational awareness regarding the target host.\\\nVarious types of information for external systems should be reviewed and, potentially, collected if the incident is, indeed, judged to be malicious. This data may be useful for generating your own threat intelligence, so you can create future alerts.\\\nThe following factors may assist you in determining whether the event is malicious: \\\n1. Country of origin\\\n1. Responsible party\\\n1. Fully qualified domain names associated with the external IP address\\\n1. Registration of fully qualified domain names associated with external IP address Determining whether it is a dynamic domain frequently visited by others and/or how third parties categorize it can also help you qualify and understand the event and possible motivation for the attack. In addition, there are various sources that may provide reputation information on the IP address or domain name, which can assist you in determining whether the event is malicious in nature. Finally, determining whether there are other events associated with the IP address may help connect data points or expose other historic events that might be brought back into scope.\\\nGathering various data on the system of interest can sometimes help quickly determine whether something suspicious is happening. Some of these items include determining who else may have logged into the system recently, whether any unusual scheduled tasks exist, whether the system is communicating on suspicious ports, whether there are modifications to sensitive registry keys, and/or whether there are any known vulnerabilities on the system. This information can often highlight other activity commonly seen in attack scenarios or give more information about how the system may have been targeted.\\\nhen a specific service or application is targeted, it is often helpful to know the associated version, to help determine whether it is vulnerable to a specific exploit.\\\nIf you suspect an attack targeting a web server, it is helpful to look at some of the behavior of the web service to see if there is evidence that the service has been compromised. Some indications of this might be network connections to external resources, the web service spawning child processes that are not associated with typical behavior, and whether the service wrote any files that might be malicious in nature.\\\nIf a suspicious file is found, we can review more information about it to help determine if it is, in fact, malicious. Identifying the file type, any processes that opened the file, the processes that may have created and/or modified the file, and how many other systems potentially have this file can you determine whether the file is malicious. Also, determining the file hash and checking it against reputation sources, such as VirusTotal, can sometimes help you quickly determine if it is malicious in nature.\\\nOften, a simple inspection of a suspect process name and path can tell you if the system has been compromised. For example, if svchost.exe is found running from a location other than `C:\\Windows\\System32`, it is likely something malicious designed to hide in plain sight when simply reviewing process names. \\\nIt can also be helpful to examine various behaviors of and the parent of the process of interest. For example, if it turns out the process of interest is malicious, it would be good to see whether the parent process spawned other processes that might also warrant further scrutiny. If a process is suspect, a review of the network connections made around the time of the event and noting whether the process has spawned any child processes could be helpful in determining whether it is malicious or executing a malicious script.", "references": ["http://www.deependresearch.org/2016/04/jboss-exploits-view-from-victim.html"], "tags": {"name": "JBoss Vulnerability", "analytic_story": "JBoss Vulnerability", "category": ["Vulnerability"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1082", "mitre_attack_technique": "System Information Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT18", "APT19", "APT29", "APT3", "APT32", "APT37", "APT38", "Aquatic Panda", "Blue Mockingbird", "Chimera", "Confucius", "Darkhotel", "Gamaredon Group", "HEXANE", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Sowbug", "Stealth Falcon", "TeamTNT", "Tropic Trooper", "Turla", "Windigo", "Windshift", "Wizard Spider", "ZIRCONIUM", "admin@338"]}], "mitre_attack_tactics": ["Discovery"], "datamodels": ["Web"], "kill_chain_phases": ["Delivery", "Reconnaissance"]}, "detection_names": ["ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Detect attackers scanning for vulnerable JBoss servers", "source": "web", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Information Discovery"}]}}, {"name": "Detect malicious requests to exploit JBoss servers", "source": "web", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}]}, {"name": "Kubernetes Scanning Activity", "id": "a9ef59cf-e981-4e66-9eef-bb049f695c09", "version": 1, "date": "2020-04-15", "author": "Rod Soto, Splunk", "description": "This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names.", "narrative": "Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitve information and management priviledges of production workloads, microservices and applications. These searches allow operator to detect suspicious unauthenticated requests from the internet to kubernetes cluster.", "references": ["https://github.com/splunk/cloud-datamodel-security-research"], "tags": {"name": "Kubernetes Scanning Activity", "analytic_story": "Kubernetes Scanning Activity", "category": ["Cloud Security"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1526", "mitre_attack_technique": "Cloud Service Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Discovery"], "datamodels": [], "kill_chain_phases": ["Reconnaissance"]}, "detection_names": ["ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule"], "investigation_names": ["ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Rod Soto", "detections": [{"name": "GCP Kubernetes cluster scan detection", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Service Discovery"}]}}, {"name": "Kubernetes Azure pod scan fingerprint", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Kubernetes Azure scan fingerprint", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Service Discovery"}]}}, {"name": "Amazon EKS Kubernetes cluster scan detection", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Service Discovery"}]}}, {"name": "Amazon EKS Kubernetes Pod scan detection", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Service Discovery"}]}}, {"name": "GCP Kubernetes cluster pod scan detection", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Service Discovery"}]}}]}, {"name": "Kubernetes Sensitive Object Access Activity", "id": "c7d4dbf0-a171-4eaf-8444-4f40392e4f92", "version": 1, "date": "2020-05-20", "author": "Rod Soto, Splunk", "description": "This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason.", "narrative": "Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive objects within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes sensitive objects.", "references": ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"], "tags": {"name": "Kubernetes Sensitive Object Access Activity", "analytic_story": "Kubernetes Sensitive Object Access Activity", "category": ["Cloud Security"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [], "mitre_attack_tactics": [], "datamodels": [], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Rod Soto", "detections": [{"name": "AWS EKS Kubernetes cluster sensitive object access", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Kubernetes AWS detect service accounts forbidden failure access", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Kubernetes Azure detect sensitive object access", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Kubernetes Azure detect service accounts forbidden failure access", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Kubernetes Azure detect suspicious kubectl calls", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Kubernetes GCP detect sensitive object access", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Kubernetes GCP detect service accounts forbidden failure access", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Kubernetes GCP detect suspicious kubectl calls", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Kubernetes AWS detect suspicious kubectl calls", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}]}, {"name": "Linux Living Off The Land", "id": "e405a2d7-dc8e-4227-8e9d-f60267b8c0cd", "version": 1, "date": "2022-07-27", "author": "Michael Haag, Splunk", "description": "Linux Living Off The Land consists of binaries that may be used to bypass local security restrictions within misconfigured systems.", "narrative": "Similar to Windows LOLBAS project, the GTFOBins project focuses solely on Unix binaries that may be abused in multiple categories including Reverse Shell, File Upload, File Download and much more. These binaries are native to the operating system and the functionality is typically native. The behaviors are typically not malicious by default or vulnerable, but these are built in functionality of the applications. When reviewing any notables or hunting through mountains of events of interest, it's important to identify the binary, review command-line arguments, path of file, and capture any network and file modifications. Linux analysis may be a bit cumbersome due to volume and how process behavior is seen in EDR products. Piecing it together will require some effort.", "references": ["https://gtfobins.github.io/"], "tags": {"name": "Linux Living Off The Land", "analytic_story": "Linux Living Off The Land", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1105", "mitre_attack_technique": "Ingress Tool Transfer", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "Chimera", "Cobalt Group", "Confucius", "Darkhotel", "Dragonfly", "Elderwood", "Ember Bear", "Evilnum", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "IndigoZebra", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "Rancor", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Turla", "Volatile Cedar", "WIRTE", "Whitefly", "Windshift", "Winnti Group", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1053.003", "mitre_attack_technique": "Cron", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT38", "Rocke"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1548.003", "mitre_attack_technique": "Sudo and Sudo Caching", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1548", "mitre_attack_technique": "Abuse Elevation Control Mechanism", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1053.002", "mitre_attack_technique": "At", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "BRONZE BUTLER", "Threat Group-3390"]}, {"mitre_attack_id": "T1222.002", "mitre_attack_technique": "Linux and Mac File and Directory Permissions Modification", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT32", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1222", "mitre_attack_technique": "File and Directory Permissions Modification", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1115", "mitre_attack_technique": "Clipboard Data", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT38", "APT39"]}, {"mitre_attack_id": "T1548.001", "mitre_attack_technique": "Setuid and Setgid", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1027", "mitre_attack_technique": "Obfuscated Files or Information", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "Aquatic Panda", "BITTER", "BackdoorDiplomacy", "BlackOasis", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Earth Lusca", "Elderwood", "Ember Bear", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Group5", "HEXANE", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leafminer", "Leviathan", "Magic Hound", "Mofang", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Putter Panda", "Rocke", "Sandworm Team", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Transparent Tribe", "Tropic Trooper", "Turla", "Whitefly", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1059.004", "mitre_attack_technique": "Unix Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT41", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1068", "mitre_attack_technique": "Exploitation for Privilege Escalation", "mitre_attack_tactics": ["Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT33", "BITTER", "Cobalt Group", "FIN6", "FIN8", "LAPSUS$", "PLATINUM", "Threat Group-3390", "Tonto Team", "Turla", "Whitefly", "ZIRCONIUM"]}, {"mitre_attack_id": "T1098.004", "mitre_attack_technique": "SSH Authorized Keys", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["Earth Lusca", "TeamTNT"]}, {"mitre_attack_id": "T1098", "mitre_attack_technique": "Account Manipulation", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT3", "Dragonfly", "Kimsuky", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1090", "mitre_attack_technique": "Proxy", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT41", "Blue Mockingbird", "CopyKittens", "Earth Lusca", "Fox Kitten", "LAPSUS$", "POLONIUM", "Sandworm Team", "Turla", "Windigo"]}, {"mitre_attack_id": "T1095", "mitre_attack_technique": "Non-Application Layer Protocol", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT29", "APT3", "BITTER", "BackdoorDiplomacy", "FIN6", "HAFNIUM", "PLATINUM"]}, {"mitre_attack_id": "T1053.006", "mitre_attack_technique": "Systemd Timers", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021.004", "mitre_attack_technique": "SSH", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT39", "BlackTech", "FIN7", "Fox Kitten", "GCMAN", "Lazarus Group", "Leviathan", "OilRig", "Rocke", "TEMP.Veles", "TeamTNT", "menuPass"]}], "mitre_attack_tactics": ["Collection", "Command And Control", "Defense Evasion", "Execution", "Lateral Movement", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Installation", "Reconnaissance"]}, "detection_names": ["ESCU - Curl Download and Bash Execution - Rule", "ESCU - Linux Add Files In Known Crontab Directories - Rule", "ESCU - Linux Adding Crontab Using List Parameter - Rule", "ESCU - Linux apt-get Privilege Escalation - Rule", "ESCU - Linux APT Privilege Escalation - Rule", "ESCU - Linux At Allow Config File Creation - Rule", "ESCU - Linux At Application Execution - Rule", "ESCU - Linux AWK Privilege Escalation - Rule", "ESCU - Linux Busybox Privilege Escalation - Rule", "ESCU - Linux c89 Privilege Escalation - Rule", "ESCU - Linux c99 Privilege Escalation - Rule", "ESCU - Linux Change File Owner To Root - Rule", "ESCU - Linux Clipboard Data Copy - Rule", "ESCU - Linux Common Process For Elevation Control - Rule", "ESCU - Linux Composer Privilege Escalation - Rule", "ESCU - Linux Cpulimit Privilege Escalation - Rule", "ESCU - Linux Csvtool Privilege Escalation - Rule", "ESCU - Linux Curl Upload File - Rule", "ESCU - Linux Decode Base64 to Shell - Rule", "ESCU - Linux Docker Privilege Escalation - Rule", "ESCU - Linux Edit Cron Table Parameter - Rule", "ESCU - Linux Emacs Privilege Escalation - Rule", "ESCU - Linux Find Privilege Escalation - Rule", "ESCU - Linux GDB Privilege Escalation - Rule", "ESCU - Linux Gem Privilege Escalation - Rule", "ESCU - Linux GNU Awk Privilege Escalation - Rule", "ESCU - Linux Ingress Tool Transfer Hunting - Rule", "ESCU - Linux Ingress Tool Transfer with Curl - Rule", "ESCU - Linux Make Privilege Escalation - Rule", "ESCU - Linux MySQL Privilege Escalation - Rule", "ESCU - Linux Node Privilege Escalation - Rule", "ESCU - Linux Obfuscated Files or Information Base64 Decode - Rule", "ESCU - Linux Octave Privilege Escalation - Rule", "ESCU - Linux OpenVPN Privilege Escalation - Rule", "ESCU - Linux PHP Privilege Escalation - Rule", "ESCU - Linux pkexec Privilege Escalation - Rule", "ESCU - Linux Possible Access Or Modification Of sshd Config File - Rule", "ESCU - Linux Possible Append Cronjob Entry on Existing Cronjob File - Rule", "ESCU - Linux Possible Cronjob Modification With Editor - Rule", "ESCU - Linux Possible Ssh Key File Creation - Rule", "ESCU - Linux Proxy Socks Curl - Rule", "ESCU - Linux Puppet Privilege Escalation - Rule", "ESCU - Linux RPM Privilege Escalation - Rule", "ESCU - Linux Ruby Privilege Escalation - Rule", "ESCU - Linux Service File Created In Systemd Directory - Rule", "ESCU - Linux Service Restarted - Rule", "ESCU - Linux Service Started Or Enabled - Rule", "ESCU - Linux Setuid Using Chmod Utility - Rule", "ESCU - Linux Sqlite3 Privilege Escalation - Rule", "ESCU - Linux SSH Authorized Keys Modification - Rule", "ESCU - Linux SSH Remote Services Script Execute - Rule", "ESCU - Suspicious Curl Network Connection - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Curl Download and Bash Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Linux Add Files In Known Crontab Directories", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cron"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Adding Crontab Using List Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cron"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux apt-get Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux APT Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux At Allow Config File Creation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cron"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux At Application Execution", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "At"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux AWK Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Busybox Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux c89 Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux c99 Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Change File Owner To Root", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Linux and Mac File and Directory Permissions Modification"}, {"mitre_attack_technique": "File and Directory Permissions Modification"}]}}, {"name": "Linux Clipboard Data Copy", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Clipboard Data"}]}}, {"name": "Linux Common Process For Elevation Control", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Setuid and Setgid"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Composer Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Cpulimit Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Csvtool Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Curl Upload File", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Linux Decode Base64 to Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Obfuscated Files or Information"}, {"mitre_attack_technique": "Unix Shell"}]}}, {"name": "Linux Docker Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Edit Cron Table Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cron"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Emacs Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Find Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux GDB Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Gem Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux GNU Awk Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Ingress Tool Transfer Hunting", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Linux Ingress Tool Transfer with Curl", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Linux Make Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux MySQL Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Node Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Obfuscated Files or Information Base64 Decode", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Obfuscated Files or Information"}]}}, {"name": "Linux Octave Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux OpenVPN Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux PHP Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux pkexec Privilege Escalation", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation for Privilege Escalation"}]}}, {"name": "Linux Possible Access Or Modification Of sshd Config File", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "SSH Authorized Keys"}, {"mitre_attack_technique": "Account Manipulation"}]}}, {"name": "Linux Possible Append Cronjob Entry on Existing Cronjob File", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cron"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Possible Cronjob Modification With Editor", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cron"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Possible Ssh Key File Creation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "SSH Authorized Keys"}, {"mitre_attack_technique": "Account Manipulation"}]}}, {"name": "Linux Proxy Socks Curl", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Proxy"}, {"mitre_attack_technique": "Non-Application Layer Protocol"}]}}, {"name": "Linux Puppet Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux RPM Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Ruby Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Service File Created In Systemd Directory", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Systemd Timers"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Service Restarted", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Systemd Timers"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Service Started Or Enabled", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Systemd Timers"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Setuid Using Chmod Utility", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Setuid and Setgid"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Sqlite3 Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux SSH Authorized Keys Modification", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "SSH Authorized Keys"}]}}, {"name": "Linux SSH Remote Services Script Execute", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "SSH"}]}}, {"name": "Suspicious Curl Network Connection", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}]}, {"name": "Linux Persistence Techniques", "id": "e40d13e5-d38b-457e-af2a-e8e6a2f2b516", "version": 1, "date": "2021-12-17", "author": "Teoderick Contreras, Splunk", "description": "Monitor for activities and techniques associated with maintaining persistence on a Linux system--a sign that an adversary may have compromised your environment.", "narrative": "Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Linux environment.", "references": ["https://attack.mitre.org/techniques/T1053/", "https://kifarunix.com/scheduling-tasks-using-at-command-in-linux/", "https://gtfobins.github.io/gtfobins/at/", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"], "tags": {"name": "Linux Persistence Techniques", "analytic_story": "Linux Persistence Techniques", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1053.003", "mitre_attack_technique": "Cron", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT38", "Rocke"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1136.001", "mitre_attack_technique": "Local Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT3", "APT39", "APT41", "Dragonfly", "Fox Kitten", "Kimsuky", "Leafminer", "Magic Hound", "TeamTNT"]}, {"mitre_attack_id": "T1136", "mitre_attack_technique": "Create Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["Indrik Spider", "Sandworm Team"]}, {"mitre_attack_id": "T1053.002", "mitre_attack_technique": "At", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "BRONZE BUTLER", "Threat Group-3390"]}, {"mitre_attack_id": "T1222.002", "mitre_attack_technique": "Linux and Mac File and Directory Permissions Modification", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT32", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1222", "mitre_attack_technique": "File and Directory Permissions Modification", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1548.001", "mitre_attack_technique": "Setuid and Setgid", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1548", "mitre_attack_technique": "Abuse Elevation Control Mechanism", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1548.003", "mitre_attack_technique": "Sudo and Sudo Caching", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547.006", "mitre_attack_technique": "Kernel Modules and Extensions", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1037.004", "mitre_attack_technique": "RC Scripts", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1037", "mitre_attack_technique": "Boot or Logon Initialization Scripts", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Rocke"]}, {"mitre_attack_id": "T1546.004", "mitre_attack_technique": "Unix Shell Configuration Modification", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1546", "mitre_attack_technique": "Event Triggered Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1098.004", "mitre_attack_technique": "SSH Authorized Keys", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["Earth Lusca", "TeamTNT"]}, {"mitre_attack_id": "T1098", "mitre_attack_technique": "Account Manipulation", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT3", "Dragonfly", "Kimsuky", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1003.008", "mitre_attack_technique": "/etc/passwd and /etc/shadow", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1574.006", "mitre_attack_technique": "Dynamic Linker Hijacking", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT41", "Rocke"]}, {"mitre_attack_id": "T1574", "mitre_attack_technique": "Hijack Execution Flow", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1053.006", "mitre_attack_technique": "Systemd Timers", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1485", "mitre_attack_technique": "Data Destruction", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "Gamaredon Group", "LAPSUS$", "Lazarus Group", "Sandworm Team"]}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Execution", "Impact", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint", "Risk"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Linux Add Files In Known Crontab Directories - Rule", "ESCU - Linux Add User Account - Rule", "ESCU - Linux Adding Crontab Using List Parameter - Rule", "ESCU - Linux At Allow Config File Creation - Rule", "ESCU - Linux At Application Execution - Rule", "ESCU - Linux Change File Owner To Root - Rule", "ESCU - Linux Common Process For Elevation Control - Rule", "ESCU - Linux Doas Conf File Creation - Rule", "ESCU - Linux Doas Tool Execution - Rule", "ESCU - Linux Edit Cron Table Parameter - Rule", "ESCU - Linux File Created In Kernel Driver Directory - Rule", "ESCU - Linux File Creation In Init Boot Directory - Rule", "ESCU - Linux File Creation In Profile Directory - Rule", "ESCU - Linux Insert Kernel Module Using Insmod Utility - Rule", "ESCU - Linux Install Kernel Module Using Modprobe Utility - Rule", "ESCU - Linux NOPASSWD Entry In Sudoers File - Rule", "ESCU - Linux Persistence and Privilege Escalation Risk Behavior - Rule", "ESCU - Linux Possible Access Or Modification Of sshd Config File - Rule", "ESCU - Linux Possible Access To Credential Files - Rule", "ESCU - Linux Possible Access To Sudoers File - Rule", "ESCU - Linux Possible Append Command To At Allow Config File - Rule", "ESCU - Linux Possible Append Command To Profile Config File - Rule", "ESCU - Linux Possible Append Cronjob Entry on Existing Cronjob File - Rule", "ESCU - Linux Possible Cronjob Modification With Editor - Rule", "ESCU - Linux Possible Ssh Key File Creation - Rule", "ESCU - Linux Preload Hijack Library Calls - Rule", "ESCU - Linux Service File Created In Systemd Directory - Rule", "ESCU - Linux Service Restarted - Rule", "ESCU - Linux Service Started Or Enabled - Rule", "ESCU - Linux Setuid Using Chmod Utility - Rule", "ESCU - Linux Setuid Using Setcap Utility - Rule", "ESCU - Linux Shred Overwrite Command - Rule", "ESCU - Linux Sudo OR Su Execution - Rule", "ESCU - Linux Sudoers Tmp File Creation - Rule", "ESCU - Linux Visudo Utility Execution - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Linux Add Files In Known Crontab Directories", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cron"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Add User Account", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Local Account"}, {"mitre_attack_technique": "Create Account"}]}}, {"name": "Linux Adding Crontab Using List Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cron"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux At Allow Config File Creation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cron"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux At Application Execution", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "At"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Change File Owner To Root", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Linux and Mac File and Directory Permissions Modification"}, {"mitre_attack_technique": "File and Directory Permissions Modification"}]}}, {"name": "Linux Common Process For Elevation Control", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Setuid and Setgid"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Doas Conf File Creation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Doas Tool Execution", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Edit Cron Table Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cron"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux File Created In Kernel Driver Directory", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Kernel Modules and Extensions"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Linux File Creation In Init Boot Directory", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "RC Scripts"}, {"mitre_attack_technique": "Boot or Logon Initialization Scripts"}]}}, {"name": "Linux File Creation In Profile Directory", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Unix Shell Configuration Modification"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "Linux Insert Kernel Module Using Insmod Utility", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Kernel Modules and Extensions"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Linux Install Kernel Module Using Modprobe Utility", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Kernel Modules and Extensions"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Linux NOPASSWD Entry In Sudoers File", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Persistence and Privilege Escalation Risk Behavior", "source": "endpoint", "type": "Correlation", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Possible Access Or Modification Of sshd Config File", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "SSH Authorized Keys"}, {"mitre_attack_technique": "Account Manipulation"}]}}, {"name": "Linux Possible Access To Credential Files", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "/etc/passwd and /etc/shadow"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Linux Possible Access To Sudoers File", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Possible Append Command To At Allow Config File", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "At"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Possible Append Command To Profile Config File", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Unix Shell Configuration Modification"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "Linux Possible Append Cronjob Entry on Existing Cronjob File", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cron"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Possible Cronjob Modification With Editor", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cron"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Possible Ssh Key File Creation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "SSH Authorized Keys"}, {"mitre_attack_technique": "Account Manipulation"}]}}, {"name": "Linux Preload Hijack Library Calls", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Dynamic Linker Hijacking"}, {"mitre_attack_technique": "Hijack Execution Flow"}]}}, {"name": "Linux Service File Created In Systemd Directory", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Systemd Timers"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Service Restarted", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Systemd Timers"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Service Started Or Enabled", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Systemd Timers"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Setuid Using Chmod Utility", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Setuid and Setgid"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Setuid Using Setcap Utility", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Setuid and Setgid"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Shred Overwrite Command", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Linux Sudo OR Su Execution", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Sudoers Tmp File Creation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Visudo Utility Execution", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}]}, {"name": "Linux Post-Exploitation", "id": "d310ccfe-5477-11ec-ad05-acde48001122", "version": 1, "date": "2021-12-03", "author": "Rod Soto", "description": "This analytic story identifies popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin.", "narrative": "These tools allow operators find possible exploits or paths for privilege escalation based on SUID binaries, user permissions, kernel version and distro version.", "references": ["https://attack.mitre.org/matrices/enterprise/linux/"], "tags": {"name": "Linux Post-Exploitation", "analytic_story": "Linux Post-Exploitation", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059.004", "mitre_attack_technique": "Unix Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT41", "Rocke", "TeamTNT"]}], "mitre_attack_tactics": ["Execution"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Suspicious Linux Discovery Commands - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "no", "author_name": "Rod Soto", "detections": [{"name": "Suspicious Linux Discovery Commands", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Unix Shell"}]}}]}, {"name": "Linux Privilege Escalation", "id": "b9879c24-670a-44c0-895e-98cdb7d0e848", "version": 1, "date": "2021-12-17", "author": "Teoderick Contreras, Splunk", "description": "Monitor for and investigate activities that may be associated with a Linux privilege-escalation attack, including unusual processes running on endpoints, schedule task, services, setuid, root execution and more.", "narrative": "Privilege escalation is a \"land-and-expand\" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Linux machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment.", "references": ["https://attack.mitre.org/tactics/TA0004/"], "tags": {"name": "Linux Privilege Escalation", "analytic_story": "Linux Privilege Escalation", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1053.003", "mitre_attack_technique": "Cron", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT38", "Rocke"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1136.001", "mitre_attack_technique": "Local Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT3", "APT39", "APT41", "Dragonfly", "Fox Kitten", "Kimsuky", "Leafminer", "Magic Hound", "TeamTNT"]}, {"mitre_attack_id": "T1136", "mitre_attack_technique": "Create Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["Indrik Spider", "Sandworm Team"]}, {"mitre_attack_id": "T1548.003", "mitre_attack_technique": "Sudo and Sudo Caching", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1548", "mitre_attack_technique": "Abuse Elevation Control Mechanism", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1053.002", "mitre_attack_technique": "At", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "BRONZE BUTLER", "Threat Group-3390"]}, {"mitre_attack_id": "T1222.002", "mitre_attack_technique": "Linux and Mac File and Directory Permissions Modification", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT32", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1222", "mitre_attack_technique": "File and Directory Permissions Modification", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1548.001", "mitre_attack_technique": "Setuid and Setgid", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547.006", "mitre_attack_technique": "Kernel Modules and Extensions", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1037.004", "mitre_attack_technique": "RC Scripts", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1037", "mitre_attack_technique": "Boot or Logon Initialization Scripts", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Rocke"]}, {"mitre_attack_id": "T1546.004", "mitre_attack_technique": "Unix Shell Configuration Modification", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1546", "mitre_attack_technique": "Event Triggered Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1068", "mitre_attack_technique": "Exploitation for Privilege Escalation", "mitre_attack_tactics": ["Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT33", "BITTER", "Cobalt Group", "FIN6", "FIN8", "LAPSUS$", "PLATINUM", "Threat Group-3390", "Tonto Team", "Turla", "Whitefly", "ZIRCONIUM"]}, {"mitre_attack_id": "T1098.004", "mitre_attack_technique": "SSH Authorized Keys", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["Earth Lusca", "TeamTNT"]}, {"mitre_attack_id": "T1098", "mitre_attack_technique": "Account Manipulation", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT3", "Dragonfly", "Kimsuky", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1003.008", "mitre_attack_technique": "/etc/passwd and /etc/shadow", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1574.006", "mitre_attack_technique": "Dynamic Linker Hijacking", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT41", "Rocke"]}, {"mitre_attack_id": "T1574", "mitre_attack_technique": "Hijack Execution Flow", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1053.006", "mitre_attack_technique": "Systemd Timers", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1485", "mitre_attack_technique": "Data Destruction", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "Gamaredon Group", "LAPSUS$", "Lazarus Group", "Sandworm Team"]}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Execution", "Impact", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint", "Risk"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Linux Add Files In Known Crontab Directories - Rule", "ESCU - Linux Add User Account - Rule", "ESCU - Linux Adding Crontab Using List Parameter - Rule", "ESCU - Linux apt-get Privilege Escalation - Rule", "ESCU - Linux APT Privilege Escalation - Rule", "ESCU - Linux At Allow Config File Creation - Rule", "ESCU - Linux At Application Execution - Rule", "ESCU - Linux AWK Privilege Escalation - Rule", "ESCU - Linux Busybox Privilege Escalation - Rule", "ESCU - Linux c89 Privilege Escalation - Rule", "ESCU - Linux c99 Privilege Escalation - Rule", "ESCU - Linux Change File Owner To Root - Rule", "ESCU - Linux Common Process For Elevation Control - Rule", "ESCU - Linux Composer Privilege Escalation - Rule", "ESCU - Linux Cpulimit Privilege Escalation - Rule", "ESCU - Linux Csvtool Privilege Escalation - Rule", "ESCU - Linux Doas Conf File Creation - Rule", "ESCU - Linux Doas Tool Execution - Rule", "ESCU - Linux Docker Privilege Escalation - Rule", "ESCU - Linux Edit Cron Table Parameter - Rule", "ESCU - Linux Emacs Privilege Escalation - Rule", "ESCU - Linux File Created In Kernel Driver Directory - Rule", "ESCU - Linux File Creation In Init Boot Directory - Rule", "ESCU - Linux File Creation In Profile Directory - Rule", "ESCU - Linux Find Privilege Escalation - Rule", "ESCU - Linux GDB Privilege Escalation - Rule", "ESCU - Linux Gem Privilege Escalation - Rule", "ESCU - Linux GNU Awk Privilege Escalation - Rule", "ESCU - Linux Insert Kernel Module Using Insmod Utility - Rule", "ESCU - Linux Install Kernel Module Using Modprobe Utility - Rule", "ESCU - Linux Make Privilege Escalation - Rule", "ESCU - Linux MySQL Privilege Escalation - Rule", "ESCU - Linux Node Privilege Escalation - Rule", "ESCU - Linux NOPASSWD Entry In Sudoers File - Rule", "ESCU - Linux Octave Privilege Escalation - Rule", "ESCU - Linux OpenVPN Privilege Escalation - Rule", "ESCU - Linux Persistence and Privilege Escalation Risk Behavior - Rule", "ESCU - Linux PHP Privilege Escalation - Rule", "ESCU - Linux pkexec Privilege Escalation - Rule", "ESCU - Linux Possible Access Or Modification Of sshd Config File - Rule", "ESCU - Linux Possible Access To Credential Files - Rule", "ESCU - Linux Possible Access To Sudoers File - Rule", "ESCU - Linux Possible Append Command To At Allow Config File - Rule", "ESCU - Linux Possible Append Command To Profile Config File - Rule", "ESCU - Linux Possible Append Cronjob Entry on Existing Cronjob File - Rule", "ESCU - Linux Possible Cronjob Modification With Editor - Rule", "ESCU - Linux Possible Ssh Key File Creation - Rule", "ESCU - Linux Preload Hijack Library Calls - Rule", "ESCU - Linux Puppet Privilege Escalation - Rule", "ESCU - Linux RPM Privilege Escalation - Rule", "ESCU - Linux Ruby Privilege Escalation - Rule", "ESCU - Linux Service File Created In Systemd Directory - Rule", "ESCU - Linux Service Restarted - Rule", "ESCU - Linux Service Started Or Enabled - Rule", "ESCU - Linux Setuid Using Chmod Utility - Rule", "ESCU - Linux Setuid Using Setcap Utility - Rule", "ESCU - Linux Shred Overwrite Command - Rule", "ESCU - Linux Sqlite3 Privilege Escalation - Rule", "ESCU - Linux Sudo OR Su Execution - Rule", "ESCU - Linux Sudoers Tmp File Creation - Rule", "ESCU - Linux Visudo Utility Execution - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Linux Add Files In Known Crontab Directories", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cron"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Add User Account", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Local Account"}, {"mitre_attack_technique": "Create Account"}]}}, {"name": "Linux Adding Crontab Using List Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cron"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux apt-get Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux APT Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux At Allow Config File Creation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cron"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux At Application Execution", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "At"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux AWK Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Busybox Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux c89 Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux c99 Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Change File Owner To Root", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Linux and Mac File and Directory Permissions Modification"}, {"mitre_attack_technique": "File and Directory Permissions Modification"}]}}, {"name": "Linux Common Process For Elevation Control", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Setuid and Setgid"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Composer Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Cpulimit Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Csvtool Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Doas Conf File Creation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Doas Tool Execution", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Docker Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Edit Cron Table Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cron"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Emacs Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux File Created In Kernel Driver Directory", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Kernel Modules and Extensions"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Linux File Creation In Init Boot Directory", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "RC Scripts"}, {"mitre_attack_technique": "Boot or Logon Initialization Scripts"}]}}, {"name": "Linux File Creation In Profile Directory", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Unix Shell Configuration Modification"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "Linux Find Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux GDB Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Gem Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux GNU Awk Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Insert Kernel Module Using Insmod Utility", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Kernel Modules and Extensions"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Linux Install Kernel Module Using Modprobe Utility", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Kernel Modules and Extensions"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Linux Make Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux MySQL Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Node Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux NOPASSWD Entry In Sudoers File", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Octave Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux OpenVPN Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Persistence and Privilege Escalation Risk Behavior", "source": "endpoint", "type": "Correlation", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux PHP Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux pkexec Privilege Escalation", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation for Privilege Escalation"}]}}, {"name": "Linux Possible Access Or Modification Of sshd Config File", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "SSH Authorized Keys"}, {"mitre_attack_technique": "Account Manipulation"}]}}, {"name": "Linux Possible Access To Credential Files", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "/etc/passwd and /etc/shadow"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Linux Possible Access To Sudoers File", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Possible Append Command To At Allow Config File", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "At"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Possible Append Command To Profile Config File", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Unix Shell Configuration Modification"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "Linux Possible Append Cronjob Entry on Existing Cronjob File", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cron"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Possible Cronjob Modification With Editor", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cron"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Possible Ssh Key File Creation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "SSH Authorized Keys"}, {"mitre_attack_technique": "Account Manipulation"}]}}, {"name": "Linux Preload Hijack Library Calls", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Dynamic Linker Hijacking"}, {"mitre_attack_technique": "Hijack Execution Flow"}]}}, {"name": "Linux Puppet Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux RPM Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Ruby Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Service File Created In Systemd Directory", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Systemd Timers"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Service Restarted", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Systemd Timers"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Service Started Or Enabled", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Systemd Timers"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Linux Setuid Using Chmod Utility", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Setuid and Setgid"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Setuid Using Setcap Utility", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Setuid and Setgid"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Shred Overwrite Command", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Linux Sqlite3 Privilege Escalation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Sudo OR Su Execution", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Sudoers Tmp File Creation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Linux Visudo Utility Execution", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Sudo and Sudo Caching"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}]}, {"name": "Linux Rootkit", "id": "e30f4054-ac08-4999-b8bc-5cc46886c18d", "version": 1, "date": "2022-07-27", "author": "Michael Haag, Splunk", "description": "Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.", "narrative": "Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor, Master Boot Record, or System Firmware. Rootkits have been seen for Windows, Linux, and Mac OS X systems. Linux rootkits may not standout as much as a Windows rootkit, therefore understanding what kernel modules are installed today and monitoring for new is important. As with any rootkit, it may blend in using a common kernel name or variation of legitimate names.", "references": ["https://attack.mitre.org/techniques/T1014/", "https://content.fireeye.com/apt-41/rpt-apt41", "https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a"], "tags": {"name": "Linux Rootkit", "analytic_story": "Linux Rootkit", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1547.006", "mitre_attack_technique": "Kernel Modules and Extensions", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1082", "mitre_attack_technique": "System Information Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT18", "APT19", "APT29", "APT3", "APT32", "APT37", "APT38", "Aquatic Panda", "Blue Mockingbird", "Chimera", "Confucius", "Darkhotel", "Gamaredon Group", "HEXANE", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Sowbug", "Stealth Falcon", "TeamTNT", "Tropic Trooper", "Turla", "Windigo", "Windshift", "Wizard Spider", "ZIRCONIUM", "admin@338"]}, {"mitre_attack_id": "T1014", "mitre_attack_technique": "Rootkit", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT41", "Rocke", "TeamTNT", "Winnti Group"]}], "mitre_attack_tactics": ["Defense Evasion", "Discovery", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - Linux File Created In Kernel Driver Directory - Rule", "ESCU - Linux Insert Kernel Module Using Insmod Utility - Rule", "ESCU - Linux Install Kernel Module Using Modprobe Utility - Rule", "ESCU - Linux Kernel Module Enumeration - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Linux File Created In Kernel Driver Directory", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Kernel Modules and Extensions"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Linux Insert Kernel Module Using Insmod Utility", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Kernel Modules and Extensions"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Linux Install Kernel Module Using Modprobe Utility", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Kernel Modules and Extensions"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Linux Kernel Module Enumeration", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Information Discovery"}, {"mitre_attack_technique": "Rootkit"}]}}]}, {"name": "Living Off The Land", "id": "6f7982e2-900b-11ec-a54a-acde48001122", "version": 2, "date": "2022-03-16", "author": "Lou Stella, Splunk", "description": "Leverage analytics that allow you to identify the presence of an adversary leveraging native applications within your environment.", "narrative": "Living Off The Land refers to an adversary methodology of using native applications already installed on the target operating system to achieve their objective. Native utilities provide the adversary with reduced chances of detection by antivirus software or EDR tools. This allows the adversary to blend in with native process behavior.", "references": ["https://lolbas-project.github.io/"], "tags": {"name": "Living Off The Land", "analytic_story": "Living Off The Land", "category": ["Adversary Tactics", "Unauthorized Software", "Lateral Movement", "Privilege Escalation"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1197", "mitre_attack_technique": "BITS Jobs", "mitre_attack_tactics": ["Defense Evasion", "Persistence"], "mitre_attack_groups": ["APT39", "APT41", "Leviathan", "Patchwork"]}, {"mitre_attack_id": "T1105", "mitre_attack_technique": "Ingress Tool Transfer", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "Chimera", "Cobalt Group", "Confucius", "Darkhotel", "Dragonfly", "Elderwood", "Ember Bear", "Evilnum", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "IndigoZebra", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "Rancor", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Turla", "Volatile Cedar", "WIRTE", "Whitefly", "Windshift", "Winnti Group", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1140", "mitre_attack_technique": "Deobfuscate/Decode Files or Information", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT39", "BRONZE BUTLER", "Darkhotel", "Earth Lusca", "Gamaredon Group", "Gorgon Group", "Higaisa", "Ke3chang", "Kimsuky", "Lazarus Group", "Leviathan", "Molerats", "MuddyWater", "OilRig", "Rocke", "Sandworm Team", "TA505", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "WIRTE", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.002", "mitre_attack_technique": "Control Panel", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Ember Bear"]}, {"mitre_attack_id": "T1003.003", "mitre_attack_technique": "NTDS", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "Chimera", "Dragonfly", "FIN6", "Fox Kitten", "HAFNIUM", "Ke3chang", "LAPSUS$", "Mustang Panda", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1218.001", "mitre_attack_technique": "Compiled HTML File", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT38", "APT41", "Dark Caracal", "OilRig", "Silence"]}, {"mitre_attack_id": "T1218.005", "mitre_attack_technique": "Mshta", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "APT32", "Confucius", "Earth Lusca", "FIN7", "Gamaredon Group", "Inception", "Kimsuky", "Lazarus Group", "LazyScripter", "MuddyWater", "Mustang Panda", "SideCopy", "Sidewinder", "TA551"]}, {"mitre_attack_id": "T1218.009", "mitre_attack_technique": "Regsvcs/Regasm", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1218.010", "mitre_attack_technique": "Regsvr32", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "Blue Mockingbird", "Cobalt Group", "Deep Panda", "Inception", "Kimsuky", "Lazarus Group", "Leviathan", "TA551", "WIRTE"]}, {"mitre_attack_id": "T1218.011", "mitre_attack_technique": "Rundll32", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "CopyKittens", "Gamaredon Group", "HAFNIUM", "Kimsuky", "Lazarus Group", "LazyScripter", "Magic Hound", "MuddyWater", "Sandworm Team", "TA505", "TA551"]}, {"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1003.001", "mitre_attack_technique": "LSASS Memory", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT1", "APT28", "APT3", "APT32", "APT33", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Cleaver", "Earth Lusca", "FIN6", "FIN8", "Fox Kitten", "GALLIUM", "HAFNIUM", "Indrik Spider", "Ke3chang", "Kimsuky", "Leafminer", "Leviathan", "Magic Hound", "MuddyWater", "OilRig", "PLATINUM", "Sandworm Team", "Silence", "TEMP.Veles", "Threat Group-3390", "Whitefly"]}, {"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1548.002", "mitre_attack_technique": "Bypass User Account Control", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT29", "APT37", "BRONZE BUTLER", "Cobalt Group", "Earth Lusca", "Evilnum", "MuddyWater", "Patchwork", "Threat Group-3390"]}, {"mitre_attack_id": "T1548", "mitre_attack_technique": "Abuse Elevation Control Mechanism", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}, {"mitre_attack_id": "T1567", "mitre_attack_technique": "Exfiltration Over Web Service", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["APT28"]}, {"mitre_attack_id": "T1059.004", "mitre_attack_technique": "Unix Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT41", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1647", "mitre_attack_technique": "Plist File Modification", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021.003", "mitre_attack_technique": "Distributed Component Object Model", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1218.014", "mitre_attack_technique": "MMC", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1574.011", "mitre_attack_technique": "Services Registry Permissions Weakness", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1574", "mitre_attack_technique": "Hijack Execution Flow", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1047", "mitre_attack_technique": "Windows Management Instrumentation", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT29", "APT32", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "Earth Lusca", "FIN6", "FIN7", "FIN8", "GALLIUM", "Gamaredon Group", "Indrik Spider", "Lazarus Group", "Leviathan", "Magic Hound", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "Stealth Falcon", "Threat Group-3390", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1055", "mitre_attack_technique": "Process Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT32", "APT37", "APT41", "Cobalt Group", "Kimsuky", "PLATINUM", "Silence", "Turla"]}, {"mitre_attack_id": "T1112", "mitre_attack_technique": "Modify Registry", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "APT38", "APT41", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN8", "Gamaredon Group", "Gorgon Group", "Kimsuky", "Magic Hound", "Patchwork", "Silence", "TA505", "Threat Group-3390", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1053.002", "mitre_attack_technique": "At", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "BRONZE BUTLER", "Threat Group-3390"]}, {"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1127", "mitre_attack_technique": "Trusted Developer Utilities Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1036.003", "mitre_attack_technique": "Rename System Utilities", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT32", "GALLIUM", "Lazarus Group", "menuPass"]}, {"mitre_attack_id": "T1127.001", "mitre_attack_technique": "MSBuild", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1218.013", "mitre_attack_technique": "Mavinject", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1546.015", "mitre_attack_technique": "Component Object Model Hijacking", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28"]}, {"mitre_attack_id": "T1546", "mitre_attack_technique": "Event Triggered Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1574.001", "mitre_attack_technique": "DLL Search Order Hijacking", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT41", "Aquatic Panda", "BackdoorDiplomacy", "Evilnum", "RTM", "Threat Group-3390", "Tonto Team", "Whitefly", "menuPass"]}, {"mitre_attack_id": "T1202", "mitre_attack_technique": "Indirect Command Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.004", "mitre_attack_technique": "InstallUtil", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Mustang Panda", "menuPass"]}, {"mitre_attack_id": "T1546.003", "mitre_attack_technique": "Windows Management Instrumentation Event Subscription", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT29", "APT33", "Blue Mockingbird", "FIN8", "Leviathan", "Mustang Panda", "Turla"]}, {"mitre_attack_id": "T1218.008", "mitre_attack_technique": "Odbcconf", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Cobalt Group"]}, {"mitre_attack_id": "T1216", "mitre_attack_technique": "System Script Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Command And Control", "Credential Access", "Defense Evasion", "Execution", "Exfiltration", "Initial Access", "Lateral Movement", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint", "Network_Traffic", "Risk"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Delivery", "Exploitation", "Installation", "Reconnaissance"]}, "detection_names": ["ESCU - BITS Job Persistence - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - CertUtil With Decode Argument - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Control Loading from World Writable Directory - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Detect Regasm with Network Connection - Rule", "ESCU - Detect Regasm with no Command Line Arguments - Rule", "ESCU - Detect Regsvcs Spawning a Process - Rule", "ESCU - Detect Regsvcs with Network Connection - Rule", "ESCU - Detect Regsvcs with No Command Line Arguments - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Living Off The Land - Rule", "ESCU - LOLBAS With Network Traffic - Rule", "ESCU - MacOS LOLbin - Rule", "ESCU - MacOS plutil - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - Rundll32 Shimcache Flush - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious microsoft workflow compiler usage - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Windows Binary Proxy Execution Mavinject DLL Injection - Rule", "ESCU - Windows COM Hijacking InprocServer32 Modification - Rule", "ESCU - Windows Diskshadow Proxy Execution - Rule", "ESCU - Windows DLL Search Order Hijacking Hunt - Rule", "ESCU - Windows DLL Search Order Hijacking Hunt with Sysmon - Rule", "ESCU - Windows DLL Search Order Hijacking with iscsicpl - Rule", "ESCU - Windows Identify Protocol Handlers - Rule", "ESCU - Windows Indirect Command Execution Via forfiles - Rule", "ESCU - Windows Indirect Command Execution Via pcalua - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows InstallUtil Remote Network Connection - Rule", "ESCU - Windows InstallUtil Uninstall Option - Rule", "ESCU - Windows InstallUtil Uninstall Option with Network - Rule", "ESCU - Windows InstallUtil URL in Command Line - Rule", "ESCU - Windows MOF Event Triggered Execution via WMI - Rule", "ESCU - Windows Odbcconf Hunting - Rule", "ESCU - Windows Odbcconf Load DLL - Rule", "ESCU - Windows Odbcconf Load Response File - Rule", "ESCU - Windows System Binary Proxy Execution Compiled HTML File Decompile - Rule", "ESCU - Windows System Script Proxy Execution Syncappvpublishingserver - Rule", "ESCU - WSReset UAC Bypass - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Lou Stella", "detections": [{"name": "BITS Job Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "BITS Jobs"}]}}, {"name": "BITSAdmin Download File", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "BITS Jobs"}, {"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "CertUtil Download With URLCache and Split Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "CertUtil Download With VerifyCtl and Split Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Certutil exe certificate extraction", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}, {"name": "CertUtil With Decode Argument", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Deobfuscate/Decode Files or Information"}]}}, {"name": "CMD Carry Out String Command Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Command Shell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Control Loading from World Writable Directory", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Control Panel"}]}}, {"name": "Creation of Shadow Copy with wmic and powershell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "NTDS"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Detect HTML Help Renamed", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Compiled HTML File"}]}}, {"name": "Detect HTML Help Spawn Child Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Compiled HTML File"}]}}, {"name": "Detect HTML Help URL in Command Line", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Compiled HTML File"}]}}, {"name": "Detect HTML Help Using InfoTech Storage Handlers", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Compiled HTML File"}]}}, {"name": "Detect mshta inline hta execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Mshta"}]}}, {"name": "Detect mshta renamed", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Mshta"}]}}, {"name": "Detect MSHTA Url in Command Line", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Mshta"}]}}, {"name": "Detect Regasm Spawning a Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvcs/Regasm"}]}}, {"name": "Detect Regasm with Network Connection", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvcs/Regasm"}]}}, {"name": "Detect Regasm with no Command Line Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvcs/Regasm"}]}}, {"name": "Detect Regsvcs Spawning a Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvcs/Regasm"}]}}, {"name": "Detect Regsvcs with Network Connection", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvcs/Regasm"}]}}, {"name": "Detect Regsvcs with No Command Line Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvcs/Regasm"}]}}, {"name": "Detect Regsvr32 Application Control Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvr32"}]}}, {"name": "Detect Rundll32 Application Control Bypass - advpack", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Detect Rundll32 Application Control Bypass - setupapi", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Detect Rundll32 Application Control Bypass - syssetup", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Detect Rundll32 Inline HTA Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Mshta"}]}}, {"name": "Disable Schedule Task", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Dump LSASS via comsvcs DLL", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Esentutl SAM Copy", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Eventvwr UAC Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Living Off The Land", "source": "endpoint", "type": "Correlation", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}, {"mitre_attack_technique": "Exploit Public-Facing Application"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "LOLBAS With Network Traffic", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}, {"mitre_attack_technique": "Exfiltration Over Web Service"}, {"mitre_attack_technique": "System Binary Proxy Execution"}]}}, {"name": "MacOS LOLbin", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Unix Shell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "MacOS plutil", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Plist File Modification"}]}}, {"name": "Mmc LOLBAS Execution Process Spawn", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "Distributed Component Object Model"}, {"mitre_attack_technique": "MMC"}]}}, {"name": "Mshta spawning Rundll32 OR Regsvr32 Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Mshta"}]}}, {"name": "Ntdsutil Export NTDS", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "NTDS"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Reg exe Manipulating Windows Services Registry Keys", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Services Registry Permissions Weakness"}, {"mitre_attack_technique": "Hijack Execution Flow"}]}}, {"name": "Regsvr32 Silent and Install Param Dll Loading", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvr32"}]}}, {"name": "Regsvr32 with Known Silent Switch Cmdline", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvr32"}]}}, {"name": "Remote WMI Command Attempt", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation"}]}}, {"name": "Rundll32 Control RunDLL Hunt", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Rundll32 Control RunDLL World Writable Directory", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Rundll32 Create Remote Thread To A Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Rundll32 CreateRemoteThread In Browser", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Rundll32 DNSQuery", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Rundll32 Process Creating Exe Dll Files", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Rundll32 Shimcache Flush", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "RunDLL Loading DLL By Ordinal", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Schedule Task with HTTP Command Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Schedule Task with Rundll32 Command Trigger", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Scheduled Task Creation on Remote Endpoint using At", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}, {"mitre_attack_technique": "At"}]}}, {"name": "Scheduled Task Deleted Or Created via CMD", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Scheduled Task Initiation on Remote Endpoint", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}, {"mitre_attack_technique": "Scheduled Task"}]}}, {"name": "Schtasks scheduling job on remote system", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Services LOLBAS Execution Process Spawn", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}, {"mitre_attack_technique": "Windows Service"}]}}, {"name": "Suspicious IcedID Rundll32 Cmdline", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Suspicious microsoft workflow compiler rename", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}, {"mitre_attack_technique": "Rename System Utilities"}]}}, {"name": "Suspicious microsoft workflow compiler usage", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}]}}, {"name": "Suspicious msbuild path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}, {"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "MSBuild"}]}}, {"name": "Suspicious MSBuild Rename", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}, {"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "MSBuild"}]}}, {"name": "Suspicious MSBuild Spawn", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}, {"mitre_attack_technique": "MSBuild"}]}}, {"name": "Suspicious mshta child process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Mshta"}]}}, {"name": "Suspicious mshta spawn", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Mshta"}]}}, {"name": "Suspicious Regsvr32 Register Suspicious Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvr32"}]}}, {"name": "Suspicious Rundll32 dllregisterserver", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Suspicious Scheduled Task from Public Directory", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Svchost LOLBAS Execution Process Spawn", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}, {"mitre_attack_technique": "Scheduled Task"}]}}, {"name": "Windows Binary Proxy Execution Mavinject DLL Injection", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Mavinject"}, {"mitre_attack_technique": "System Binary Proxy Execution"}]}}, {"name": "Windows COM Hijacking InprocServer32 Modification", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Component Object Model Hijacking"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "Windows Diskshadow Proxy Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}]}}, {"name": "Windows DLL Search Order Hijacking Hunt", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DLL Search Order Hijacking"}, {"mitre_attack_technique": "Hijack Execution Flow"}]}}, {"name": "Windows DLL Search Order Hijacking Hunt with Sysmon", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DLL Search Order Hijacking"}, {"mitre_attack_technique": "Hijack Execution Flow"}]}}, {"name": "Windows DLL Search Order Hijacking with iscsicpl", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DLL Search Order Hijacking"}]}}, {"name": "Windows Identify Protocol Handlers", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Windows Indirect Command Execution Via forfiles", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indirect Command Execution"}]}}, {"name": "Windows Indirect Command Execution Via pcalua", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indirect Command Execution"}]}}, {"name": "Windows InstallUtil in Non Standard Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "InstallUtil"}]}}, {"name": "Windows InstallUtil Remote Network Connection", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "InstallUtil"}, {"mitre_attack_technique": "System Binary Proxy Execution"}]}}, {"name": "Windows InstallUtil Uninstall Option", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "InstallUtil"}, {"mitre_attack_technique": "System Binary Proxy Execution"}]}}, {"name": "Windows InstallUtil Uninstall Option with Network", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "InstallUtil"}, {"mitre_attack_technique": "System Binary Proxy Execution"}]}}, {"name": "Windows InstallUtil URL in Command Line", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "InstallUtil"}, {"mitre_attack_technique": "System Binary Proxy Execution"}]}}, {"name": "Windows MOF Event Triggered Execution via WMI", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation Event Subscription"}]}}, {"name": "Windows Odbcconf Hunting", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Odbcconf"}]}}, {"name": "Windows Odbcconf Load DLL", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Odbcconf"}]}}, {"name": "Windows Odbcconf Load Response File", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Odbcconf"}]}}, {"name": "Windows System Binary Proxy Execution Compiled HTML File Decompile", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compiled HTML File"}, {"mitre_attack_technique": "System Binary Proxy Execution"}]}}, {"name": "Windows System Script Proxy Execution Syncappvpublishingserver", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Script Proxy Execution"}, {"mitre_attack_technique": "System Binary Proxy Execution"}]}}, {"name": "WSReset UAC Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}]}, {"name": "Local Privilege Escalation With KrbRelayUp", "id": "765790f0-2f8f-4048-8321-fd1928ec2546", "version": 1, "date": "2022-04-28", "author": "Michael Haag, Mauricio Velazco, Splunk", "description": "KrbRelayUp is a tool that allows local privilege escalation from low-priviliged domain user to local system on domain-joined computers.", "narrative": "In October 2021, James Forshaw from Googles Project Zero released a research  blog post titled `Using Kerberos for Authentication Relay Attacks`. This research introduced, for the first time, ways to make Windows authenticate to a different Service Principal Name (SPN) than what would normally be derived from the hostname the client is connecting to. This effectively proved that relaying Kerberos authentication is possible\\\\. In April 2022, security researcher Mor Davidovich released a tool named KrbRelayUp which implements Kerberos relaying as well as other known Kerberos techniques with the goal of escalating privileges from a low-privileged domain user on a domain-joined device and obtain a SYSTEM shell.", "references": ["https://github.com/Dec0ne/KrbRelayUp", "https://gist.github.com/tothi/bf6c59d6de5d0c9710f23dae5750c4b9", "https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html", "https://dirkjanm.io/relaying-kerberos-over-dns-with-krbrelayx-and-mitm6/", "https://github.com/cube0x0/KrbRelay"], "tags": {"name": "Local Privilege Escalation With KrbRelayUp", "analytic_story": "Local Privilege Escalation With KrbRelayUp", "category": ["Privilege Escalation"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1558", "mitre_attack_technique": "Steal or Forge Kerberos Tickets", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}], "mitre_attack_tactics": ["Credential Access", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation"]}, "detection_names": ["ESCU - Windows Computer Account Created by Computer Account - Rule", "ESCU - Windows Computer Account Requesting Kerberos Ticket - Rule", "ESCU - Windows Computer Account With SPN - Rule", "ESCU - Windows Kerberos Local Successful Logon - Rule", "ESCU - Windows KrbRelayUp Service Creation - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Mauricio Velazco, Splunk", "author_name": "Michael Haag", "detections": [{"name": "Windows Computer Account Created by Computer Account", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}]}}, {"name": "Windows Computer Account Requesting Kerberos Ticket", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}]}}, {"name": "Windows Computer Account With SPN", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}]}}, {"name": "Windows Kerberos Local Successful Logon", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}]}}, {"name": "Windows KrbRelayUp Service Creation", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Service"}]}}]}, {"name": "Log4Shell CVE-2021-44228", "id": "b4453928-5a98-11ec-afcd-8de10b48fc52", "version": 1, "date": "2021-12-11", "author": "Jose Hernandez", "description": "Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition.", "narrative": "In late November 2021, Chen Zhaojun of Alibaba identified a remote code execution vulnerability. Previous work was seen in a 2016 Blackhat talk by Alvaro Munoz and Oleksandr Mirosh called [\"A Journey from JNDI/LDAP Manipulation to Remote Code Execution Dream Land\"](https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf). Reported under the CVE ID : CVE-2021-44228, released to the public on December 10, 2021. The vulnerability is exploited through improper deserialization of user input passed into the framework. It permits remote code execution and it can allow an attacker to leak sensitive data, such as environment variables, or execute malicious software on the target system.", "references": ["https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injection/", "https://www.fastly.com/blog/digging-deeper-into-log4shell-0day-rce-exploit-found-in-log4j", "https://www.crowdstrike.com/blog/log4j2-vulnerability-analysis-and-mitigation-recommendations/", "https://www.lunasec.io/docs/blog/log4j-zero-day/", "https://www.splunk.com/en_us/blog/security/log-jammin-log4j-2-rce.html"], "tags": {"name": "Log4Shell CVE-2021-44228", "analytic_story": "Log4Shell CVE-2021-44228", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Application Security", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1105", "mitre_attack_technique": "Ingress Tool Transfer", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "Chimera", "Cobalt Group", "Confucius", "Darkhotel", "Dragonfly", "Elderwood", "Ember Bear", "Evilnum", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "IndigoZebra", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "Rancor", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Turla", "Volatile Cedar", "WIRTE", "Whitefly", "Windshift", "Winnti Group", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}], "mitre_attack_tactics": ["Command And Control", "Execution", "Initial Access"], "datamodels": ["Endpoint", "Network_Traffic", "Risk", "Web"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Curl Download and Bash Execution - Rule", "ESCU - Hunting for Log4Shell - Rule", "ESCU - Java Class File download by Java User Agent - Rule", "ESCU - Linux Java Spawning Shell - Rule", "ESCU - Log4Shell CVE-2021-44228 Exploitation - Rule", "ESCU - Outbound Network Connection from Java Using Default Ports - Rule", "ESCU - PowerShell - Connect To Internet With Hidden Window - Rule", "ESCU - Wget Download and Bash Execution - Rule", "ESCU - Windows Java Spawning Shells - Rule", "ESCU - Detect Outbound LDAP Traffic - Rule", "ESCU - Log4Shell JNDI Payload Injection Attempt - Rule", "ESCU - Log4Shell JNDI Payload Injection with Outbound Connection - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "no", "author_name": "Jose Hernandez", "detections": [{"name": "Any Powershell DownloadFile", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "CMD Carry Out String Command Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Command Shell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Curl Download and Bash Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Hunting for Log4Shell", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Java Class File download by Java User Agent", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Linux Java Spawning Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Log4Shell CVE-2021-44228 Exploitation", "source": "endpoint", "type": "Correlation", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}, {"mitre_attack_technique": "Exploit Public-Facing Application"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Outbound Network Connection from Java Using Default Ports", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "PowerShell - Connect To Internet With Hidden Window", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Wget Download and Bash Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Windows Java Spawning Shells", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Detect Outbound LDAP Traffic", "source": "network", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Log4Shell JNDI Payload Injection Attempt", "source": "web", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Log4Shell JNDI Payload Injection with Outbound Connection", "source": "web", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}]}, {"name": "Malicious PowerShell", "id": "2c8ff66e-0b57-42af-8ad7-912438a403fc", "version": 5, "date": "2017-08-23", "author": "David Dorsey, Splunk", "description": "Attackers are finding stealthy ways \"live off the land,\" leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.", "narrative": "The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope. \\\nThe following factors may assist you in determining whether the event is malicious: \\\n1. Country of origin \\\n1. Responsible party \\\n1. Fully qualified domain names associated with the external IP address \\\n1. Registration of fully qualified domain names associated with external IP address \\\nDetermining whether it is a dynamic domain frequently visited by others and/or how third parties categorize it can also help you answer some questions surrounding the attacker and details related to the external system. In addition, there are various sources--such as VirusTotal&#151; that can provide some reputation information on the IP address or domain name, which can assist in determining whether the event is malicious. Finally, determining whether there are other events associated with the IP address may help connect data points or show other events that should be brought into scope. \\\nGathering data on the system of interest can sometimes help you quickly determine whether something suspicious is happening. Some of these items include finding out who else may have recently logged into the system, whether any unusual scheduled tasks exist, whether the system is communicating on suspicious ports, whether there are modifications to sensitive registry keys, and whether there are any known vulnerabilities on the system. This information can often highlight other activity commonly seen in attack scenarios or give more information about how the system may have been targeted. \\\nOften, a simple inspection of the process name and path can tell you if the system has been compromised. For example, if `svchost.exe` is found running from a location other than `C:\\Windows\\System32`, it is likely something malicious designed to hide in plain sight when cursorily reviewing process names. Similarly, if the process itself seems legitimate, but the parent process is running from the temporary browser cache, that could be indicative of activity initiated via a compromised website a user visited. \\\nIt can also be very helpful to examine various behaviors of the process of interest or the parent of the process of interest. For example, if it turns out the process of interest is malicious, it would be good to see if the parent to that process spawned other processes that might be worth further scrutiny. If a process is suspect, a review of the network connections made in and around the time of the event and/or whether the process spawned any child processes could be helpful, as well. \\\nIn the event a system is suspected of having been compromised via a malicious website, we suggest reviewing the browsing activity from that system around the time of the event. If categories are given for the URLs visited, that can help you zero in on possible malicious sites. \\\nMost recently we have added new content related to PowerShell Script Block logging, Windows EventCode 4104. Script block logging presents the deobfuscated and raw script executed on an endpoint. The analytics produced were tested against commonly used attack frameworks - PowerShell-Empire, Cobalt Strike and Covenant. In addition, we sampled publicly available samples that utilize PowerShell and validated coverage. The analytics are here to identify suspicious usage, cmdlets, or script values. 4104 events are enabled via the Windows registry and may generate a large volume of data if enabled globally. Enabling on critical systems or a limited set may be best. During triage of 4104 events, review parallel processes for other processes and command executed. Identify any file modifications and network communication and review accordingly. Fortunately, we get the full script to determine the level of threat identified.", "references": ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"], "tags": {"name": "Malicious PowerShell", "analytic_story": "Malicious PowerShell", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1105", "mitre_attack_technique": "Ingress Tool Transfer", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "Chimera", "Cobalt Group", "Confucius", "Darkhotel", "Dragonfly", "Elderwood", "Ember Bear", "Evilnum", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "IndigoZebra", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "Rancor", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Turla", "Volatile Cedar", "WIRTE", "Whitefly", "Windshift", "Winnti Group", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1087", "mitre_attack_technique": "Account Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29"]}, {"mitre_attack_id": "T1087.001", "mitre_attack_technique": "Local Account", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT1", "APT3", "APT32", "Chimera", "Fox Kitten", "Ke3chang", "Moses Staff", "OilRig", "Poseidon Group", "Threat Group-3390", "Turla", "admin@338"]}, {"mitre_attack_id": "T1027", "mitre_attack_technique": "Obfuscated Files or Information", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "Aquatic Panda", "BITTER", "BackdoorDiplomacy", "BlackOasis", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Earth Lusca", "Elderwood", "Ember Bear", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Group5", "HEXANE", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leafminer", "Leviathan", "Magic Hound", "Mofang", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Putter Panda", "Rocke", "Sandworm Team", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Transparent Tribe", "Tropic Trooper", "Turla", "Whitefly", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021.003", "mitre_attack_technique": "Distributed Component Object Model", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021.006", "mitre_attack_technique": "Windows Remote Management", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT29", "Chimera", "Threat Group-3390", "Wizard Spider"]}, {"mitre_attack_id": "T1047", "mitre_attack_technique": "Windows Management Instrumentation", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT29", "APT32", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "Earth Lusca", "FIN6", "FIN7", "FIN8", "GALLIUM", "Gamaredon Group", "Indrik Spider", "Lazarus Group", "Leviathan", "Magic Hound", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "Stealth Falcon", "Threat Group-3390", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1218.014", "mitre_attack_technique": "MMC", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1546.015", "mitre_attack_technique": "Component Object Model Hijacking", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28"]}, {"mitre_attack_id": "T1027.005", "mitre_attack_technique": "Indicator Removal from Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT3", "Deep Panda", "GALLIUM", "OilRig", "Patchwork", "TEMP.Veles", "Turla"]}, {"mitre_attack_id": "T1546", "mitre_attack_technique": "Event Triggered Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1055", "mitre_attack_technique": "Process Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT32", "APT37", "APT41", "Cobalt Group", "Kimsuky", "PLATINUM", "Silence", "Turla"]}, {"mitre_attack_id": "T1592", "mitre_attack_technique": "Gather Victim Host Information", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1558.003", "mitre_attack_technique": "Kerberoasting", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "FIN7", "Wizard Spider"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}], "mitre_attack_tactics": ["Command And Control", "Credential Access", "Defense Evasion", "Discovery", "Execution", "Lateral Movement", "Persistence", "Privilege Escalation", "Reconnaissance"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Exploitation", "Installation", "Reconnaissance"]}, "detection_names": ["ESCU - Suspicious Powershell Command-Line Arguments - Rule", "ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - GetLocalUser with PowerShell Script Block - Rule", "ESCU - GetWmiObject User Account with PowerShell Script Block - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Possible Lateral Movement PowerShell Spawn - Rule", "ESCU - PowerShell 4104 Hunting - Rule", "ESCU - PowerShell - Connect To Internet With Hidden Window - Rule", "ESCU - Powershell COM Hijacking InprocServer32 Modification - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - PowerShell Loading DotNET into Memory via Reflection - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - ServicePrincipalNames Discovery with PowerShell - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule"], "investigation_names": ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "David Dorsey", "detections": [{"name": "Suspicious Powershell Command-Line Arguments", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "PowerShell"}]}}, {"name": "Any Powershell DownloadFile", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Any Powershell DownloadString", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Detect Empire with PowerShell Script Block Logging", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Detect Mimikatz With PowerShell Script Block Logging", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "OS Credential Dumping"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "GetLocalUser with PowerShell Script Block", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Discovery"}, {"mitre_attack_technique": "Local Account"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "GetWmiObject User Account with PowerShell Script Block", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Discovery"}, {"mitre_attack_technique": "Local Account"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Malicious PowerShell Process - Encoded Command", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Obfuscated Files or Information"}]}}, {"name": "Malicious PowerShell Process With Obfuscation Techniques", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Possible Lateral Movement PowerShell Spawn", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "Distributed Component Object Model"}, {"mitre_attack_technique": "Windows Remote Management"}, {"mitre_attack_technique": "Windows Management Instrumentation"}, {"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Windows Service"}, {"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "MMC"}]}}, {"name": "PowerShell 4104 Hunting", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "PowerShell - Connect To Internet With Hidden Window", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Powershell COM Hijacking InprocServer32 Modification", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Component Object Model Hijacking"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Powershell Creating Thread Mutex", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Obfuscated Files or Information"}, {"mitre_attack_technique": "Indicator Removal from Tools"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "PowerShell Domain Enumeration", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Powershell Enable SMB1Protocol Feature", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Obfuscated Files or Information"}, {"mitre_attack_technique": "Indicator Removal from Tools"}]}}, {"name": "Powershell Execute COM Object", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Component Object Model Hijacking"}, {"mitre_attack_technique": "Event Triggered Execution"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Powershell Fileless Process Injection via GetProcAddress", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "Process Injection"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Powershell Fileless Script Contains Base64 Encoded Content", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "Obfuscated Files or Information"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "PowerShell Loading DotNET into Memory via Reflection", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Powershell Processing Stream Of Data", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Powershell Using memory As Backing Store", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Recon AVProduct Through Pwh or WMI", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Gather Victim Host Information"}]}}, {"name": "Recon Using WMI Class", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Gather Victim Host Information"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "ServicePrincipalNames Discovery with PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Kerberoasting"}]}}, {"name": "Set Default PowerShell Execution Policy To Unrestricted or Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Unloading AMSI via Reflection", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Impair Defenses"}, {"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "WMI Recon Running Process Or Services", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Gather Victim Host Information"}]}}]}, {"name": "Masquerading - Rename System Utilities", "id": "f0258af4-a6ae-11eb-b3c2-acde48001122", "version": 1, "date": "2021-04-26", "author": "Michael Haag, Splunk", "description": "Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities.", "narrative": "Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths.\\\nThe following content is here to assist with binaries within `system32` or `syswow64` being moved to a new location or an adversary bringing a the binary in to execute.\\\nThere will be false positives as some native Windows processes are moved or ran by third party applications from different paths. If file names are mismatched between the file name on disk and that of the binarys PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.", "references": ["https://attack.mitre.org/techniques/T1036/003/"], "tags": {"name": "Masquerading - Rename System Utilities", "analytic_story": "Masquerading - Rename System Utilities", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1036.003", "mitre_attack_technique": "Rename System Utilities", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT32", "GALLIUM", "Lazarus Group", "menuPass"]}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1218.011", "mitre_attack_technique": "Rundll32", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "CopyKittens", "Gamaredon Group", "HAFNIUM", "Kimsuky", "Lazarus Group", "LazyScripter", "Magic Hound", "MuddyWater", "Sandworm Team", "TA505", "TA551"]}, {"mitre_attack_id": "T1485", "mitre_attack_technique": "Data Destruction", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "Gamaredon Group", "LAPSUS$", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1070.004", "mitre_attack_technique": "File Deletion", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT3", "APT32", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Chimera", "Cobalt Group", "Dragonfly", "Evilnum", "FIN10", "FIN5", "FIN6", "FIN8", "Gamaredon Group", "Group5", "Kimsuky", "Lazarus Group", "Magic Hound", "Mustang Panda", "OilRig", "Patchwork", "Rocke", "Sandworm Team", "Silence", "TEMP.Veles", "TeamTNT", "The White Company", "Threat Group-3390", "Tropic Trooper", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1070", "mitre_attack_technique": "Indicator Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Lazarus Group"]}, {"mitre_attack_id": "T1127", "mitre_attack_technique": "Trusted Developer Utilities Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1127.001", "mitre_attack_technique": "MSBuild", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1218.004", "mitre_attack_technique": "InstallUtil", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Mustang Panda", "menuPass"]}], "mitre_attack_tactics": ["Defense Evasion", "Impact"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Sdelete Application Execution - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Execution of File With Spaces Before Extension", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Rename System Utilities"}]}}, {"name": "Suspicious Rundll32 Rename", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rundll32"}, {"mitre_attack_technique": "Rename System Utilities"}]}}, {"name": "Execution of File with Multiple Extensions", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rename System Utilities"}]}}, {"name": "Sdelete Application Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}, {"mitre_attack_technique": "File Deletion"}, {"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "Suspicious microsoft workflow compiler rename", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}, {"mitre_attack_technique": "Rename System Utilities"}]}}, {"name": "Suspicious msbuild path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}, {"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "MSBuild"}]}}, {"name": "Suspicious MSBuild Rename", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}, {"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "MSBuild"}]}}, {"name": "System Processes Run From Unexpected Locations", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rename System Utilities"}]}}, {"name": "Windows DotNet Binary in Non Standard Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "InstallUtil"}]}}, {"name": "Windows InstallUtil in Non Standard Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "InstallUtil"}]}}]}, {"name": "MetaSploit", "id": "c149b694-bd08-4535-88d3-1f288a66313f", "version": 1, "date": "2022-11-21", "author": "Michael Haag, Splunk", "description": "The following analytic story highlights content related directly to MetaSploit, which may be default configurations attributed to MetaSploit or behaviors of known knowns that are related.", "narrative": "The Metasploit framework is a very powerful tool which can be used by cybercriminals as well as ethical hackers to probe systematic vulnerabilities on networks and servers. Because it is an open-source framework, it can be easily customized and used with most operating systems.\\\nThe Metasploit Project was undertaken in 2003 by H.D. Moore for use as a Perl-based portable network tool, with assistance from core developer Matt Miller. It was fully converted to Ruby by 2007, and the license was acquired by Rapid7 in 2009, where it remains as part of the Boston-based company repertoire of IDS signature development and targeted remote exploit, fuzzing, anti-forensic, and evasion tools.\\\nPortions of these other tools reside within the Metasploit framework, which is built into the Kali Linux OS. Rapid7 has also developed two proprietary OpenCore tools, Metasploit Pro, Metasploit Express.\\\nThis framework has become the go-to exploit development and mitigation tool. Prior to Metasploit, pen testers had to perform all probes manually by using a variety of tools that may or may not have supported the platform they were testing, writing their own code by hand, and introducing it onto networks manually. Remote testing was virtually unheard of, and that limited a security specialist reach to the local area and companies spending a fortune on in-house IT or security consultants. (ref. Varonis)", "references": ["https://github.com/rapid7/metasploit-framework", "https://www.varonis.com/blog/what-is-metasploit"], "tags": {"name": "MetaSploit", "analytic_story": "MetaSploit", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}], "mitre_attack_tactics": ["Execution"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Powershell Load Module in Meterpreter - Rule", "ESCU - Windows Apache Benchmark Binary - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Powershell Load Module in Meterpreter", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Windows Apache Benchmark Binary", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}]}}]}, {"name": "Meterpreter", "id": "d5f8e298-c85a-11eb-9fea-acde48001122", "version": 1, "date": "2021-06-08", "author": "Michael Hart", "description": "Meterpreter provides red teams, pen testers and threat actors interactive access to a compromised host to run commands, upload payloads, download files, and other actions.", "narrative": "This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Meterpreter. Meterpreter is a Metasploit payload for remote execution that leverages DLL injection to make it extremely difficult to detect.  Since the software runs in memory, no new processes are created upon injection.  It also leverages encrypted communication channels.\\\nMeterpreter enables the operator to remotely run commands on the target machine, upload payloads, download files, dump password hashes, and much more.  It is difficult to determine from the forensic evidence what actions the operator performed.  Splunk Research, however, has observed anomalous behaviors on the compromised hosts that seem to only appear when Meterpreter is executing various commands.  With that, we have written new detections targeted to these detections.\\\nWhile investigating a detection related to this analytic story, please bear in mind that the detections look for anomalies in system behavior.  It will be imperative to look for other signs in the endpoint and network logs for lateral movement, discovery and other actions to confirm that the host was compromised and a remote actor used it to progress on their objectives.", "references": ["https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/", "https://doubleoctopus.com/security-wiki/threats-and-tools/meterpreter/", "https://www.rapid7.com/products/metasploit/"], "tags": {"name": "Meterpreter", "analytic_story": "Meterpreter", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}], "mitre_attack_tactics": ["Execution"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Excessive distinct processes from Windows Temp - Rule", "ESCU - Excessive number of taskhost processes - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "no", "author_name": "Michael Hart", "detections": [{"name": "Excessive distinct processes from Windows Temp", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Excessive number of taskhost processes", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}]}}]}, {"name": "Microsoft MSHTML Remote Code Execution CVE-2021-40444", "id": "4ad4253e-10ca-11ec-8235-acde48001122", "version": 1, "date": "2021-09-08", "author": "Michael Haag, Splunk", "description": "CVE-2021-40444 is a remote code execution vulnerability in MSHTML, recently used to delivery targeted spearphishing documents.", "narrative": "Microsoft is aware of targeted attacks that attempt to exploit this vulnerability, CVE-2021-40444 by using specially-crafted Microsoft Office documents. MSHTML is a software component used to render web pages on Windows. Although it is 2019s most commonly associated with Internet Explorer, it is also used in other software.  CVE-2021-40444 received a CVSS score of 8.8 out of 10. MSHTML is the beating heart of Internet Explorer, the vulnerability also exists in that browser. Although given its limited use, there is little risk of infection by that vector. Microsoft Office applications use the MSHTML component to display web content in Office documents. The attack depends on MSHTML loading a specially crafted ActiveX control when the target opens a malicious Office document. The loaded ActiveX control can then run arbitrary code to infect the system with more malware. At the moment all supported Windows versions are vulnerable. Since there is no patch available yet, Microsoft proposes a few methods to block these attacks. \\\n1. Disable the installation of all ActiveX controls in Internet Explorer via the registry. Previously-installed ActiveX controls will still run, but no new ones will be added, including malicious ones. Open documents from the Internet in Protected View or Application Guard for Office, both of which prevent the current attack. This is a default setting but it may have been changed.", "references": ["https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/09/windows-mshtml-zero-day-actively-exploited-mitigations-required/", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444", "https://www.echotrail.io/insights/search/control.exe"], "tags": {"name": "Microsoft MSHTML Remote Code Execution CVE-2021-40444", "analytic_story": "Microsoft MSHTML Remote Code Execution CVE-2021-40444", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.002", "mitre_attack_technique": "Control Panel", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Ember Bear"]}, {"mitre_attack_id": "T1566", "mitre_attack_technique": "Phishing", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["Axiom", "GOLD SOUTHFIELD"]}, {"mitre_attack_id": "T1566.001", "mitre_attack_technique": "Spearphishing Attachment", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "IndigoZebra", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1218.011", "mitre_attack_technique": "Rundll32", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "CopyKittens", "Gamaredon Group", "HAFNIUM", "Kimsuky", "Lazarus Group", "LazyScripter", "Magic Hound", "MuddyWater", "Sandworm Team", "TA505", "TA551"]}], "mitre_attack_tactics": ["Defense Evasion", "Initial Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Control Loading from World Writable Directory - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Product Writing cab or inf - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Control Loading from World Writable Directory", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Control Panel"}]}}, {"name": "MSHTML Module Load in Office Product", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Writing cab or inf", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Spawning Control", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Rundll32 Control RunDLL Hunt", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Rundll32 Control RunDLL World Writable Directory", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}]}, {"name": "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190", "id": "2a60a99e-c93a-4036-af70-768fac838019", "version": 1, "date": "2022-05-31", "author": "Michael Haag, Teoderick Contreras, Splunk", "description": "On Monday May 30, 2022, Microsoft issued CVE-2022-30190 regarding the Microsoft Support Diagnostic Tool (MSDT) in Windows vulnerability.", "narrative": "A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user''s rights.", "references": ["https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/", "https://isc.sans.edu/diary/rss/28694", "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e", "https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A", "https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/", "https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection", "https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html"], "tags": {"name": "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190", "analytic_story": "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1566", "mitre_attack_technique": "Phishing", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["Axiom", "GOLD SOUTHFIELD"]}, {"mitre_attack_id": "T1566.001", "mitre_attack_technique": "Spearphishing Attachment", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "IndigoZebra", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}], "mitre_attack_tactics": ["Defense Evasion", "Execution", "Initial Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Windows Command and Scripting Interpreter Hunting Path Traversal - Rule", "ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule", "ESCU - Windows Execute Arbitrary Commands with MSDT - Rule", "ESCU - Windows Office Product Spawning MSDT - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Teoderick Contreras, Splunk", "author_name": "Michael Haag", "detections": [{"name": "Windows Command and Scripting Interpreter Hunting Path Traversal", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Windows Command and Scripting Interpreter Path Traversal Exec", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Windows Execute Arbitrary Commands with MSDT", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}]}}, {"name": "Windows Office Product Spawning MSDT", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}]}, {"name": "Monitor for Updates", "id": "9ef8d677-7b52-4213-a038-99cfc7acc2d8", "version": 1, "date": "2017-09-15", "author": "Rico Valdez, Splunk", "description": "Monitor your enterprise to ensure that your endpoints are being patched and updated. Adversaries notoriously exploit known vulnerabilities that could be mitigated by applying routine security patches.", "narrative": "It is a common best practice to ensure that endpoints are being patched and updated in a timely manner, in order to reduce the risk of compromise via a publicly disclosed vulnerability. Timely application of updates/patches is important to eliminate known vulnerabilities that may be exploited by various threat actors.\\\nSearches in this analytic story are designed to help analysts monitor endpoints for system patches and/or updates. This helps analysts identify any systems that are not successfully updated in a timely matter.\\\nMicrosoft releases updates for Windows systems on a monthly cadence. They should be installed as soon as possible after following internal testing and validation procedures. Patches and updates for other systems or applications are typically released as needed.", "references": ["https://learn.cisecurity.org/20-controls-download"], "tags": {"name": "Monitor for Updates", "analytic_story": "Monitor for Updates", "category": ["Best Practices"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Compliance", "mitre_attack_enrichments": [], "mitre_attack_tactics": [], "datamodels": ["Updates"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - No Windows Updates in a time frame - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task"], "baseline_names": ["ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"], "author_company": "Splunk", "author_name": "Rico Valdez", "detections": [{"name": "No Windows Updates in a time frame", "source": "application", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}]}, {"name": "Netsh Abuse", "id": "2b1800dd-92f9-47ec-a981-fdf1351e5f65", "version": 1, "date": "2017-01-05", "author": "Bhavin Patel, Splunk", "description": "Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system.", "narrative": "It is a common practice for attackers of all types to leverage native Windows tools and functionality to execute commands for malicious reasons. One such tool on Windows OS is `netsh.exe`,a command-line scripting utility that allows you to--either locally or remotely--display or modify the network configuration of a computer that is currently running. `Netsh.exe` can be used to discover and disable local firewall settings. It can also be used to set up a remote connection to a host from an infected system.\\\nTo get started, run the detection search to identify parent processes of `netsh.exe`.", "references": ["https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"], "tags": {"name": "Netsh Abuse", "analytic_story": "Netsh Abuse", "category": ["Abuse"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1562.004", "mitre_attack_technique": "Disable or Modify System Firewall", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "APT38", "Carbanak", "Dragonfly", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}], "mitre_attack_tactics": ["Defense Evasion"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"], "baseline_names": ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Processes created by netsh", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify System Firewall"}]}}, {"name": "Processes launching netsh", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify System Firewall"}, {"mitre_attack_technique": "Impair Defenses"}]}}]}, {"name": "Network Discovery", "id": "af228995-f182-49d7-90b3-2a732944f00f", "version": 1, "date": "2022-02-14", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the network discovery, including looking for network configuration, settings such as IP, MAC address, firewall settings and many more.", "narrative": "Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.", "references": ["https://attack.mitre.org/techniques/T1016/", "https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf", "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"], "tags": {"name": "Network Discovery", "analytic_story": "Network Discovery", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1016", "mitre_attack_technique": "System Network Configuration Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT1", "APT19", "APT3", "APT32", "APT41", "Chimera", "Darkhotel", "Dragonfly", "Earth Lusca", "GALLIUM", "HEXANE", "Higaisa", "Ke3chang", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "SideCopy", "Sidewinder", "Stealth Falcon", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}], "mitre_attack_tactics": ["Discovery"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Reconnaissance"]}, "detection_names": ["ESCU - Linux System Network Discovery - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Linux System Network Discovery", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Configuration Discovery"}]}}]}, {"name": "NOBELIUM Group", "id": "758196b5-2e21-424f-a50c-6e421ce926c2", "version": 2, "date": "2020-12-14", "author": "Patrick Bareiss, Michael Haag, Splunk", "description": "Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world.", "narrative": "This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) of the NOBELIUM Group. The threat actor behind sunburst compromised the SolarWinds.Orion.Core.BusinessLayer.dll, is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. The detections in this Analytic Story are focusing on the dll loading events, file create events and network events to detect This malware.", "references": ["https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/", "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"], "tags": {"name": "NOBELIUM Group", "analytic_story": "NOBELIUM Group", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1560.001", "mitre_attack_technique": "Archive via Utility", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT1", "APT28", "APT29", "APT3", "APT33", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Chimera", "CopyKittens", "Earth Lusca", "FIN8", "Fox Kitten", "GALLIUM", "Gallmaker", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "MuddyWater", "Mustang Panda", "Sowbug", "Turla", "menuPass"]}, {"mitre_attack_id": "T1560", "mitre_attack_technique": "Archive Collected Data", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT28", "APT32", "Axiom", "Dragonfly", "FIN6", "Ke3chang", "Lazarus Group", "Leviathan", "Patchwork", "menuPass"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.005", "mitre_attack_technique": "Mshta", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "APT32", "Confucius", "Earth Lusca", "FIN7", "Gamaredon Group", "Inception", "Kimsuky", "Lazarus Group", "LazyScripter", "MuddyWater", "Mustang Panda", "SideCopy", "Sidewinder", "TA551"]}, {"mitre_attack_id": "T1027", "mitre_attack_technique": "Obfuscated Files or Information", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "Aquatic Panda", "BITTER", "BackdoorDiplomacy", "BlackOasis", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Earth Lusca", "Elderwood", "Ember Bear", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Group5", "HEXANE", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leafminer", "Leviathan", "Magic Hound", "Mofang", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Putter Panda", "Rocke", "Sandworm Team", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Transparent Tribe", "Tropic Trooper", "Turla", "Whitefly", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1018", "mitre_attack_technique": "Remote System Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "APT3", "APT32", "APT39", "BRONZE BUTLER", "Chimera", "Deep Panda", "Dragonfly", "Earth Lusca", "FIN5", "FIN6", "FIN8", "Fox Kitten", "GALLIUM", "HEXANE", "Indrik Spider", "Ke3chang", "Leafminer", "Naikon", "Rocke", "Sandworm Team", "Silence", "Threat Group-3390", "Turla", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1569", "mitre_attack_technique": "System Services", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1569.002", "mitre_attack_technique": "Service Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT32", "APT38", "APT39", "APT41", "Blue Mockingbird", "Chimera", "FIN6", "Ke3chang", "Silence", "Wizard Spider"]}, {"mitre_attack_id": "T1203", "mitre_attack_technique": "Exploitation for Client Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT12", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT41", "Andariel", "Aoqin Dragon", "Axiom", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Elderwood", "Ember Bear", "Higaisa", "Inception", "Lazarus Group", "Leviathan", "MuddyWater", "Mustang Panda", "Patchwork", "Sandworm Team", "Sidewinder", "TA459", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "admin@338"]}, {"mitre_attack_id": "T1071.002", "mitre_attack_technique": "File Transfer Protocols", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT41", "Kimsuky", "SilverTerrier"]}, {"mitre_attack_id": "T1071", "mitre_attack_technique": "Application Layer Protocol", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["Dragonfly", "Magic Hound", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1071.001", "mitre_attack_technique": "Web Protocols", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Chimera", "Cobalt Group", "Confucius", "Dark Caracal", "FIN4", "FIN8", "Gamaredon Group", "HAFNIUM", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Mustang Panda", "OilRig", "Orangeworm", "Rancor", "Rocke", "Sandworm Team", "Sidewinder", "SilverTerrier", "Stealth Falcon", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "WIRTE", "Windshift", "Wizard Spider"]}, {"mitre_attack_id": "T1505.003", "mitre_attack_technique": "Web Shell", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT38", "APT39", "BackdoorDiplomacy", "Deep Panda", "Dragonfly", "Fox Kitten", "GALLIUM", "HAFNIUM", "Kimsuky", "Leviathan", "Magic Hound", "Moses Staff", "OilRig", "Sandworm Team", "TEMP.Veles", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Volatile Cedar"]}], "mitre_attack_tactics": ["Collection", "Command And Control", "Defense Evasion", "Discovery", "Execution", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint", "Network_Traffic", "Web"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Exploitation", "Installation"]}, "detection_names": ["ESCU - Anomalous usage of 7zip - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Windows AdFind Exe - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Sunburst Correlation DLL and Network Event - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Supernova Webshell - Rule"], "investigation_names": [], "baseline_names": ["ESCU - Previously Seen Running Windows Services - Initial", "ESCU - Previously Seen Running Windows Services - Update"], "author_company": "Michael Haag, Splunk", "author_name": "Patrick Bareiss", "detections": [{"name": "Anomalous usage of 7zip", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Archive via Utility"}, {"mitre_attack_technique": "Archive Collected Data"}]}}, {"name": "Detect Prohibited Applications Spawning cmd exe", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "Windows Command Shell"}]}}, {"name": "Detect Rundll32 Inline HTA Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Mshta"}]}}, {"name": "Malicious PowerShell Process - Encoded Command", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Obfuscated Files or Information"}]}}, {"name": "Sc exe Manipulating Windows Services", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Service"}, {"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Scheduled Task Deleted Or Created via CMD", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Schtasks scheduling job on remote system", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Windows AdFind Exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote System Discovery"}]}}, {"name": "First Time Seen Running Windows Service", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Services"}, {"mitre_attack_technique": "Service Execution"}]}}, {"name": "Sunburst Correlation DLL and Network Event", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation for Client Execution"}]}}, {"name": "Detect Outbound SMB Traffic", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File Transfer Protocols"}, {"mitre_attack_technique": "Application Layer Protocol"}]}}, {"name": "TOR Traffic", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Application Layer Protocol"}, {"mitre_attack_technique": "Web Protocols"}]}}, {"name": "Supernova Webshell", "source": "web", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Web Shell"}]}}]}, {"name": "Office 365 Detections", "id": "1a51dd71-effc-48b2-abc4-3e9cdb61e5b9", "version": 1, "date": "2020-12-16", "author": "Patrick Bareiss, Splunk", "description": "This story is focused around detecting Office 365 Attacks.", "narrative": "More and more companies are using Microsofts Office 365 cloud offering. Therefore, we see more and more attacks against Office 365. This story provides various detections for Office 365 attacks.", "references": ["https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf"], "tags": {"name": "Office 365 Detections", "analytic_story": "Office 365 Detections", "category": ["Cloud Security"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1136.003", "mitre_attack_technique": "Cloud Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT29", "LAPSUS$"]}, {"mitre_attack_id": "T1136", "mitre_attack_technique": "Create Account", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["Indrik Spider", "Sandworm Team"]}, {"mitre_attack_id": "T1562.007", "mitre_attack_technique": "Disable or Modify Cloud Firewall", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1556", "mitre_attack_technique": "Modify Authentication Process", "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1110", "mitre_attack_technique": "Brute Force", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT38", "APT39", "DarkVishnya", "Dragonfly", "FIN5", "Fox Kitten", "HEXANE", "Lazarus Group", "OilRig", "Turla"]}, {"mitre_attack_id": "T1114", "mitre_attack_technique": "Email Collection", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["Magic Hound", "Silent Librarian"]}, {"mitre_attack_id": "T1114.003", "mitre_attack_technique": "Email Forwarding Rule", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["Kimsuky", "LAPSUS$", "Silent Librarian"]}, {"mitre_attack_id": "T1114.002", "mitre_attack_technique": "Remote Email Collection", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT1", "APT28", "APT29", "Chimera", "Dragonfly", "FIN4", "HAFNIUM", "Ke3chang", "Kimsuky", "Leafminer", "Magic Hound"]}, {"mitre_attack_id": "T1110.001", "mitre_attack_technique": "Password Guessing", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28"]}], "mitre_attack_tactics": ["Collection", "Credential Access", "Defense Evasion", "Persistence"], "datamodels": [], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - High Number of Login Failures from a single source - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Patrick Bareiss", "detections": [{"name": "O365 Add App Role Assignment Grant User", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Account"}, {"mitre_attack_technique": "Create Account"}]}}, {"name": "O365 Added Service Principal", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Account"}, {"mitre_attack_technique": "Create Account"}]}}, {"name": "O365 Bypass MFA via Trusted IP", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Cloud Firewall"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "O365 Disable MFA", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Authentication Process"}]}}, {"name": "O365 Excessive Authentication Failures Alert", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Brute Force"}]}}, {"name": "O365 Excessive SSO logon errors", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Authentication Process"}]}}, {"name": "O365 New Federated Domain Added", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Account"}, {"mitre_attack_technique": "Create Account"}]}}, {"name": "O365 PST export alert", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Email Collection"}]}}, {"name": "O365 Suspicious Admin Email Forwarding", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Email Forwarding Rule"}, {"mitre_attack_technique": "Email Collection"}]}}, {"name": "O365 Suspicious Rights Delegation", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Email Collection"}, {"mitre_attack_technique": "Email Collection"}]}}, {"name": "O365 Suspicious User Email Forwarding", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Email Forwarding Rule"}, {"mitre_attack_technique": "Email Collection"}]}}, {"name": "High Number of Login Failures from a single source", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Guessing"}, {"mitre_attack_technique": "Brute Force"}]}}]}, {"name": "Okta MFA Exhaustion", "id": "7c6e508d-4b4d-42c8-82de-5ff4ea3b0cb3", "version": 1, "date": "2022-09-27", "author": "Michael Haag, Splunk", "description": "A social engineering technique called 'MFA Fatigue', aka 'MFA push spam' or 'MFA Exhaustion', is growing more popular with threat actors as it does not require malware or phishing infrastructure and has proven to be successful in attacks.", "narrative": "An MFA Fatigue attack is when a threat actor runs a script that attempts to log in with stolen credentials over and over, causing what feels like an endless stream of MFA push requests to be sent to the account's owner's mobile device. The goal is to keep this up, day and night, to break down the target's cybersecurity posture and inflict a sense of \"fatigue\" regarding these MFA prompts.", "references": ["https://www.bleepingcomputer.com/news/security/mfa-fatigue-hackers-new-favorite-tactic-in-high-profile-breaches/", "https://www.csoonline.com/article/3674156/multi-factor-authentication-fatigue-attacks-are-on-the-rise-how-to-defend-against-them.html"], "tags": {"name": "Okta MFA Exhaustion", "analytic_story": "Okta MFA Exhaustion", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1110", "mitre_attack_technique": "Brute Force", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT38", "APT39", "DarkVishnya", "Dragonfly", "FIN5", "Fox Kitten", "HEXANE", "Lazarus Group", "OilRig", "Turla"]}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": ["Risk"], "kill_chain_phases": ["Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - Okta Risk Threshold Exceeded - Rule", "ESCU - Okta Account Locked Out - Rule", "ESCU - Okta MFA Exhaustion Hunt - Rule", "ESCU - Okta Two or More Rejected Okta Pushes - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Okta Risk Threshold Exceeded", "source": "application", "type": "Correlation", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Brute Force"}]}}, {"name": "Okta Account Locked Out", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Brute Force"}]}}, {"name": "Okta MFA Exhaustion Hunt", "source": "application", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Brute Force"}]}}, {"name": "Okta Two or More Rejected Okta Pushes", "source": "application", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Brute Force"}]}}]}, {"name": "OpenSSL CVE-2022-3602", "id": "491e00c9-998b-4c64-91bb-d8f9c79c1f4c", "version": 1, "date": "2022-11-02", "author": "Michael Haag, splunk", "description": "OpenSSL recently disclosed two vulnerabilities CVE-2022-3602 and CVE-2022-3786. CVE-2022-3602 is a X.509 Email Address 4-byte Buffer Overflow where puny code is utilized. This only affects OpenSSL 3.0.0 - 3.0.6.", "narrative": "A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the . character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Users of OpenSSL 3.0.0 - 3.0.6 are encouraged to upgrade to 3.0.7 as soon as possible. If you obtain your copy of OpenSSL from your Operating System vendor or other third party then you should seek to obtain an updated version from them as soon as possible. SSL Certificates with Punycode will identify SSL certificates with Punycode. Note that it does not mean it will capture malicious payloads. If using Zeek, modify the Zeek x509 certificate with punycode to match your environment. We found during this exercise that the FULL x509 with SAN must be captured and stored, decoded, in order to query against it.", "references": ["https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/", "https://github.com/advisories/GHSA-h8jm-2x53-xhp5", "https://community.emergingthreats.net/t/out-of-band-ruleset-update-summary-2022-11-01/117", "https://github.com/corelight/CVE-2022-3602/tree/master/scripts"], "tags": {"name": "OpenSSL CVE-2022-3602", "analytic_story": "OpenSSL CVE-2022-3602", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1573", "mitre_attack_technique": "Encrypted Channel", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT29", "BITTER", "Tropic Trooper"]}], "mitre_attack_tactics": ["Command And Control"], "datamodels": [], "kill_chain_phases": ["Delivery", "Reconnaissance"]}, "detection_names": ["ESCU - SSL Certificates with Punycode - Rule", "ESCU - Zeek x509 Certificate with Punycode - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "splunk", "author_name": "Michael Haag", "detections": [{"name": "SSL Certificates with Punycode", "source": "network", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Encrypted Channel"}]}}, {"name": "Zeek x509 Certificate with Punycode", "source": "network", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Encrypted Channel"}]}}]}, {"name": "Orangeworm Attack Group", "id": "bb9f5ed2-916e-4364-bb6d-97c370efcf52", "version": 2, "date": "2020-01-22", "author": "David Dorsey, Splunk", "description": "Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry.", "narrative": "In May of 2018, the attack group Orangeworm was implicated for installing a custom backdoor called Trojan.Kwampirs within large international healthcare corporations in the United States, Europe, and Asia. This malware provides the attackers with remote access to the target system, decrypting and extracting a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.\\\nAwareness of the Orangeworm group first surfaced in January, 2015. It has conducted targeted attacks against related industries, as well, such as pharmaceuticals and healthcare IT solution providers.\\\nHealthcare may be a promising target, because it is notoriously behind in technology, often using older operating systems and neglecting to patch computers. Even so, the group was able to evade detection for a full three years. Sources say that the malware spread quickly within the target networks, infecting computers used to control medical devices, such as MRI and X-ray machines.\\\nThis Analytic Story is designed to help you detect and investigate suspicious activities that may be indicative of an Orangeworm attack. One detection search looks for command-line arguments. Another monitors for uses of sc.exe, a non-essential Windows file that can manipulate Windows services. One of the investigative searches helps you get more information on web hosts that you suspect have been compromised.", "references": ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"], "tags": {"name": "Orangeworm Attack Group", "analytic_story": "Orangeworm Attack Group", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1569", "mitre_attack_technique": "System Services", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1569.002", "mitre_attack_technique": "Service Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT32", "APT38", "APT39", "APT41", "Blue Mockingbird", "Chimera", "FIN6", "Ke3chang", "Silence", "Wizard Spider"]}], "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Installation"]}, "detection_names": ["ESCU - First time seen command line argument - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - First Time Seen Running Windows Service - Rule"], "investigation_names": ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"], "baseline_names": ["ESCU - Previously seen command line arguments", "ESCU - Previously Seen Running Windows Services - Initial", "ESCU - Previously Seen Running Windows Services - Update"], "author_company": "Splunk", "author_name": "David Dorsey", "detections": [{"name": "First time seen command line argument", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Windows Command Shell"}]}}, {"name": "Sc exe Manipulating Windows Services", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Service"}, {"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "First Time Seen Running Windows Service", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Services"}, {"mitre_attack_technique": "Service Execution"}]}}]}, {"name": "PetitPotam NTLM Relay on Active Directory Certificate Services", "id": "97aecafc-0a68-11ec-962f-acde48001122", "version": 1, "date": "2021-08-31", "author": "Michael Haag, Mauricio Velazco, Splunk", "description": "PetitPotam (CVE-2021-36942,) is a vulnerablity identified in Microsofts EFSRPC Protocol that can allow an unauthenticated account to escalate privileges to domain administrator given the right circumstances.", "narrative": "In June 2021, security researchers at SpecterOps released a blog post and white paper detailing several potential attack vectors against Active Directory Certificated Services (ADCS). ADCS is a Microsoft product that implements Public Key Infrastrucutre (PKI) functionality and can be used by organizations to provide and manage digital certiticates within Active Directory.\\ In July 2021, a security researcher released PetitPotam, a tool that allows attackers to coerce Windows systems into authenticating to arbitrary endpoints.\\ Combining PetitPotam with the identified ADCS attack vectors allows attackers to escalate privileges from an unauthenticated anonymous user to full domain admin privileges.", "references": ["https://us-cert.cisa.gov/ncas/current-activity/2021/07/27/microsoft-releases-guidance-mitigating-petitpotam-ntlm-relay", "https://support.microsoft.com/en-us/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429", "https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf", "https://github.com/topotam/PetitPotam/", "https://github.com/gentilkiwi/mimikatz/releases/tag/2.2.0-20210723", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942", "https://attack.mitre.org/techniques/T1187/"], "tags": {"name": "PetitPotam NTLM Relay on Active Directory Certificate Services", "analytic_story": "PetitPotam NTLM Relay on Active Directory Certificate Services", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1187", "mitre_attack_technique": "Forced Authentication", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["DarkHydrus", "Dragonfly"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": [], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - PetitPotam Network Share Access Request - Rule", "ESCU - PetitPotam Suspicious Kerberos TGT Request - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Mauricio Velazco, Splunk", "author_name": "Michael Haag", "detections": [{"name": "PetitPotam Network Share Access Request", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Forced Authentication"}]}}, {"name": "PetitPotam Suspicious Kerberos TGT Request", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "OS Credential Dumping"}]}}]}, {"name": "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "id": "988C59C5-0A1C-45B6-A555-0C62276E327E", "version": 1, "date": "2020-01-22", "author": "iDefense Cyber Espionage Team, iDefense", "description": "Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group.", "narrative": "This story was created as a joint effort between iDefense and Splunk.\\\niDefense analysts have recently discovered a Windows executable file that, upon execution, spoofs a decryption tool and then drops a file that appears to be the custom-built javascript backdoor, \"Orz,\" which is associated with the threat actors known as MUDCARP (as well as \"temp.Periscope\" and \"Leviathan\"). The file is executed using Wscript.\\\nThe MUDCARP techniques include the use of the compressed-folders module from Microsoft, zipfldr.dll, with RouteTheCall export to run the malicious process or command. After a successful reboot, the malware is made persistent by a manipulating `[HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run]'help'='c:\\\\windows\\\\system32\\\\rundll32.exe c:\\\\windows\\\\system32\\\\zipfldr.dll,RouteTheCall c:\\\\programdata\\\\winapp.exe'`. Though this technique is not exclusive to MUDCARP, it has been spotted in the group's arsenal of advanced techniques seen in the wild.\\\nThis Analytic Story searches for evidence of tactics, techniques, and procedures (TTPs) that allow for the use of a endpoint detection-and-response (EDR) bypass technique to mask the true parent of a malicious process. It can also be set as a registry key for further sandbox evasion and to allow the malware to launch only after reboot.\\\nIf behavioral searches included in this story yield positive hits, iDefense recommends conducting IOC searches for the following:\\\n\\\n1. www.chemscalere[.]com\\\n1. chemscalere[.]com\\\n1. about.chemscalere[.]com\\\n1. autoconfig.chemscalere[.]com\\\n1. autodiscover.chemscalere[.]com\\\n1. catalog.chemscalere[.]com\\\n1. cpanel.chemscalere[.]com\\\n1. db.chemscalere[.]com\\\n1. ftp.chemscalere[.]com\\\n1. mail.chemscalere[.]com\\\n1. news.chemscalere[.]com\\\n1. update.chemscalere[.]com\\\n1. webmail.chemscalere[.]com\\\n1. www.candlelightparty[.]org\\\n1. candlelightparty[.]org\\\n1. newapp.freshasianews[.]comIn addition, iDefense also recommends that organizations review their environments for activity related to the following hashes:\\\n\\\n1. cd195ee448a3657b5c2c2d13e9c7a2e2\\\n1. b43ad826fe6928245d3c02b648296b43\\\n1. 889a9b52566448231f112a5ce9b5dfaf\\\n1. b8ec65dab97cdef3cd256cc4753f0c54\\\n1. 04d83cd3813698de28cfbba326d7647c", "references": ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"], "tags": {"name": "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "analytic_story": "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1547.001", "mitre_attack_technique": "Registry Run Keys / Startup Folder", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Dark Caracal", "Darkhotel", "Dragonfly", "FIN10", "FIN6", "FIN7", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Putter Panda", "RTM", "Rocke", "Sidewinder", "Silence", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Command & Control"]}, "detection_names": ["ESCU - First time seen command line argument - Rule", "ESCU - PowerShell - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule"], "investigation_names": ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"], "baseline_names": ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"], "author_company": "iDefense", "author_name": "iDefense Cyber Espionage Team", "detections": [{"name": "First time seen command line argument", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Windows Command Shell"}]}}, {"name": "PowerShell - Connect To Internet With Hidden Window", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Registry Keys Used For Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Registry Run Keys / Startup Folder"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Unusually Long Command Line", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "Unusually Long Command Line - MLTK", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}]}, {"name": "PrintNightmare CVE-2021-34527", "id": "fd79470a-da88-11eb-b803-acde48001122", "version": 1, "date": "2021-07-01", "author": "Splunk Threat Research Team", "description": "The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-34527 previously known as (CVE-2021-1675), to gain privilege escalation on the vulnerable machine.", "narrative": "This vulnerability affects the Print Spooler service, enabled by default on Windows systems, and allows adversaries to trick this service into installing a remotely hosted print driver using a low privileged user account. Successful exploitation effectively allows adversaries to execute code in the target system (Remote Code Execution) in the context of the Print Spooler service which runs with the highest privileges (Privilege Escalation). \\\nThe prerequisites for successful exploitation consist of: \\\n1. Print Spooler service enabled on the target system \\\n1. Network connectivity to the target system (initial access has been obtained) \\\n1. Hash or password for a low privileged user ( or computer ) account. \\\nIn the most impactful scenario, an attacker would be able to leverage this vulnerability to obtain a SYSTEM shell on a domain controller and so escalate their privileges from a low privileged domain account to full domain access in the target environment as shown below.", "references": ["https://github.com/cube0x0/CVE-2021-1675/", "https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/", "https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/", "https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes"], "tags": {"name": "PrintNightmare CVE-2021-34527", "analytic_story": "PrintNightmare CVE-2021-34527", "category": ["Vulnerability"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1547.012", "mitre_attack_technique": "Print Processors", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.011", "mitre_attack_technique": "Rundll32", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "CopyKittens", "Gamaredon Group", "HAFNIUM", "Kimsuky", "Lazarus Group", "LazyScripter", "Magic Hound", "MuddyWater", "Sandworm Team", "TA505", "TA551"]}, {"mitre_attack_id": "T1068", "mitre_attack_technique": "Exploitation for Privilege Escalation", "mitre_attack_tactics": ["Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT33", "BITTER", "Cobalt Group", "FIN6", "FIN8", "LAPSUS$", "PLATINUM", "Threat Group-3390", "Tonto Team", "Turla", "Whitefly", "ZIRCONIUM"]}], "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - Print Spooler Adding A Printer Driver - Rule", "ESCU - Print Spooler Failed to Load a Plug-in - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - Spoolsv Spawning Rundll32 - Rule", "ESCU - Spoolsv Suspicious Loaded Modules - Rule", "ESCU - Spoolsv Suspicious Process Access - Rule", "ESCU - Spoolsv Writing a DLL - Rule", "ESCU - Spoolsv Writing a DLL - Sysmon - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "no", "author_name": "Splunk Threat Research Team", "detections": [{"name": "Print Spooler Adding A Printer Driver", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Print Processors"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Print Spooler Failed to Load a Plug-in", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Print Processors"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Rundll32 with no Command Line Arguments with Network", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Spoolsv Spawning Rundll32", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Print Processors"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Spoolsv Suspicious Loaded Modules", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Print Processors"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Spoolsv Suspicious Process Access", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation for Privilege Escalation"}]}}, {"name": "Spoolsv Writing a DLL", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Print Processors"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Spoolsv Writing a DLL - Sysmon", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Print Processors"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Suspicious Rundll32 no Command Line Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}]}, {"name": "Prohibited Traffic Allowed or Protocol Mismatch", "id": "6d13121c-90f3-446d-8ac3-27efbbc65218", "version": 1, "date": "2017-09-11", "author": "Rico Valdez, Splunk", "description": "Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers.", "narrative": "A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts.", "references": ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"], "tags": {"name": "Prohibited Traffic Allowed or Protocol Mismatch", "analytic_story": "Prohibited Traffic Allowed or Protocol Mismatch", "category": ["Best Practices"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1021.001", "mitre_attack_technique": "Remote Desktop Protocol", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT1", "APT29", "APT3", "APT39", "APT41", "Axiom", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "HEXANE", "Kimsuky", "Lazarus Group", "Leviathan", "Magic Hound", "OilRig", "Patchwork", "Silence", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1048", "mitre_attack_technique": "Exfiltration Over Alternative Protocol", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1048.003", "mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["APT32", "APT33", "FIN6", "FIN8", "Lazarus Group", "OilRig", "Thrip", "Wizard Spider"]}, {"mitre_attack_id": "T1071", "mitre_attack_technique": "Application Layer Protocol", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["Dragonfly", "Magic Hound", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1071.001", "mitre_attack_technique": "Web Protocols", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Chimera", "Cobalt Group", "Confucius", "Dark Caracal", "FIN4", "FIN8", "Gamaredon Group", "HAFNIUM", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Mustang Panda", "OilRig", "Orangeworm", "Rancor", "Rocke", "Sandworm Team", "Sidewinder", "SilverTerrier", "Stealth Falcon", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "WIRTE", "Windshift", "Wizard Spider"]}, {"mitre_attack_id": "T1189", "mitre_attack_technique": "Drive-by Compromise", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT19", "APT28", "APT32", "APT37", "APT38", "Andariel", "Axiom", "BRONZE BUTLER", "Dark Caracal", "Darkhotel", "Dragonfly", "Earth Lusca", "Elderwood", "Lazarus Group", "Leafminer", "Leviathan", "Machete", "Magic Hound", "PLATINUM", "PROMETHIUM", "Patchwork", "RTM", "Threat Group-3390", "Transparent Tribe", "Turla", "Windigo", "Windshift"]}], "mitre_attack_tactics": ["Command And Control", "Exfiltration", "Initial Access", "Lateral Movement"], "datamodels": ["Endpoint", "Network_Resolution", "Network_Traffic"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Delivery", "Exploitation"]}, "detection_names": ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Inbound Traffic In Firewall Rule - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule"], "investigation_names": ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"], "baseline_names": ["ESCU - Count of Unique IPs Connecting to Ports"], "author_company": "Splunk", "author_name": "Rico Valdez", "detections": [{"name": "Allow Inbound Traffic By Firewall Rule Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Desktop Protocol"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "Allow Inbound Traffic In Firewall Rule", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Desktop Protocol"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "Enable RDP In Other Port Number", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}]}}, {"name": "Prohibited Network Traffic Allowed", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}, {"name": "Protocol or Port Mismatch", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}, {"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}, {"name": "TOR Traffic", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Application Layer Protocol"}, {"mitre_attack_technique": "Web Protocols"}]}}, {"name": "Detect hosts connecting to dynamic domain providers", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Drive-by Compromise"}]}}]}, {"name": "ProxyNotShell", "id": "4e3f17e7-9ed7-425d-a05e-b65464945836", "version": 1, "date": "2022-09-30", "author": "Michael Haag, Splunk", "description": "Two new zero day Microsoft Exchange vulnerabilities have been identified actively exploited in the wild - CVE-2022-41040 and CVE-2022-41082.", "narrative": "Microsoft is investigating two reported zero-day vulnerabilities affecting Microsoft Exchange Server 2013, 2016, and 2019. The first vulnerability, identified as CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, while the second, identified as CVE-2022-41082, allows remote code execution (RCE) when PowerShell is accessible to the attacker. Originally identified by GTSC monitoring Exchange, some adversary post-exploitation activity was identified and is tagged to this story.", "references": ["https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/", "https://twitter.com/GossiTheDog/status/1575762721353916417?s=20&t=67gq9xCWuyPm1VEm8ydfyA", "https://twitter.com/cglyer/status/1575793769814728705?s=20&t=67gq9xCWuyPm1VEm8ydfyA", "https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html", "https://research.splunk.com/stories/proxyshell/", "https://www.inversecos.com/2022/07/hunting-for-apt-abuse-of-exchange.html"], "tags": {"name": "ProxyNotShell", "analytic_story": "ProxyNotShell", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1105", "mitre_attack_technique": "Ingress Tool Transfer", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "Chimera", "Cobalt Group", "Confucius", "Darkhotel", "Dragonfly", "Elderwood", "Ember Bear", "Evilnum", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "IndigoZebra", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "Rancor", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Turla", "Volatile Cedar", "WIRTE", "Whitefly", "Windshift", "Winnti Group", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1505", "mitre_attack_technique": "Server Software Component", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1505.003", "mitre_attack_technique": "Web Shell", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT38", "APT39", "BackdoorDiplomacy", "Deep Panda", "Dragonfly", "Fox Kitten", "GALLIUM", "HAFNIUM", "Kimsuky", "Leviathan", "Magic Hound", "Moses Staff", "OilRig", "Sandworm Team", "TEMP.Veles", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Volatile Cedar"]}, {"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}, {"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}], "mitre_attack_tactics": ["Command And Control", "Execution", "Initial Access", "Persistence"], "datamodels": ["Endpoint", "Risk", "Web"], "kill_chain_phases": ["Exploitation", "Installation", "Reconnaissance"]}, "detection_names": ["ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Detect Exchange Web Shell - Rule", "ESCU - Exchange PowerShell Module Usage - Rule", "ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Windows MSExchange Management Mailbox Cmdlet Usage - Rule", "ESCU - Exchange PowerShell Abuse via SSRF - Rule", "ESCU - ProxyShell ProxyNotShell Behavior Detected - Rule", "ESCU - Windows Exchange Autodiscover SSRF Abuse - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "CertUtil Download With URLCache and Split Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "CMD Carry Out String Command Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Command Shell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Detect Exchange Web Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "Web Shell"}, {"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Exchange PowerShell Module Usage", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Unified Messaging Service Spawning a Process", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "W3WP Spawning Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "Web Shell"}]}}, {"name": "Windows MSExchange Management Mailbox Cmdlet Usage", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Exchange PowerShell Abuse via SSRF", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "ProxyShell ProxyNotShell Behavior Detected", "source": "web", "type": "Correlation", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Windows Exchange Autodiscover SSRF Abuse", "source": "web", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}]}, {"name": "ProxyShell", "id": "413bb68e-04e2-11ec-a835-acde48001122", "version": 1, "date": "2021-08-24", "author": "Michael Haag, Teoderick Contreras, Mauricio Velazco, Splunk", "description": "ProxyShell is a chain of exploits targeting on-premise Microsoft Exchange Server - CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207.", "narrative": "During Pwn2Own April 2021, a security researcher demonstrated an attack  chain targeting on-premise Microsoft Exchange Server. August 5th, the same researcher  publicly released further details and demonstrated the attack chain. CVE-2021-34473  Pre-auth path confusion leads to ACL Bypass (Patched in April by KB5001779)  CVE-2021-34523 - Elevation of privilege on Exchange PowerShell backend (Patched in April by KB5001779) . CVE-2021-31207 - Post-auth Arbitrary-File-Write  leads to RCE (Patched in May by KB5003435) Upon successful exploitation,  the remote attacker will have SYSTEM privileges on the Exchange Server. In addition    to remote access/execution, the adversary may be able to run Exchange PowerShell  Cmdlets to perform further actions.", "references": ["https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/", "https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell", "https://www.youtube.com/watch?v=FC6iHw258RI", "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do", "https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-ProxyLogon-Is-Just-The-Tip-Of-The-Iceberg-A-New-Attack-Surface-On-Microsoft-Exchange-Server.pdf", "https://www.inversecos.com/2022/07/hunting-for-apt-abuse-of-exchange.html"], "tags": {"name": "ProxyShell", "analytic_story": "ProxyShell", "category": ["Adversary Tactics", "Ransomware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1505", "mitre_attack_technique": "Server Software Component", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1505.003", "mitre_attack_technique": "Web Shell", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT38", "APT39", "BackdoorDiplomacy", "Deep Panda", "Dragonfly", "Fox Kitten", "GALLIUM", "HAFNIUM", "Kimsuky", "Leviathan", "Magic Hound", "Moses Staff", "OilRig", "Sandworm Team", "TEMP.Veles", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Volatile Cedar"]}, {"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}], "mitre_attack_tactics": ["Execution", "Initial Access", "Persistence"], "datamodels": ["Endpoint", "Risk", "Web"], "kill_chain_phases": ["Exploitation", "Installation", "Reconnaissance"]}, "detection_names": ["ESCU - Detect Exchange Web Shell - Rule", "ESCU - Exchange PowerShell Module Usage - Rule", "ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Windows MSExchange Management Mailbox Cmdlet Usage - Rule", "ESCU - Exchange PowerShell Abuse via SSRF - Rule", "ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule", "ESCU - ProxyShell ProxyNotShell Behavior Detected - Rule", "ESCU - Windows Exchange Autodiscover SSRF Abuse - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Teoderick Contreras, Mauricio Velazco, Splunk", "author_name": "Michael Haag", "detections": [{"name": "Detect Exchange Web Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "Web Shell"}, {"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Exchange PowerShell Module Usage", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Unified Messaging Service Spawning a Process", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "W3WP Spawning Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "Web Shell"}]}}, {"name": "Windows MSExchange Management Mailbox Cmdlet Usage", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Exchange PowerShell Abuse via SSRF", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "MS Exchange Mailbox Replication service writing Active Server Pages", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "Web Shell"}, {"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "ProxyShell ProxyNotShell Behavior Detected", "source": "web", "type": "Correlation", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Windows Exchange Autodiscover SSRF Abuse", "source": "web", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}]}, {"name": "Qakbot", "id": "0c6169b1-f126-4d86-8e4f-f7891007ebc6", "version": 2, "date": "2022-11-14", "author": "Teoderick Contreras, Splunk", "description": "QakBot is a modular banking trojan that has been used primarily by financially-motivated actors since at least 2007. QakBot is continuously maintained and developed and has evolved from an information stealer into a delivery agent for ransomware (ref. MITRE ATT&CK).", "narrative": "QakBot notably has made its way on the CISA top malware list for 2021. QakBot for years has been under continious improvement when it comes to initial access, injection and post-exploitation. Multiple adversaries use QakBot to gain initial access and persist, most notably TA551. The actor(s) behind QakBot possess a modular framework consisting of maldoc builders, signed loaders, and DLLs that produce initially low detection rates at the beginning of the attack, which creates opportunities to deliver additional malware such as Egregor and Cobalt Strike. (ref. Cybersecurity ATT) The more recent campaigns utilize HTML smuggling to deliver a ISO container that has a LNK and QakBot payload. QakBot will either load via regsvr32.exe directly, it will attempt to perform DLL sideloading.", "references": ["https://www.cisa.gov/sites/default/files/publications/202010221030_QakBot%20TLPWHITE.pdf", "https://malpedia.caad.fkie.fraunhofer.de/details/win.QakBot", "https://securelist.com/QakBot-technical-analysis/103931/", "https://www.fortinet.com/blog/threat-research/new-variant-of-QakBot-spread-by-phishing-emails", "https://attack.mitre.org/software/S0650/", "https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot"], "tags": {"name": "Qakbot", "analytic_story": "Qakbot", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1059.007", "mitre_attack_technique": "JavaScript", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT32", "Cobalt Group", "Earth Lusca", "Ember Bear", "Evilnum", "FIN6", "FIN7", "Higaisa", "Indrik Spider", "Kimsuky", "LazyScripter", "Leafminer", "Molerats", "MuddyWater", "Sidewinder", "Silence", "TA505", "Turla"]}, {"mitre_attack_id": "T1055", "mitre_attack_technique": "Process Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT32", "APT37", "APT41", "Cobalt Group", "Kimsuky", "PLATINUM", "Silence", "Turla"]}, {"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1027", "mitre_attack_technique": "Obfuscated Files or Information", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "Aquatic Panda", "BITTER", "BackdoorDiplomacy", "BlackOasis", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Earth Lusca", "Elderwood", "Ember Bear", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Group5", "HEXANE", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leafminer", "Leviathan", "Magic Hound", "Mofang", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Putter Panda", "Rocke", "Sandworm Team", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Transparent Tribe", "Tropic Trooper", "Turla", "Whitefly", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1049", "mitre_attack_technique": "System Network Connections Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT1", "APT3", "APT32", "APT38", "APT41", "Andariel", "BackdoorDiplomacy", "Chimera", "Earth Lusca", "GALLIUM", "HEXANE", "Ke3chang", "Lazarus Group", "Magic Hound", "MuddyWater", "Mustang Panda", "OilRig", "Poseidon Group", "Sandworm Team", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1016", "mitre_attack_technique": "System Network Configuration Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT1", "APT19", "APT3", "APT32", "APT41", "Chimera", "Darkhotel", "Dragonfly", "Earth Lusca", "GALLIUM", "HEXANE", "Higaisa", "Ke3chang", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "SideCopy", "Sidewinder", "Stealth Falcon", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1016.001", "mitre_attack_technique": "Internet Connection Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "Gamaredon Group", "HEXANE", "Turla"]}, {"mitre_attack_id": "T1482", "mitre_attack_technique": "Domain Trust Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "Chimera", "Earth Lusca", "FIN8"]}, {"mitre_attack_id": "T1566", "mitre_attack_technique": "Phishing", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["Axiom", "GOLD SOUTHFIELD"]}, {"mitre_attack_id": "T1566.001", "mitre_attack_technique": "Spearphishing Attachment", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "IndigoZebra", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1566.002", "mitre_attack_technique": "Spearphishing Link", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT1", "APT28", "APT29", "APT3", "APT32", "APT33", "APT39", "BlackTech", "Cobalt Group", "Confucius", "EXOTIC LILY", "Earth Lusca", "Elderwood", "Ember Bear", "Evilnum", "FIN4", "FIN7", "FIN8", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Sandworm Team", "Sidewinder", "TA505", "Transparent Tribe", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1592", "mitre_attack_technique": "Gather Victim Host Information", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1547.001", "mitre_attack_technique": "Registry Run Keys / Startup Folder", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Dark Caracal", "Darkhotel", "Dragonfly", "FIN10", "FIN6", "FIN7", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Putter Panda", "RTM", "Rocke", "Sidewinder", "Silence", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.010", "mitre_attack_technique": "Regsvr32", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "Blue Mockingbird", "Cobalt Group", "Deep Panda", "Inception", "Kimsuky", "Lazarus Group", "Leviathan", "TA551", "WIRTE"]}, {"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1036.003", "mitre_attack_technique": "Rename System Utilities", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT32", "GALLIUM", "Lazarus Group", "menuPass"]}, {"mitre_attack_id": "T1033", "mitre_attack_technique": "System Owner/User Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT37", "APT38", "APT39", "APT41", "Chimera", "Dragonfly", "Earth Lusca", "FIN10", "GALLIUM", "Gamaredon Group", "HEXANE", "Ke3chang", "Lazarus Group", "Magic Hound", "MuddyWater", "OilRig", "Patchwork", "Sandworm Team", "Sidewinder", "Stealth Falcon", "Threat Group-3390", "Tropic Trooper", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1071", "mitre_attack_technique": "Application Layer Protocol", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["Dragonfly", "Magic Hound", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1574.001", "mitre_attack_technique": "DLL Search Order Hijacking", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT41", "Aquatic Panda", "BackdoorDiplomacy", "Evilnum", "RTM", "Threat Group-3390", "Tonto Team", "Whitefly", "menuPass"]}, {"mitre_attack_id": "T1574", "mitre_attack_technique": "Hijack Execution Flow", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1574.002", "mitre_attack_technique": "DLL Side-Loading", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT41", "BRONZE BUTLER", "BlackTech", "Chimera", "Earth Lusca", "GALLIUM", "Higaisa", "Lazarus Group", "MuddyWater", "Mustang Panda", "Naikon", "Patchwork", "SideCopy", "Sidewinder", "Threat Group-3390", "Tropic Trooper", "menuPass"]}, {"mitre_attack_id": "T1204.001", "mitre_attack_technique": "Malicious Link", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT33", "APT39", "BlackTech", "Cobalt Group", "Confucius", "EXOTIC LILY", "Earth Lusca", "Elderwood", "Ember Bear", "Evilnum", "FIN4", "FIN7", "FIN8", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Sandworm Team", "Sidewinder", "TA505", "Transparent Tribe", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1204", "mitre_attack_technique": "User Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["LAPSUS$"]}, {"mitre_attack_id": "T1112", "mitre_attack_technique": "Modify Registry", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "APT38", "APT41", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN8", "Gamaredon Group", "Gorgon Group", "Kimsuky", "Magic Hound", "Patchwork", "Silence", "TA505", "Threat Group-3390", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1055.001", "mitre_attack_technique": "Dynamic-link Library Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["BackdoorDiplomacy", "Lazarus Group", "Leviathan", "Putter Panda", "TA505", "Tropic Trooper", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1055.002", "mitre_attack_technique": "Portable Executable Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["Gorgon Group", "Rocke"]}, {"mitre_attack_id": "T1569", "mitre_attack_technique": "System Services", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1569.002", "mitre_attack_technique": "Service Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT32", "APT38", "APT39", "APT41", "Blue Mockingbird", "Chimera", "FIN6", "Ke3chang", "Silence", "Wizard Spider"]}, {"mitre_attack_id": "T1047", "mitre_attack_technique": "Windows Management Instrumentation", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT29", "APT32", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "Earth Lusca", "FIN6", "FIN7", "FIN8", "GALLIUM", "Gamaredon Group", "Indrik Spider", "Lazarus Group", "Leviathan", "Magic Hound", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "Stealth Falcon", "Threat Group-3390", "Windshift", "Wizard Spider", "menuPass"]}], "mitre_attack_tactics": ["Command And Control", "Defense Evasion", "Discovery", "Execution", "Initial Access", "Persistence", "Privilege Escalation", "Reconnaissance"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Delivery", "Exploitation", "Installation", "Reconnaissance"]}, "detection_names": ["ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Cmdline Tool Not Executed In CMD Shell - Rule", "ESCU - Cmdline Tool Not Executed In CMD Shell - Rule", "ESCU - Create Remote Thread In Shell Application - Rule", "ESCU - Disable Defender Spynet Reporting - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Network Connection Discovery With Arp - Rule", "ESCU - Network Connection Discovery With Netstat - Rule", "ESCU - Network Discovery Using Route Windows App - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Office Application Spawn Regsvr32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawn CMD Process - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks Run Task On Demand - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Suspicious Copy on System32 - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - System User Discovery With Whoami - Rule", "ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule", "ESCU - Windows App Layer Protocol Qakbot NamedPipe - Rule", "ESCU - Windows App Layer Protocol Wermgr Connect To NamedPipe - Rule", "ESCU - Windows Command Shell Fetch Env Variables - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows DLL Search Order Hijacking Hunt with Sysmon - Rule", "ESCU - Windows DLL Side-Loading In Calc - Rule", "ESCU - Windows DLL Side-Loading Process Child Of Calc - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Windows Masquerading Explorer As Child Process - Rule", "ESCU - Windows Modify Registry Qakbot Binary Data Registry - Rule", "ESCU - Windows Phishing Recent ISO Exec Registry - Rule", "ESCU - Windows Process Injection Of Wermgr to Known Browser - Rule", "ESCU - Windows Process Injection Remote Thread - Rule", "ESCU - Windows Process Injection Wermgr Child Process - Rule", "ESCU - Windows Regsvr32 Renamed Binary - Rule", "ESCU - Windows Schtasks Create Run As System - Rule", "ESCU - Windows Service Created with Suspicious Service Path - Rule", "ESCU - Windows System Discovery Using ldap Nslookup - Rule", "ESCU - Windows System Discovery Using Qwinsta - Rule", "ESCU - Windows WMI Impersonate Token - Rule", "ESCU - Windows WMI Process Call Create - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "CMD Carry Out String Command Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Command Shell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Cmdline Tool Not Executed In CMD Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "JavaScript"}]}}, {"name": "Cmdline Tool Not Executed In CMD Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "JavaScript"}]}}, {"name": "Create Remote Thread In Shell Application", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Disable Defender Spynet Reporting", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Executables Or Script Creation In Suspicious Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "Malicious PowerShell Process - Encoded Command", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Obfuscated Files or Information"}]}}, {"name": "Network Connection Discovery With Arp", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Connections Discovery"}]}}, {"name": "Network Connection Discovery With Netstat", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Connections Discovery"}]}}, {"name": "Network Discovery Using Route Windows App", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Configuration Discovery"}, {"mitre_attack_technique": "Internet Connection Discovery"}]}}, {"name": "NLTest Domain Trust Discovery", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Trust Discovery"}]}}, {"name": "Office Application Spawn Regsvr32 process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Document Executing Macro Code", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Spawn CMD Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Process Creating LNK file in Suspicious Location", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Link"}]}}, {"name": "Recon AVProduct Through Pwh or WMI", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Gather Victim Host Information"}]}}, {"name": "Recon Using WMI Class", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Gather Victim Host Information"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Registry Keys Used For Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Registry Run Keys / Startup Folder"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Regsvr32 with Known Silent Switch Cmdline", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvr32"}]}}, {"name": "Scheduled Task Deleted Or Created via CMD", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Schtasks Run Task On Demand", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Services LOLBAS Execution Process Spawn", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}, {"mitre_attack_technique": "Windows Service"}]}}, {"name": "Suspicious Copy on System32", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "Masquerading"}]}}, {"name": "Suspicious Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Suspicious Regsvr32 Register Suspicious Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvr32"}]}}, {"name": "System Processes Run From Unexpected Locations", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rename System Utilities"}]}}, {"name": "System User Discovery With Whoami", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Owner/User Discovery"}]}}, {"name": "Wermgr Process Spawned CMD Or Powershell Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Windows App Layer Protocol Qakbot NamedPipe", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Application Layer Protocol"}]}}, {"name": "Windows App Layer Protocol Wermgr Connect To NamedPipe", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Application Layer Protocol"}]}}, {"name": "Windows Command Shell Fetch Env Variables", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Windows Defender Exclusion Registry Entry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows DLL Search Order Hijacking Hunt with Sysmon", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DLL Search Order Hijacking"}, {"mitre_attack_technique": "Hijack Execution Flow"}]}}, {"name": "Windows DLL Side-Loading In Calc", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DLL Side-Loading"}, {"mitre_attack_technique": "Hijack Execution Flow"}]}}, {"name": "Windows DLL Side-Loading Process Child Of Calc", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DLL Side-Loading"}, {"mitre_attack_technique": "Hijack Execution Flow"}]}}, {"name": "Windows ISO LNK File Creation", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Malicious Link"}, {"mitre_attack_technique": "User Execution"}]}}, {"name": "Windows Masquerading Explorer As Child Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DLL Side-Loading"}, {"mitre_attack_technique": "Hijack Execution Flow"}]}}, {"name": "Windows Modify Registry Qakbot Binary Data Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Phishing Recent ISO Exec Registry", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}]}}, {"name": "Windows Process Injection Of Wermgr to Known Browser", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Dynamic-link Library Injection"}, {"mitre_attack_technique": "Process Injection"}]}}, {"name": "Windows Process Injection Remote Thread", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}, {"mitre_attack_technique": "Portable Executable Injection"}]}}, {"name": "Windows Process Injection Wermgr Child Process", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Windows Regsvr32 Renamed Binary", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Regsvr32"}, {"mitre_attack_technique": "System Binary Proxy Execution"}]}}, {"name": "Windows Schtasks Create Run As System", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Windows Service Created with Suspicious Service Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Services"}, {"mitre_attack_technique": "Service Execution"}]}}, {"name": "Windows System Discovery Using ldap Nslookup", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Owner/User Discovery"}]}}, {"name": "Windows System Discovery Using Qwinsta", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Owner/User Discovery"}]}}, {"name": "Windows WMI Impersonate Token", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation"}]}}, {"name": "Windows WMI Process Call Create", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation"}]}}, {"name": "WinEvent Windows Task Scheduler Event Action Started", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}]}}]}, {"name": "Ransomware", "id": "cf309d0d-d4aa-4fbb-963d-1e79febd3756", "version": 1, "date": "2020-02-04", "author": "David Dorsey, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.", "narrative": "Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware.", "references": ["https://web.archive.org/web/20190826231258/https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"], "tags": {"name": "Ransomware", "analytic_story": "Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1560.001", "mitre_attack_technique": "Archive via Utility", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT1", "APT28", "APT29", "APT3", "APT33", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Chimera", "CopyKittens", "Earth Lusca", "FIN8", "Fox Kitten", "GALLIUM", "Gallmaker", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "MuddyWater", "Mustang Panda", "Sowbug", "Turla", "menuPass"]}, {"mitre_attack_id": "T1560", "mitre_attack_technique": "Archive Collected Data", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT28", "APT32", "Axiom", "Dragonfly", "FIN6", "Ke3chang", "Lazarus Group", "Leviathan", "Patchwork", "menuPass"]}, {"mitre_attack_id": "T1562.007", "mitre_attack_technique": "Disable or Modify Cloud Firewall", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1548", "mitre_attack_technique": "Abuse Elevation Control Mechanism", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1490", "mitre_attack_technique": "Inhibit System Recovery", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1070.004", "mitre_attack_technique": "File Deletion", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT3", "APT32", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Chimera", "Cobalt Group", "Dragonfly", "Evilnum", "FIN10", "FIN5", "FIN6", "FIN8", "Gamaredon Group", "Group5", "Kimsuky", "Lazarus Group", "Magic Hound", "Mustang Panda", "OilRig", "Patchwork", "Rocke", "Sandworm Team", "Silence", "TEMP.Veles", "TeamTNT", "The White Company", "Threat Group-3390", "Tropic Trooper", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1070", "mitre_attack_technique": "Indicator Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Lazarus Group"]}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.003", "mitre_attack_technique": "CMSTP", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Cobalt Group", "MuddyWater"]}, {"mitre_attack_id": "T1485", "mitre_attack_technique": "Data Destruction", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "Gamaredon Group", "LAPSUS$", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1204", "mitre_attack_technique": "User Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["LAPSUS$"]}, {"mitre_attack_id": "T1020", "mitre_attack_technique": "Automated Exfiltration", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["Gamaredon Group", "Ke3chang", "Sidewinder", "Tropic Trooper"]}, {"mitre_attack_id": "T1087.002", "mitre_attack_technique": "Domain Account", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "BRONZE BUTLER", "Chimera", "Dragonfly", "FIN6", "Fox Kitten", "Ke3chang", "LAPSUS$", "Lazarus Group", "MuddyWater", "OilRig", "Poseidon Group", "Sandworm Team", "Turla", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1069.001", "mitre_attack_technique": "Local Groups", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["Chimera", "HEXANE", "OilRig", "Tonto Team", "Turla", "admin@338"]}, {"mitre_attack_id": "T1482", "mitre_attack_technique": "Domain Trust Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "Chimera", "Earth Lusca", "FIN8"]}, {"mitre_attack_id": "T1087.001", "mitre_attack_technique": "Local Account", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT1", "APT3", "APT32", "Chimera", "Fox Kitten", "Ke3chang", "Moses Staff", "OilRig", "Poseidon Group", "Threat Group-3390", "Turla", "admin@338"]}, {"mitre_attack_id": "T1087", "mitre_attack_technique": "Account Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29"]}, {"mitre_attack_id": "T1069.002", "mitre_attack_technique": "Domain Groups", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "Dragonfly", "Inception", "Ke3chang", "LAPSUS$", "OilRig", "Turla"]}, {"mitre_attack_id": "T1069", "mitre_attack_technique": "Permission Groups Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "APT3", "TA505"]}, {"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1070.001", "mitre_attack_technique": "Clear Windows Event Logs", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT32", "APT38", "APT41", "Chimera", "Dragonfly", "FIN5", "FIN8", "Indrik Spider"]}, {"mitre_attack_id": "T1489", "mitre_attack_technique": "Service Stop", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["Indrik Spider", "Lazarus Group", "Wizard Spider"]}, {"mitre_attack_id": "T1531", "mitre_attack_technique": "Account Access Removal", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["LAPSUS$"]}, {"mitre_attack_id": "T1569", "mitre_attack_technique": "System Services", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1569.002", "mitre_attack_technique": "Service Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT32", "APT38", "APT39", "APT41", "Blue Mockingbird", "Chimera", "FIN6", "Ke3chang", "Silence", "Wizard Spider"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1059.005", "mitre_attack_technique": "Visual Basic", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT32", "APT33", "APT37", "APT38", "APT39", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Earth Lusca", "FIN4", "FIN7", "Gamaredon Group", "Gorgon Group", "HEXANE", "Higaisa", "Inception", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "Transparent Tribe", "Turla", "WIRTE", "Windshift"]}, {"mitre_attack_id": "T1222", "mitre_attack_technique": "File and Directory Permissions Modification", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1491", "mitre_attack_technique": "Defacement", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1574.002", "mitre_attack_technique": "DLL Side-Loading", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT41", "BRONZE BUTLER", "BlackTech", "Chimera", "Earth Lusca", "GALLIUM", "Higaisa", "Lazarus Group", "MuddyWater", "Mustang Panda", "Naikon", "Patchwork", "SideCopy", "Sidewinder", "Threat Group-3390", "Tropic Trooper", "menuPass"]}, {"mitre_attack_id": "T1574", "mitre_attack_technique": "Hijack Execution Flow", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1027", "mitre_attack_technique": "Obfuscated Files or Information", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "Aquatic Panda", "BITTER", "BackdoorDiplomacy", "BlackOasis", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Earth Lusca", "Elderwood", "Ember Bear", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Group5", "HEXANE", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leafminer", "Leviathan", "Magic Hound", "Mofang", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Putter Panda", "Rocke", "Sandworm Team", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Transparent Tribe", "Tropic Trooper", "Turla", "Whitefly", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1027.005", "mitre_attack_technique": "Indicator Removal from Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT3", "Deep Panda", "GALLIUM", "OilRig", "Patchwork", "TEMP.Veles", "Turla"]}, {"mitre_attack_id": "T1546.015", "mitre_attack_technique": "Component Object Model Hijacking", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28"]}, {"mitre_attack_id": "T1546", "mitre_attack_technique": "Event Triggered Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1592", "mitre_attack_technique": "Gather Victim Host Information", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547.001", "mitre_attack_technique": "Registry Run Keys / Startup Folder", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Dark Caracal", "Darkhotel", "Dragonfly", "FIN10", "FIN6", "FIN7", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Putter Panda", "RTM", "Rocke", "Sidewinder", "Silence", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1047", "mitre_attack_technique": "Windows Management Instrumentation", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT29", "APT32", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "Earth Lusca", "FIN6", "FIN7", "FIN8", "GALLIUM", "Gamaredon Group", "Indrik Spider", "Lazarus Group", "Leviathan", "Magic Hound", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "Stealth Falcon", "Threat Group-3390", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1112", "mitre_attack_technique": "Modify Registry", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "APT38", "APT41", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN8", "Gamaredon Group", "Gorgon Group", "Kimsuky", "Magic Hound", "Patchwork", "Silence", "TA505", "Threat Group-3390", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1218.011", "mitre_attack_technique": "Rundll32", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "CopyKittens", "Gamaredon Group", "HAFNIUM", "Kimsuky", "Lazarus Group", "LazyScripter", "Magic Hound", "MuddyWater", "Sandworm Team", "TA505", "TA551"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1036.003", "mitre_attack_technique": "Rename System Utilities", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT32", "GALLIUM", "Lazarus Group", "menuPass"]}, {"mitre_attack_id": "T1218.007", "mitre_attack_technique": "Msiexec", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Machete", "Molerats", "Rancor", "TA505", "ZIRCONIUM"]}, {"mitre_attack_id": "T1486", "mitre_attack_technique": "Data Encrypted for Impact", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "APT41", "FIN7", "Indrik Spider", "TA505"]}, {"mitre_attack_id": "T1218.004", "mitre_attack_technique": "InstallUtil", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Mustang Panda", "menuPass"]}, {"mitre_attack_id": "T1588.002", "mitre_attack_technique": "Tool", "mitre_attack_tactics": ["Resource Development"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT19", "APT28", "APT29", "APT32", "APT33", "APT38", "APT39", "APT41", "Aoqin Dragon", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Carbanak", "Chimera", "Cleaver", "Cobalt Group", "CopyKittens", "DarkHydrus", "DarkVishnya", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN5", "FIN6", "Ferocious Kitten", "GALLIUM", "Gorgon Group", "HEXANE", "Inception", "IndigoZebra", "Ke3chang", "Kimsuky", "LAPSUS$", "Lazarus Group", "Leafminer", "Magic Hound", "Moses Staff", "MuddyWater", "POLONIUM", "Patchwork", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "TA505", "TEMP.Veles", "Threat Group-3390", "Thrip", "Turla", "WIRTE", "Whitefly", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1219", "mitre_attack_technique": "Remote Access Software", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["Carbanak", "Cobalt Group", "DarkVishnya", "Evilnum", "GOLD SOUTHFIELD", "Kimsuky", "MuddyWater", "Mustang Panda", "RTM", "Sandworm Team", "TeamTNT", "Thrip"]}, {"mitre_attack_id": "T1505", "mitre_attack_technique": "Server Software Component", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1505.003", "mitre_attack_technique": "Web Shell", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT38", "APT39", "BackdoorDiplomacy", "Deep Panda", "Dragonfly", "Fox Kitten", "GALLIUM", "HAFNIUM", "Kimsuky", "Leviathan", "Magic Hound", "Moses Staff", "OilRig", "Sandworm Team", "TEMP.Veles", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Volatile Cedar"]}, {"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}, {"mitre_attack_id": "T1048", "mitre_attack_technique": "Exfiltration Over Alternative Protocol", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1021.002", "mitre_attack_technique": "SMB/Windows Admin Shares", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT39", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "FIN8", "Fox Kitten", "Ke3chang", "Lazarus Group", "Moses Staff", "Orangeworm", "Sandworm Team", "Threat Group-1314", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1071", "mitre_attack_technique": "Application Layer Protocol", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["Dragonfly", "Magic Hound", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1071.001", "mitre_attack_technique": "Web Protocols", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Chimera", "Cobalt Group", "Confucius", "Dark Caracal", "FIN4", "FIN8", "Gamaredon Group", "HAFNIUM", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Mustang Panda", "OilRig", "Orangeworm", "Rancor", "Rocke", "Sandworm Team", "Sidewinder", "SilverTerrier", "Stealth Falcon", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "WIRTE", "Windshift", "Wizard Spider"]}], "mitre_attack_tactics": ["Collection", "Command And Control", "Defense Evasion", "Discovery", "Execution", "Exfiltration", "Impact", "Initial Access", "Lateral Movement", "Persistence", "Privilege Escalation", "Reconnaissance", "Resource Development"], "datamodels": ["Endpoint", "Network_Traffic"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Delivery", "Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Rundll32 LockWorkStation - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DiskCryptor Usage - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Raccine Scheduled Task Deletion - Rule", "ESCU - Windows Registry Modification for Safe Mode Persistence - Rule", "ESCU - Windows Remote Access Software Hunt - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - TOR Traffic - Rule"], "investigation_names": ["ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"], "baseline_names": ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Count of Unique IPs Connecting to Ports"], "author_company": "Splunk", "author_name": "David Dorsey", "detections": [{"name": "Scheduled tasks used in BadRabbit ransomware", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}]}}, {"name": "7zip CommandLine To SMB Share Path", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Archive via Utility"}, {"mitre_attack_technique": "Archive Collected Data"}]}}, {"name": "Allow File And Printing Sharing In Firewall", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Cloud Firewall"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Allow Network Discovery In Firewall", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Cloud Firewall"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Allow Operation with Consent Admin", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "BCDEdit Failure Recovery Modification", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Clear Unallocated Sector Using Cipher App", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File Deletion"}, {"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "CMLUA Or CMSTPLUA UAC Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "CMSTP"}]}}, {"name": "Common Ransomware Extensions", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Common Ransomware Notes", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Conti Common Exec parameter", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "User Execution"}]}}, {"name": "Delete ShadowCopy With PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Deleting Shadow Copies", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Detect RClone Command-Line Usage", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Automated Exfiltration"}]}}, {"name": "Detect Renamed RClone", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Automated Exfiltration"}]}}, {"name": "Detect SharpHound Command-Line Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Local Groups"}, {"mitre_attack_technique": "Domain Trust Discovery"}, {"mitre_attack_technique": "Local Account"}, {"mitre_attack_technique": "Account Discovery"}, {"mitre_attack_technique": "Domain Groups"}, {"mitre_attack_technique": "Permission Groups Discovery"}]}}, {"name": "Detect SharpHound File Modifications", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Local Groups"}, {"mitre_attack_technique": "Domain Trust Discovery"}, {"mitre_attack_technique": "Local Account"}, {"mitre_attack_technique": "Account Discovery"}, {"mitre_attack_technique": "Domain Groups"}, {"mitre_attack_technique": "Permission Groups Discovery"}]}}, {"name": "Detect SharpHound Usage", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Local Groups"}, {"mitre_attack_technique": "Domain Trust Discovery"}, {"mitre_attack_technique": "Local Account"}, {"mitre_attack_technique": "Account Discovery"}, {"mitre_attack_technique": "Domain Groups"}, {"mitre_attack_technique": "Permission Groups Discovery"}]}}, {"name": "Disable AMSI Through Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable ETW Through Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Logs Using WevtUtil", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}, {"mitre_attack_technique": "Clear Windows Event Logs"}]}}, {"name": "Disable Windows Behavior Monitoring", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Excessive Service Stop Attempt", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Service Stop"}]}}, {"name": "Excessive Usage Of Net App", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Access Removal"}]}}, {"name": "Excessive Usage Of SC Service Utility", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Services"}, {"mitre_attack_technique": "Service Execution"}]}}, {"name": "Execute Javascript With Jscript COM CLSID", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "Visual Basic"}]}}, {"name": "Fsutil Zeroing File", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "ICACLS Grant Command", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File and Directory Permissions Modification"}]}}, {"name": "Known Services Killed by Ransomware", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Modification Of Wallpaper", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Defacement"}]}}, {"name": "Msmpeng Application DLL Side Loading", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DLL Side-Loading"}, {"mitre_attack_technique": "Hijack Execution Flow"}]}}, {"name": "Permission Modification using Takeown App", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File and Directory Permissions Modification"}]}}, {"name": "Powershell Disable Security Monitoring", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Powershell Enable SMB1Protocol Feature", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Obfuscated Files or Information"}, {"mitre_attack_technique": "Indicator Removal from Tools"}]}}, {"name": "Powershell Execute COM Object", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Component Object Model Hijacking"}, {"mitre_attack_technique": "Event Triggered Execution"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Prevent Automatic Repair Mode using Bcdedit", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Recon AVProduct Through Pwh or WMI", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Gather Victim Host Information"}]}}, {"name": "Recursive Delete of Directory In Batch CMD", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File Deletion"}, {"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "Registry Keys Used For Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Registry Run Keys / Startup Folder"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Remote Process Instantiation via WMI", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation"}]}}, {"name": "Revil Common Exec Parameter", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "User Execution"}]}}, {"name": "Revil Registry Entry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Rundll32 LockWorkStation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Schtasks used for forcing a reboot", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Suspicious Event Log Service Behavior", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}, {"mitre_attack_technique": "Clear Windows Event Logs"}]}}, {"name": "Suspicious Scheduled Task from Public Directory", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Suspicious wevtutil Usage", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Clear Windows Event Logs"}, {"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "System Processes Run From Unexpected Locations", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rename System Utilities"}]}}, {"name": "UAC Bypass With Colorui COM Object", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "CMSTP"}]}}, {"name": "Uninstall App Using MsiExec", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Msiexec"}, {"mitre_attack_technique": "System Binary Proxy Execution"}]}}, {"name": "USN Journal Deletion", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "WBAdmin Delete System Backups", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Wbemprox COM Object Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "CMSTP"}]}}, {"name": "Windows Disable Change Password Through Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Disable Lock Workstation Feature Through Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Disable LogOff Button Through Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Disable Memory Crash Dump", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Windows Disable Shutdown Button Through Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Disable Windows Group Policy Features Through Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows DiskCryptor Usage", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Encrypted for Impact"}]}}, {"name": "Windows DotNet Binary in Non Standard Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "InstallUtil"}]}}, {"name": "Windows Event Log Cleared", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}, {"mitre_attack_technique": "Clear Windows Event Logs"}]}}, {"name": "Windows Hide Notification Features Through Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows InstallUtil in Non Standard Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "InstallUtil"}]}}, {"name": "Windows NirSoft AdvancedRun", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Tool"}]}}, {"name": "Windows Raccine Scheduled Task Deletion", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}]}}, {"name": "Windows Registry Modification for Safe Mode Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Registry Run Keys / Startup Folder"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Windows Remote Access Software Hunt", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Access Software"}]}}, {"name": "WinEvent Scheduled Task Created to Spawn Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "WinEvent Scheduled Task Created Within Public Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "MS Exchange Mailbox Replication service writing Active Server Pages", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "Web Shell"}, {"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Spike in File Writes", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "Unusually Long Command Line", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "Unusually Long Command Line - MLTK", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "Prohibited Network Traffic Allowed", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}, {"name": "SMB Traffic Spike", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "SMB/Windows Admin Shares"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "SMB Traffic Spike - MLTK", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "SMB/Windows Admin Shares"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "TOR Traffic", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Application Layer Protocol"}, {"mitre_attack_technique": "Web Protocols"}]}}]}, {"name": "BlackMatter Ransomware", "id": "0da348a3-78a0-412e-ab27-2de9dd7f9fee", "version": 1, "date": "2021-09-06", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the BlackMatter ransomware, including looking for file writes associated with BlackMatter, force safe mode boot, autadminlogon account registry modification and more.", "narrative": "BlackMatter ransomware campaigns targeting healthcare and other vertical sectors, involve the use of ransomware payloads along with exfiltration of data per HHS bulletin. Malicious actors demand payment for ransome of data and threaten deletion and exposure of exfiltrated data.", "references": ["https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/", "https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-gang-rises-from-the-ashes-of-darkside-revil/", "https://blog.malwarebytes.com/ransomware/2021/07/blackmatter-a-new-ransomware-group-claims-link-to-darkside-revil/"], "tags": {"name": "BlackMatter Ransomware", "analytic_story": "BlackMatter Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1552.002", "mitre_attack_technique": "Credentials in Registry", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT32"]}, {"mitre_attack_id": "T1552", "mitre_attack_technique": "Unsecured Credentials", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1490", "mitre_attack_technique": "Inhibit System Recovery", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1491", "mitre_attack_technique": "Defacement", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1486", "mitre_attack_technique": "Data Encrypted for Impact", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "APT41", "FIN7", "Indrik Spider", "TA505"]}], "mitre_attack_tactics": ["Credential Access", "Impact"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Add DefaultUser And Password In Registry - Rule", "ESCU - Auto Admin Logon Registry Entry - Rule", "ESCU - Bcdedit Command Back To Normal Mode Boot - Rule", "ESCU - Change To Safe Mode With Network Config - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Ransomware Notes bulk creation - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Add DefaultUser And Password In Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Credentials in Registry"}, {"mitre_attack_technique": "Unsecured Credentials"}]}}, {"name": "Auto Admin Logon Registry Entry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Credentials in Registry"}, {"mitre_attack_technique": "Unsecured Credentials"}]}}, {"name": "Bcdedit Command Back To Normal Mode Boot", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Change To Safe Mode With Network Config", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Known Services Killed by Ransomware", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Modification Of Wallpaper", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Defacement"}]}}, {"name": "Ransomware Notes bulk creation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Encrypted for Impact"}]}}]}, {"name": "Chaos Ransomware", "id": "153d7b8f-27f2-4e4d-bae8-dfafd93a22a8", "version": 1, "date": "2023-01-11", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the Chaos ransomware, including looking for file writes (file encryption and ransomware notes), deleting shadow volume storage, registry key modification, dropping of files in startup folder, and more.", "narrative": "CHAOS ransomware has been seen and monitored since 2021. This ransomware is purportedly a .NET version of Ryuk ransomware but upon closer look to its code and behavior, this malware sample reveals that it doesn't share much relation to the notorious RYUK ransomware. This ransomware is one of the known ransomware that was used in the ongoing geo-political war. This ransomware is capable to check that only one copy of itself is running on the targeted host, delay of execution as part of its defense evasion technique, persistence through registry and startup folder, drop a copy of itself in each root drive of the targeted host and also in %appdata% folder and many more. As of writing this ransomware is still active and keeps on infecting Windows Operating machines and Windows networks.", "references": ["https://blog.qualys.com/vulnerabilities-threat-research/2022/01/17/the-chaos-ransomware-can-be-ravaging", "https://www.fortinet.com/blog/threat-research/chaos-ransomware-variant-in-fake-minecraft-alt-list-brings-destruction", "https://marcoramilli.com/2021/06/14/the-allegedly-ryuk-ransomware-builder-ryukjoke/", "https://www.trendmicro.com/en_us/research/21/h/chaos-ransomware-a-dangerous-proof-of-concept.html"], "tags": {"name": "Chaos Ransomware", "analytic_story": "Chaos Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1485", "mitre_attack_technique": "Data Destruction", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "Gamaredon Group", "LAPSUS$", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1490", "mitre_attack_technique": "Inhibit System Recovery", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1486", "mitre_attack_technique": "Data Encrypted for Impact", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "APT41", "FIN7", "Indrik Spider", "TA505"]}, {"mitre_attack_id": "T1547.001", "mitre_attack_technique": "Registry Run Keys / Startup Folder", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Dark Caracal", "Darkhotel", "Dragonfly", "FIN10", "FIN6", "FIN7", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Putter Panda", "RTM", "Rocke", "Sidewinder", "Silence", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1091", "mitre_attack_technique": "Replication Through Removable Media", "mitre_attack_tactics": ["Initial Access", "Lateral Movement"], "mitre_attack_groups": ["APT28", "Aoqin Dragon", "Darkhotel", "FIN7", "Mustang Panda", "Tropic Trooper"]}, {"mitre_attack_id": "T1204.002", "mitre_attack_technique": "Malicious File", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT-C-36", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "Ajax Security Team", "Andariel", "Aoqin Dragon", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "Dark Caracal", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Earth Lusca", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HEXANE", "Higaisa", "Inception", "IndigoZebra", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "PROMETHIUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Whitefly", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1204", "mitre_attack_technique": "User Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["LAPSUS$"]}], "mitre_attack_tactics": ["Defense Evasion", "Execution", "Impact", "Initial Access", "Lateral Movement", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Windows Boot or Logon Autostart Execution In Startup Folder - Rule", "ESCU - Windows Replication Through Removable Media - Rule", "ESCU - Windows User Execution Malicious URL Shortcut File - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "CMD Carry Out String Command Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Command Shell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Common Ransomware Notes", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Deleting Shadow Copies", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Executables Or Script Creation In Suspicious Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "Prevent Automatic Repair Mode using Bcdedit", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Ransomware Notes bulk creation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Encrypted for Impact"}]}}, {"name": "Registry Keys Used For Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Registry Run Keys / Startup Folder"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Suspicious Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "WBAdmin Delete System Backups", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Windows Boot or Logon Autostart Execution In Startup Folder", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Registry Run Keys / Startup Folder"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Windows Replication Through Removable Media", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Replication Through Removable Media"}]}}, {"name": "Windows User Execution Malicious URL Shortcut File", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Malicious File"}, {"mitre_attack_technique": "User Execution"}]}}]}, {"name": "Clop Ransomware", "id": "5a6f6849-1a26-4fae-aa05-fa730556eeb6", "version": 1, "date": "2021-03-17", "author": "Rod Soto, Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the Clop ransomware, including looking for file writes associated with Clope, encrypting network shares, deleting and resizing shadow volume storage, registry key modification, deleting of security logs, and more.", "narrative": "Clop ransomware campaigns targeting healthcare and other vertical sectors, involve the use of ransomware payloads along with exfiltration of data per HHS bulletin. Malicious actors demand payment for ransome of data and threaten deletion and exposure of exfiltrated data.", "references": ["https://www.hhs.gov/sites/default/files/analyst-note-cl0p-tlp-white.pdf", "https://securityaffairs.co/wordpress/115250/data-breach/qualys-clop-ransomware.html", "https://www.darkreading.com/attacks-breaches/qualys-is-the-latest-victim-of-accellion-data-breach/d/d-id/1340323"], "tags": {"name": "Clop Ransomware", "analytic_story": "Clop Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1204", "mitre_attack_technique": "User Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["LAPSUS$"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1485", "mitre_attack_technique": "Data Destruction", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "Gamaredon Group", "LAPSUS$", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1490", "mitre_attack_technique": "Inhibit System Recovery", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1486", "mitre_attack_technique": "Data Encrypted for Impact", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "APT41", "FIN7", "Indrik Spider", "TA505"]}, {"mitre_attack_id": "T1070", "mitre_attack_technique": "Indicator Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Lazarus Group"]}, {"mitre_attack_id": "T1070.001", "mitre_attack_technique": "Clear Windows Event Logs", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT32", "APT38", "APT41", "Chimera", "Dragonfly", "FIN5", "FIN8", "Indrik Spider"]}, {"mitre_attack_id": "T1569", "mitre_attack_technique": "System Services", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1569.002", "mitre_attack_technique": "Service Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT32", "APT38", "APT39", "APT41", "Blue Mockingbird", "Chimera", "FIN6", "Ke3chang", "Silence", "Wizard Spider"]}], "mitre_attack_tactics": ["Defense Evasion", "Execution", "Impact", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - Clop Common Exec Parameter - Rule", "ESCU - Clop Ransomware Known Service Name - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - High Process Termination Frequency - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - Resize ShadowStorage volume - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows High File Deletion Frequency - Rule", "ESCU - Windows Service Created with Suspicious Service Path - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Teoderick Contreras, Splunk", "author_name": "Rod Soto", "detections": [{"name": "Clop Common Exec Parameter", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "User Execution"}]}}, {"name": "Clop Ransomware Known Service Name", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Common Ransomware Extensions", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Common Ransomware Notes", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Deleting Shadow Copies", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "High Process Termination Frequency", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Encrypted for Impact"}]}}, {"name": "Process Deleting Its Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "Ransomware Notes bulk creation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Encrypted for Impact"}]}}, {"name": "Resize ShadowStorage volume", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Suspicious Event Log Service Behavior", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}, {"mitre_attack_technique": "Clear Windows Event Logs"}]}}, {"name": "Suspicious wevtutil Usage", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Clear Windows Event Logs"}, {"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "Windows Event Log Cleared", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}, {"mitre_attack_technique": "Clear Windows Event Logs"}]}}, {"name": "Windows High File Deletion Frequency", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Windows Service Created with Suspicious Service Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Services"}, {"mitre_attack_technique": "Service Execution"}]}}]}, {"name": "Ransomware Cloud", "id": "f52f6c43-05f8-4b19-a9d3-5b8c56da91c2", "version": 1, "date": "2020-10-27", "author": "Rod Soto, David Dorsey, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features.", "narrative": "Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise.Cloud ransomware can be deployed by obtaining high privilege credentials from targeted users or resources.", "references": ["https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/", "https://github.com/d1vious/git-wild-hunt", "https://www.youtube.com/watch?v=PgzNib37g0M"], "tags": {"name": "Ransomware Cloud", "analytic_story": "Ransomware Cloud", "category": ["Malware"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1486", "mitre_attack_technique": "Data Encrypted for Impact", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "APT41", "FIN7", "Indrik Spider", "TA505"]}], "mitre_attack_tactics": ["Impact"], "datamodels": [], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task"], "baseline_names": [], "author_company": "David Dorsey, Splunk", "author_name": "Rod Soto", "detections": [{"name": "AWS Detect Users creating keys with encrypt policy without MFA", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Encrypted for Impact"}]}}, {"name": "AWS Detect Users with KMS keys performing encryption S3", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Encrypted for Impact"}]}}]}, {"name": "DarkSide Ransomware", "id": "507edc74-13d5-4339-878e-b9114ded1f35", "version": 1, "date": "2021-05-12", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", "references": ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations"], "tags": {"name": "DarkSide Ransomware", "analytic_story": "DarkSide Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1197", "mitre_attack_technique": "BITS Jobs", "mitre_attack_tactics": ["Defense Evasion", "Persistence"], "mitre_attack_groups": ["APT39", "APT41", "Leviathan", "Patchwork"]}, {"mitre_attack_id": "T1105", "mitre_attack_technique": "Ingress Tool Transfer", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "Chimera", "Cobalt Group", "Confucius", "Darkhotel", "Dragonfly", "Elderwood", "Ember Bear", "Evilnum", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "IndigoZebra", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "Rancor", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Turla", "Volatile Cedar", "WIRTE", "Whitefly", "Windshift", "Winnti Group", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.003", "mitre_attack_technique": "CMSTP", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Cobalt Group", "MuddyWater"]}, {"mitre_attack_id": "T1055", "mitre_attack_technique": "Process Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT32", "APT37", "APT41", "Cobalt Group", "Kimsuky", "PLATINUM", "Silence", "Turla"]}, {"mitre_attack_id": "T1490", "mitre_attack_technique": "Inhibit System Recovery", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1003.001", "mitre_attack_technique": "LSASS Memory", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT1", "APT28", "APT3", "APT32", "APT33", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Cleaver", "Earth Lusca", "FIN6", "FIN8", "Fox Kitten", "GALLIUM", "HAFNIUM", "Indrik Spider", "Ke3chang", "Kimsuky", "Leafminer", "Leviathan", "Magic Hound", "MuddyWater", "OilRig", "PLATINUM", "Sandworm Team", "Silence", "TEMP.Veles", "Threat Group-3390", "Whitefly"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021.002", "mitre_attack_technique": "SMB/Windows Admin Shares", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT39", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "FIN8", "Fox Kitten", "Ke3chang", "Lazarus Group", "Moses Staff", "Orangeworm", "Sandworm Team", "Threat Group-1314", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1020", "mitre_attack_technique": "Automated Exfiltration", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["Gamaredon Group", "Ke3chang", "Sidewinder", "Tropic Trooper"]}, {"mitre_attack_id": "T1569", "mitre_attack_technique": "System Services", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1569.002", "mitre_attack_technique": "Service Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT32", "APT38", "APT39", "APT41", "Blue Mockingbird", "Chimera", "FIN6", "Ke3chang", "Silence", "Wizard Spider"]}, {"mitre_attack_id": "T1486", "mitre_attack_technique": "Data Encrypted for Impact", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "APT41", "FIN7", "Indrik Spider", "TA505"]}, {"mitre_attack_id": "T1548.002", "mitre_attack_technique": "Bypass User Account Control", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT29", "APT37", "BRONZE BUTLER", "Cobalt Group", "Earth Lusca", "Evilnum", "MuddyWater", "Patchwork", "Threat Group-3390"]}, {"mitre_attack_id": "T1548", "mitre_attack_technique": "Abuse Elevation Control Mechanism", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Command And Control", "Credential Access", "Defense Evasion", "Execution", "Exfiltration", "Impact", "Lateral Movement", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Extraction of Registry Hives - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Windows Possible Credential Dumping - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "BITSAdmin Download File", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "BITS Jobs"}, {"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "CertUtil Download With URLCache and Split Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "CertUtil Download With VerifyCtl and Split Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "CMLUA Or CMSTPLUA UAC Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "CMSTP"}]}}, {"name": "Cobalt Strike Named Pipes", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Delete ShadowCopy With PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Detect Mimikatz Using Loaded Images", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Detect PsExec With accepteula Flag", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "SMB/Windows Admin Shares"}]}}, {"name": "Detect RClone Command-Line Usage", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Automated Exfiltration"}]}}, {"name": "Detect Renamed PSExec", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Services"}, {"mitre_attack_technique": "Service Execution"}]}}, {"name": "Detect Renamed RClone", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Automated Exfiltration"}]}}, {"name": "Extraction of Registry Hives", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Ransomware Notes bulk creation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Encrypted for Impact"}]}}, {"name": "SLUI RunAs Elevated", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "SLUI Spawning a Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Windows Possible Credential Dumping", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}]}, {"name": "LockBit Ransomware", "id": "67e5b98d-16d6-46a6-8d00-070a3d1a5cfc", "version": 1, "date": "2023-01-16", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the LockBit ransomware, including looking for file writes (file encryption and ransomware notes), deleting services, terminating processes, registry key modification and more.", "narrative": "LockBit ransomware was first seen in 2019. This ransomware was used by cybercriminal in targeting multiple sectors and organizations. Lockbit is one of the ransomware being offered as a Ransomware-as-a-Service(RaaS) and also known to affiliates to implement the 'double extortion' techniques by uploading the stolen and sensitive victim information to their dark website and then threatening to sell/release it in public if their demands are not met. LockBit Ransomware advertised opportunities for threat actors that could provide credential access via RDP and VPN. Aside from this it is also uses threat emulation like Cobalt Strike and Metasploit to gain foot hold to the targeted host and persist if needed.", "references": ["https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html", "https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/", "https://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom", "https://www.trendmicro.com/en_us/research/22/g/lockbit-ransomware-group-augments-its-latest-variant--lockbit-3-.html"], "tags": {"name": "LockBit Ransomware", "analytic_story": "LockBit Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.003", "mitre_attack_technique": "CMSTP", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Cobalt Group", "MuddyWater"]}, {"mitre_attack_id": "T1055", "mitre_attack_technique": "Process Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT32", "APT37", "APT41", "Cobalt Group", "Kimsuky", "PLATINUM", "Silence", "Turla"]}, {"mitre_attack_id": "T1485", "mitre_attack_technique": "Data Destruction", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "Gamaredon Group", "LAPSUS$", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1490", "mitre_attack_technique": "Inhibit System Recovery", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1070", "mitre_attack_technique": "Indicator Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Lazarus Group"]}, {"mitre_attack_id": "T1486", "mitre_attack_technique": "Data Encrypted for Impact", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "APT41", "FIN7", "Indrik Spider", "TA505"]}, {"mitre_attack_id": "T1491", "mitre_attack_technique": "Defacement", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1592", "mitre_attack_technique": "Gather Victim Host Information", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1112", "mitre_attack_technique": "Modify Registry", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "APT38", "APT41", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN8", "Gamaredon Group", "Gorgon Group", "Kimsuky", "Magic Hound", "Patchwork", "Silence", "TA505", "Threat Group-3390", "Turla", "Wizard Spider"]}], "mitre_attack_tactics": ["Defense Evasion", "Execution", "Impact", "Persistence", "Privilege Escalation", "Reconnaissance"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - High Process Termination Frequency - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - Windows Modify Registry Default Icon Setting - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "CMLUA Or CMSTPLUA UAC Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "CMSTP"}]}}, {"name": "Cobalt Strike Named Pipes", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Common Ransomware Extensions", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Common Ransomware Notes", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Deleting Shadow Copies", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Executables Or Script Creation In Suspicious Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "Fsutil Zeroing File", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "High Process Termination Frequency", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Encrypted for Impact"}]}}, {"name": "Known Services Killed by Ransomware", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Modification Of Wallpaper", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Defacement"}]}}, {"name": "Ransomware Notes bulk creation", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Encrypted for Impact"}]}}, {"name": "Recon Using WMI Class", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Gather Victim Host Information"}, {"mitre_attack_technique": "PowerShell"}]}}, {"name": "Suspicious Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "UAC Bypass With Colorui COM Object", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "CMSTP"}]}}, {"name": "Wbemprox COM Object Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "CMSTP"}]}}, {"name": "Windows Modify Registry Default Icon Setting", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}]}, {"name": "Prestige Ransomware", "id": "8b8d8506-b931-450c-b794-f24184ca1deb", "version": 1, "date": "2022-11-30", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the Prestige Ransomware", "narrative": "This story addresses Prestige ransomware. This ransomware payload seen by Microsoft Threat Intelligence Center(MSTIC) as a ransomware campaign targeting organization in the transportation and logistic industries in some countries. This ransomware campaign highlight the destructive attack to its target organization that directly supplies or transporting military and humanitarian services or assistance. MSTIC observed this ransomware has similarities in terms of its deployment techniques with CaddyWiper and HermeticWiper which is also known malware campaign impacted multiple targeted critical infrastructure organizations. This analytic story will provide techniques and analytics that may help SOC or security researchers to monitor this threat.", "references": ["https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"], "tags": {"name": "Prestige Ransomware", "analytic_story": "Prestige Ransomware", "category": ["Malware", "Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1546.001", "mitre_attack_technique": "Change Default File Association", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Kimsuky"]}, {"mitre_attack_id": "T1546", "mitre_attack_technique": "Event Triggered Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1485", "mitre_attack_technique": "Data Destruction", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "Gamaredon Group", "LAPSUS$", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1070", "mitre_attack_technique": "Indicator Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Lazarus Group"]}, {"mitre_attack_id": "T1070.005", "mitre_attack_technique": "Network Share Connection Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Threat Group-3390"]}, {"mitre_attack_id": "T1490", "mitre_attack_technique": "Inhibit System Recovery", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1069", "mitre_attack_technique": "Permission Groups Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "APT3", "TA505"]}, {"mitre_attack_id": "T1069.002", "mitre_attack_technique": "Domain Groups", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "Dragonfly", "Inception", "Ke3chang", "LAPSUS$", "OilRig", "Turla"]}, {"mitre_attack_id": "T1003.001", "mitre_attack_technique": "LSASS Memory", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT1", "APT28", "APT3", "APT32", "APT33", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Cleaver", "Earth Lusca", "FIN6", "FIN8", "Fox Kitten", "GALLIUM", "HAFNIUM", "Indrik Spider", "Ke3chang", "Kimsuky", "Leafminer", "Leviathan", "Magic Hound", "MuddyWater", "OilRig", "PLATINUM", "Sandworm Team", "Silence", "TEMP.Veles", "Threat Group-3390", "Whitefly"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1222", "mitre_attack_technique": "File and Directory Permissions Modification", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1531", "mitre_attack_technique": "Account Access Removal", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["LAPSUS$"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021.002", "mitre_attack_technique": "SMB/Windows Admin Shares", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT39", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "FIN8", "Fox Kitten", "Ke3chang", "Lazarus Group", "Moses Staff", "Orangeworm", "Sandworm Team", "Threat Group-1314", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1021.003", "mitre_attack_technique": "Distributed Component Object Model", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1047", "mitre_attack_technique": "Windows Management Instrumentation", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT29", "APT32", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "Earth Lusca", "FIN6", "FIN7", "FIN8", "GALLIUM", "Gamaredon Group", "Indrik Spider", "Lazarus Group", "Leviathan", "Magic Hound", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "Stealth Falcon", "Threat Group-3390", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1069.001", "mitre_attack_technique": "Local Groups", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["Chimera", "HEXANE", "OilRig", "Tonto Team", "Turla", "admin@338"]}, {"mitre_attack_id": "T1049", "mitre_attack_technique": "System Network Connections Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT1", "APT3", "APT32", "APT38", "APT41", "Andariel", "BackdoorDiplomacy", "Chimera", "Earth Lusca", "GALLIUM", "HEXANE", "Ke3chang", "Lazarus Group", "Magic Hound", "MuddyWater", "Mustang Panda", "OilRig", "Poseidon Group", "Sandworm Team", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1016", "mitre_attack_technique": "System Network Configuration Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT1", "APT19", "APT3", "APT32", "APT41", "Chimera", "Darkhotel", "Dragonfly", "Earth Lusca", "GALLIUM", "HEXANE", "Higaisa", "Ke3chang", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "SideCopy", "Sidewinder", "Stealth Falcon", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1016.001", "mitre_attack_technique": "Internet Connection Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "Gamaredon Group", "HEXANE", "Turla"]}, {"mitre_attack_id": "T1003.003", "mitre_attack_technique": "NTDS", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "Chimera", "Dragonfly", "FIN6", "Fox Kitten", "HAFNIUM", "Ke3chang", "LAPSUS$", "Mustang Panda", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1592", "mitre_attack_technique": "Gather Victim Host Information", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1003.005", "mitre_attack_technique": "Cached Domain Credentials", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT33", "Leafminer", "MuddyWater", "OilRig"]}, {"mitre_attack_id": "T1115", "mitre_attack_technique": "Clipboard Data", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT38", "APT39"]}, {"mitre_attack_id": "T1555", "mitre_attack_technique": "Credentials from Password Stores", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "APT33", "APT39", "Evilnum", "FIN6", "HEXANE", "Leafminer", "MuddyWater", "OilRig", "Stealth Falcon"]}, {"mitre_attack_id": "T1552.002", "mitre_attack_technique": "Credentials in Registry", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT32"]}, {"mitre_attack_id": "T1552", "mitre_attack_technique": "Unsecured Credentials", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1202", "mitre_attack_technique": "Indirect Command Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1082", "mitre_attack_technique": "System Information Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT18", "APT19", "APT29", "APT3", "APT32", "APT37", "APT38", "Aquatic Panda", "Blue Mockingbird", "Chimera", "Confucius", "Darkhotel", "Gamaredon Group", "HEXANE", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Sowbug", "Stealth Falcon", "TeamTNT", "Tropic Trooper", "Turla", "Windigo", "Windshift", "Wizard Spider", "ZIRCONIUM", "admin@338"]}, {"mitre_attack_id": "T1012", "mitre_attack_technique": "Query Registry", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT32", "APT39", "Chimera", "Dragonfly", "Fox Kitten", "Kimsuky", "Lazarus Group", "OilRig", "Stealth Falcon", "Threat Group-3390", "Turla", "ZIRCONIUM"]}, {"mitre_attack_id": "T1555.005", "mitre_attack_technique": "Password Managers", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Fox Kitten", "Threat Group-3390"]}, {"mitre_attack_id": "T1552.004", "mitre_attack_technique": "Private Keys", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1547.005", "mitre_attack_technique": "Security Support Provider", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1489", "mitre_attack_technique": "Service Stop", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["Indrik Spider", "Lazarus Group", "Wizard Spider"]}, {"mitre_attack_id": "T1558", "mitre_attack_technique": "Steal or Forge Kerberos Tickets", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1033", "mitre_attack_technique": "System Owner/User Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT37", "APT38", "APT39", "APT41", "Chimera", "Dragonfly", "Earth Lusca", "FIN10", "GALLIUM", "Gamaredon Group", "HEXANE", "Ke3chang", "Lazarus Group", "Magic Hound", "MuddyWater", "OilRig", "Patchwork", "Sandworm Team", "Sidewinder", "Stealth Falcon", "Threat Group-3390", "Tropic Trooper", "Windshift", "Wizard Spider", "ZIRCONIUM"]}], "mitre_attack_tactics": ["Collection", "Credential Access", "Defense Evasion", "Discovery", "Execution", "Impact", "Lateral Movement", "Persistence", "Privilege Escalation", "Reconnaissance"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - Change Default File Association - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Create or delete windows shares using net exe - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Domain Group Discovery With Net - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Excessive Usage Of Cacls App - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Executable File Written in Administrative SMB Share - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Net Localgroup Discovery - Rule", "ESCU - Network Connection Discovery With Arp - Rule", "ESCU - Network Connection Discovery With Net - Rule", "ESCU - Network Connection Discovery With Netstat - Rule", "ESCU - Network Discovery Using Route Windows App - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Windows Cached Domain Credentials Reg Query - Rule", "ESCU - Windows Change Default File Association For No File Ext - Rule", "ESCU - Windows ClipBoard Data via Get-ClipBoard - Rule", "ESCU - Windows Credentials from Password Stores Query - Rule", "ESCU - Windows Credentials in Registry Reg Query - Rule", "ESCU - Windows Indirect Command Execution Via Series Of Forfiles - Rule", "ESCU - Windows Information Discovery Fsutil - Rule", "ESCU - Windows Modify Registry Reg Restore - Rule", "ESCU - Windows Password Managers Discovery - Rule", "ESCU - Windows Private Keys Discovery - Rule", "ESCU - Windows Query Registry Reg Save - Rule", "ESCU - Windows Security Support Provider Reg Query - Rule", "ESCU - Windows Service Stop Via Net  and SC Application - Rule", "ESCU - Windows Steal or Forge Kerberos Tickets Klist - Rule", "ESCU - Windows System Network Config Discovery Display DNS - Rule", "ESCU - Windows System Network Connections Discovery Netsh - Rule", "ESCU - Windows System User Discovery Via Quser - Rule", "ESCU - Windows WMI Process And Service List - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Change Default File Association", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Change Default File Association"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "Common Ransomware Extensions", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Create or delete windows shares using net exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}, {"mitre_attack_technique": "Network Share Connection Removal"}]}}, {"name": "Deleting Shadow Copies", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Domain Group Discovery With Net", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Domain Groups"}]}}, {"name": "Dump LSASS via comsvcs DLL", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Excessive Usage Of Cacls App", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File and Directory Permissions Modification"}]}}, {"name": "Excessive Usage Of Net App", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Access Removal"}]}}, {"name": "Executable File Written in Administrative SMB Share", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "SMB/Windows Admin Shares"}]}}, {"name": "Impacket Lateral Movement Commandline Parameters", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "SMB/Windows Admin Shares"}, {"mitre_attack_technique": "Distributed Component Object Model"}, {"mitre_attack_technique": "Windows Management Instrumentation"}, {"mitre_attack_technique": "Windows Service"}]}}, {"name": "Net Localgroup Discovery", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Local Groups"}]}}, {"name": "Network Connection Discovery With Arp", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Connections Discovery"}]}}, {"name": "Network Connection Discovery With Net", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Connections Discovery"}]}}, {"name": "Network Connection Discovery With Netstat", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Connections Discovery"}]}}, {"name": "Network Discovery Using Route Windows App", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Configuration Discovery"}, {"mitre_attack_technique": "Internet Connection Discovery"}]}}, {"name": "Ntdsutil Export NTDS", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "NTDS"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Recon AVProduct Through Pwh or WMI", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Gather Victim Host Information"}]}}, {"name": "Scheduled Task Deleted Or Created via CMD", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Schtasks scheduling job on remote system", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Suspicious Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "WBAdmin Delete System Backups", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Windows Cached Domain Credentials Reg Query", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cached Domain Credentials"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Windows Change Default File Association For No File Ext", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Change Default File Association"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "Windows ClipBoard Data via Get-ClipBoard", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Clipboard Data"}]}}, {"name": "Windows Credentials from Password Stores Query", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Credentials from Password Stores"}]}}, {"name": "Windows Credentials in Registry Reg Query", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Credentials in Registry"}, {"mitre_attack_technique": "Unsecured Credentials"}]}}, {"name": "Windows Indirect Command Execution Via Series Of Forfiles", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indirect Command Execution"}]}}, {"name": "Windows Information Discovery Fsutil", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Information Discovery"}]}}, {"name": "Windows Modify Registry Reg Restore", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Query Registry"}]}}, {"name": "Windows Password Managers Discovery", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Managers"}]}}, {"name": "Windows Private Keys Discovery", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Private Keys"}, {"mitre_attack_technique": "Unsecured Credentials"}]}}, {"name": "Windows Query Registry Reg Save", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Query Registry"}]}}, {"name": "Windows Security Support Provider Reg Query", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Support Provider"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Windows Service Stop Via Net  and SC Application", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Service Stop"}]}}, {"name": "Windows Steal or Forge Kerberos Tickets Klist", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}]}}, {"name": "Windows System Network Config Discovery Display DNS", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Configuration Discovery"}]}}, {"name": "Windows System Network Connections Discovery Netsh", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Connections Discovery"}]}}, {"name": "Windows System User Discovery Via Quser", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Owner/User Discovery"}]}}, {"name": "Windows WMI Process And Service List", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation"}]}}, {"name": "WinEvent Scheduled Task Created Within Public Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "WinEvent Windows Task Scheduler Event Action Started", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}]}}]}, {"name": "Revil Ransomware", "id": "817cae42-f54b-457a-8a36-fbf45521e29e", "version": 1, "date": "2021-06-04", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the Revil ransomware, including looking for file writes associated with Revil, encrypting network shares, deleting shadow volume storage, registry key modification, deleting of security logs, and more.", "narrative": "Revil ransomware is a RaaS,that a single group may operates and manges the development of this ransomware. It involve the use of ransomware payloads along with exfiltration of data. Malicious actors demand payment for ransome of data and threaten deletion and exposure of exfiltrated data.", "references": ["https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"], "tags": {"name": "Revil Ransomware", "analytic_story": "Revil Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1562.007", "mitre_attack_technique": "Disable or Modify Cloud Firewall", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1490", "mitre_attack_technique": "Inhibit System Recovery", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1491", "mitre_attack_technique": "Defacement", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1574.002", "mitre_attack_technique": "DLL Side-Loading", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT41", "BRONZE BUTLER", "BlackTech", "Chimera", "Earth Lusca", "GALLIUM", "Higaisa", "Lazarus Group", "MuddyWater", "Mustang Panda", "Naikon", "Patchwork", "SideCopy", "Sidewinder", "Threat Group-3390", "Tropic Trooper", "menuPass"]}, {"mitre_attack_id": "T1574", "mitre_attack_technique": "Hijack Execution Flow", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1204", "mitre_attack_technique": "User Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["LAPSUS$"]}, {"mitre_attack_id": "T1112", "mitre_attack_technique": "Modify Registry", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "APT38", "APT41", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN8", "Gamaredon Group", "Gorgon Group", "Kimsuky", "Magic Hound", "Patchwork", "Silence", "TA505", "Threat Group-3390", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.003", "mitre_attack_technique": "CMSTP", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Cobalt Group", "MuddyWater"]}], "mitre_attack_tactics": ["Defense Evasion", "Execution", "Impact", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Wbemprox COM Object Execution - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Allow Network Discovery In Firewall", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Cloud Firewall"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Delete ShadowCopy With PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Disable Windows Behavior Monitoring", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Modification Of Wallpaper", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Defacement"}]}}, {"name": "Msmpeng Application DLL Side Loading", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DLL Side-Loading"}, {"mitre_attack_technique": "Hijack Execution Flow"}]}}, {"name": "Powershell Disable Security Monitoring", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Revil Common Exec Parameter", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "User Execution"}]}}, {"name": "Revil Registry Entry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Wbemprox COM Object Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "CMSTP"}]}}]}, {"name": "Ryuk Ransomware", "id": "507edc74-13d5-4339-878e-b9744ded1f35", "version": 1, "date": "2020-11-06", "author": "Jose Hernandez, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the Ryuk ransomware, including looking for file writes associated with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, suspicious psexec use, and more.", "narrative": "Cybersecurity Infrastructure Security Agency (CISA) released Alert (AA20-302A) on October 28th called Ransomware Activity Targeting the Healthcare and Public Health Sector. This alert details TTPs associated with ongoing and possible imminent attacks against the Healthcare sector, and is a joint advisory in coordination with other U.S. Government agencies. The objective of these malicious campaigns is to infiltrate targets in named sectors and to drop ransomware payloads, which will likely cause disruption of service and increase risk of actual harm to the health and safety of patients at hospitals, even with the aggravant of an ongoing COVID-19 pandemic. This document specifically refers to several crimeware exploitation frameworks, emphasizing the use of Ryuk ransomware as payload. The Ryuk ransomware payload is not new. It has been well documented and identified in multiple variants. Payloads need a carrier, and for Ryuk it has often been exploitation frameworks such as Cobalt Strike, or popular crimeware frameworks such as Emotet or Trickbot.", "references": ["https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html", "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"], "tags": {"name": "Ryuk Ransomware", "analytic_story": "Ryuk Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1490", "mitre_attack_technique": "Inhibit System Recovery", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1485", "mitre_attack_technique": "Data Destruction", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "Gamaredon Group", "LAPSUS$", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1482", "mitre_attack_technique": "Domain Trust Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "Chimera", "Earth Lusca", "FIN8"]}, {"mitre_attack_id": "T1486", "mitre_attack_technique": "Data Encrypted for Impact", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "APT41", "FIN7", "Indrik Spider", "TA505"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1489", "mitre_attack_technique": "Service Stop", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["Indrik Spider", "Lazarus Group", "Wizard Spider"]}, {"mitre_attack_id": "T1021.001", "mitre_attack_technique": "Remote Desktop Protocol", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT1", "APT29", "APT3", "APT39", "APT41", "Axiom", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "HEXANE", "Kimsuky", "Lazarus Group", "Leviathan", "Magic Hound", "OilRig", "Patchwork", "Silence", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Defense Evasion", "Discovery", "Execution", "Impact", "Lateral Movement", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint", "Network_Traffic"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - Windows connhost exe started forcefully - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task"], "baseline_names": ["ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Identify Systems Using Remote Desktop"], "author_company": "Splunk", "author_name": "Jose Hernandez", "detections": [{"name": "Windows connhost exe started forcefully", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Command Shell"}]}}, {"name": "BCDEdit Failure Recovery Modification", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Common Ransomware Extensions", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Common Ransomware Notes", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "NLTest Domain Trust Discovery", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Trust Discovery"}]}}, {"name": "Ryuk Test Files Detected", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Encrypted for Impact"}]}}, {"name": "Ryuk Wake on LAN Command", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "Windows Command Shell"}]}}, {"name": "Suspicious Scheduled Task from Public Directory", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "WBAdmin Delete System Backups", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Windows DisableAntiSpyware Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows Security Account Manager Stopped", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Service Stop"}]}}, {"name": "WinEvent Scheduled Task Created to Spawn Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "WinEvent Scheduled Task Created Within Public Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Spike in File Writes", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "Remote Desktop Network Bruteforce", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Desktop Protocol"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "Remote Desktop Network Traffic", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Desktop Protocol"}, {"mitre_attack_technique": "Remote Services"}]}}]}, {"name": "SamSam Ransomware", "id": "c4b89506-fbcf-4cb7-bfd6-527e54789604", "version": 1, "date": "2018-12-13", "author": "Rico Valdez, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more.", "narrative": "The first version of the SamSam ransomware (a.k.a. Samas or SamsamCrypt) was launched in 2015 by a group of Iranian threat actors. The malicious software has affected and continues to affect thousands of victims and has raised almost $6M in ransom.\\\nAlthough categorized under the heading of ransomware, SamSam campaigns have some importance distinguishing characteristics. Most notable is the fact that conventional ransomware is a numbers game. Perpetrators use a \"spray-and-pray\" approach with phishing campaigns or other mechanisms, charging a small ransom (typically under $1,000). The goal is to find a large number of victims willing to pay these mini-ransoms, adding up to a lucrative payday. They use relatively simple methods for infecting systems.\\\nSamSam attacks are different beasts. They have become progressively more targeted and skillful than typical ransomware attacks. First, malicious actors break into a victim's network, surveil it, then run the malware manually. The attacks are tailored to cause maximum damage and the threat actors usually demand amounts in the tens of thousands of dollars.\\\nIn a typical attack on one large healthcare organization in 2018, the company ended up paying a ransom of four Bitcoins, then worth $56,707. Reports showed that access to the company's files was restored within two hours of paying the sum.\\\nAccording to Sophos, SamSam previously leveraged  RDP to gain access to targeted networks via brute force. SamSam is not spread automatically, like other malware. It requires skill because it forces the attacker to adapt their tactics to the individual environment. Next, the actors escalate their privileges to admin level. They scan the networks for worthy targets, using conventional tools, such as PsExec or PaExec, to deploy/execute, quickly encrypting files.\\\nThis Analytic Story includes searches designed to help detect and investigate signs of the SamSam ransomware, such as the creation of fileswrites to system32, writes with tell-tale extensions, batch files written to system32, and evidence of brute-force attacks via RDP.", "references": ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"], "tags": {"name": "SamSam Ransomware", "analytic_story": "SamSam Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1036.005", "mitre_attack_technique": "Match Legitimate Name or Location", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT1", "APT28", "APT29", "APT32", "APT39", "APT41", "Aoqin Dragon", "BRONZE BUTLER", "BackdoorDiplomacy", "Blue Mockingbird", "Carbanak", "Chimera", "Darkhotel", "Earth Lusca", "FIN7", "Ferocious Kitten", "Fox Kitten", "Gamaredon Group", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Poseidon Group", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "Sowbug", "TEMP.Veles", "TeamTNT", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Whitefly", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1595", "mitre_attack_technique": "Active Scanning", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1204", "mitre_attack_technique": "User Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["LAPSUS$"]}, {"mitre_attack_id": "T1204.002", "mitre_attack_technique": "Malicious File", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT-C-36", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "Ajax Security Team", "Andariel", "Aoqin Dragon", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "Dark Caracal", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Earth Lusca", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HEXANE", "Higaisa", "Inception", "IndigoZebra", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "PROMETHIUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Whitefly", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1485", "mitre_attack_technique": "Data Destruction", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "Gamaredon Group", "LAPSUS$", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1490", "mitre_attack_technique": "Inhibit System Recovery", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021.002", "mitre_attack_technique": "SMB/Windows Admin Shares", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT39", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "FIN8", "Fox Kitten", "Ke3chang", "Lazarus Group", "Moses Staff", "Orangeworm", "Sandworm Team", "Threat Group-1314", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1569", "mitre_attack_technique": "System Services", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1569.002", "mitre_attack_technique": "Service Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT32", "APT38", "APT39", "APT41", "Blue Mockingbird", "Chimera", "FIN6", "Ke3chang", "Silence", "Wizard Spider"]}, {"mitre_attack_id": "T1486", "mitre_attack_technique": "Data Encrypted for Impact", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "APT41", "FIN7", "Indrik Spider", "TA505"]}, {"mitre_attack_id": "T1021.001", "mitre_attack_technique": "Remote Desktop Protocol", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT1", "APT29", "APT3", "APT39", "APT41", "Axiom", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "HEXANE", "Kimsuky", "Lazarus Group", "Leviathan", "Magic Hound", "OilRig", "Patchwork", "Silence", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1082", "mitre_attack_technique": "System Information Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT18", "APT19", "APT29", "APT3", "APT32", "APT37", "APT38", "Aquatic Panda", "Blue Mockingbird", "Chimera", "Confucius", "Darkhotel", "Gamaredon Group", "HEXANE", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Sowbug", "Stealth Falcon", "TeamTNT", "Tropic Trooper", "Turla", "Windigo", "Windshift", "Wizard Spider", "ZIRCONIUM", "admin@338"]}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Discovery", "Execution", "Impact", "Lateral Movement", "Reconnaissance"], "datamodels": ["Endpoint", "Network_Traffic", "Web"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Delivery", "Exploitation", "Installation", "Reconnaissance"]}, "detection_names": ["ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule"], "investigation_names": ["ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"], "baseline_names": ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Identify Systems Using Remote Desktop"], "author_company": "Splunk", "author_name": "Rico Valdez", "detections": [{"name": "Prohibited Software On Endpoint", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": []}}, {"name": "Attacker Tools On Endpoint", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Match Legitimate Name or Location"}, {"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "OS Credential Dumping"}, {"mitre_attack_technique": "Active Scanning"}]}}, {"name": "Batch File Write to System32", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "User Execution"}, {"mitre_attack_technique": "Malicious File"}]}}, {"name": "Common Ransomware Extensions", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Common Ransomware Notes", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Deleting Shadow Copies", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Detect PsExec With accepteula Flag", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "SMB/Windows Admin Shares"}]}}, {"name": "Detect Renamed PSExec", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Services"}, {"mitre_attack_technique": "Service Execution"}]}}, {"name": "File with Samsam Extension", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}, {"name": "Samsam Test File Write", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Encrypted for Impact"}]}}, {"name": "Spike in File Writes", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "Remote Desktop Network Bruteforce", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Desktop Protocol"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "Remote Desktop Network Traffic", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Desktop Protocol"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "Detect attackers scanning for vulnerable JBoss servers", "source": "web", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Information Discovery"}]}}, {"name": "Detect malicious requests to exploit JBoss servers", "source": "web", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}]}, {"name": "Remcos", "id": "2bd4aa08-b9a5-40cf-bfe5-7d43f13d496c", "version": 1, "date": "2021-09-23", "author": "Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the Remcos RAT trojan, including looking for file writes associated with its payload, screencapture, registry modification, UAC bypassed, persistence and data collection..", "narrative": "Remcos or Remote Control and Surveillance, marketed as a legitimate software for remotely managing Windows systems is now widely used in multiple malicious campaigns both APT and commodity malware by threat actors.", "references": ["https://success.trendmicro.com/solution/1123281-remcos-malware-information", "https://attack.mitre.org/software/S0332/", "https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos#:~:text=Remcos%20(acronym%20of%20Remote%20Control,used%20to%20remotely%20control%20computers.&text=Remcos%20can%20be%20used%20for,been%20used%20in%20hacking%20campaigns."], "tags": {"name": "Remcos", "analytic_story": "Remcos", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1548.002", "mitre_attack_technique": "Bypass User Account Control", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT29", "APT37", "BRONZE BUTLER", "Cobalt Group", "Earth Lusca", "Evilnum", "MuddyWater", "Patchwork", "Threat Group-3390"]}, {"mitre_attack_id": "T1548", "mitre_attack_technique": "Abuse Elevation Control Mechanism", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1059.007", "mitre_attack_technique": "JavaScript", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT32", "Cobalt Group", "Earth Lusca", "Ember Bear", "Evilnum", "FIN6", "FIN7", "Higaisa", "Indrik Spider", "Kimsuky", "LazyScripter", "Leafminer", "Molerats", "MuddyWater", "Sidewinder", "Silence", "TA505", "Turla"]}, {"mitre_attack_id": "T1055", "mitre_attack_technique": "Process Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT32", "APT37", "APT41", "Cobalt Group", "Kimsuky", "PLATINUM", "Silence", "Turla"]}, {"mitre_attack_id": "T1055.001", "mitre_attack_technique": "Dynamic-link Library Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["BackdoorDiplomacy", "Lazarus Group", "Leviathan", "Putter Panda", "TA505", "Tropic Trooper", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1218.010", "mitre_attack_technique": "Regsvr32", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "Blue Mockingbird", "Cobalt Group", "Deep Panda", "Inception", "Kimsuky", "Lazarus Group", "Leviathan", "TA551", "WIRTE"]}, {"mitre_attack_id": "T1112", "mitre_attack_technique": "Modify Registry", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "APT38", "APT41", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN8", "Gamaredon Group", "Gorgon Group", "Kimsuky", "Magic Hound", "Patchwork", "Silence", "TA505", "Threat Group-3390", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1555", "mitre_attack_technique": "Credentials from Password Stores", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "APT33", "APT39", "Evilnum", "FIN6", "HEXANE", "Leafminer", "MuddyWater", "OilRig", "Stealth Falcon"]}, {"mitre_attack_id": "T1555.003", "mitre_attack_technique": "Credentials from Web Browsers", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "APT3", "APT33", "APT37", "Ajax Security Team", "FIN6", "HEXANE", "Inception", "Kimsuky", "LAPSUS$", "Leafminer", "Molerats", "MuddyWater", "OilRig", "Patchwork", "Sandworm Team", "Stealth Falcon", "TA505", "ZIRCONIUM"]}, {"mitre_attack_id": "T1566", "mitre_attack_technique": "Phishing", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["Axiom", "GOLD SOUTHFIELD"]}, {"mitre_attack_id": "T1566.001", "mitre_attack_technique": "Spearphishing Attachment", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "IndigoZebra", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1070", "mitre_attack_technique": "Indicator Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Lazarus Group"]}, {"mitre_attack_id": "T1559.001", "mitre_attack_technique": "Component Object Model", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["Gamaredon Group", "MuddyWater"]}, {"mitre_attack_id": "T1547.001", "mitre_attack_technique": "Registry Run Keys / Startup Folder", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Dark Caracal", "Darkhotel", "Dragonfly", "FIN10", "FIN6", "FIN7", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Putter Panda", "RTM", "Rocke", "Sidewinder", "Silence", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1113", "mitre_attack_technique": "Screen Capture", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT28", "APT39", "BRONZE BUTLER", "Dark Caracal", "Dragonfly", "FIN7", "GOLD SOUTHFIELD", "Gamaredon Group", "Group5", "Magic Hound", "MuddyWater", "OilRig", "Silence"]}, {"mitre_attack_id": "T1059.005", "mitre_attack_technique": "Visual Basic", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT32", "APT33", "APT37", "APT38", "APT39", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Earth Lusca", "FIN4", "FIN7", "Gamaredon Group", "Gorgon Group", "HEXANE", "Higaisa", "Inception", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "Transparent Tribe", "Turla", "WIRTE", "Windshift"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1592", "mitre_attack_technique": "Gather Victim Host Information", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1204.001", "mitre_attack_technique": "Malicious Link", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT33", "APT39", "BlackTech", "Cobalt Group", "Confucius", "EXOTIC LILY", "Earth Lusca", "Elderwood", "Ember Bear", "Evilnum", "FIN4", "FIN7", "FIN8", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Sandworm Team", "Sidewinder", "TA505", "Transparent Tribe", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1204", "mitre_attack_technique": "User Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["LAPSUS$"]}, {"mitre_attack_id": "T1134.004", "mitre_attack_technique": "Parent PID Spoofing", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1134", "mitre_attack_technique": "Access Token Manipulation", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["Blue Mockingbird", "FIN6"]}], "mitre_attack_tactics": ["Collection", "Credential Access", "Defense Evasion", "Execution", "Initial Access", "Persistence", "Privilege Escalation", "Reconnaissance"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Jscript Execution Using Cscript App - Rule", "ESCU - Loading Of Dynwrapx Module - Rule", "ESCU - Malicious InProcServer32 Modification - Rule", "ESCU - Non Chrome Process Accessing Chrome Default Dir - Rule", "ESCU - Non Firefox Process Access Firefox Profile Dir - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawn CMD Process - Rule", "ESCU - Office Product Spawning Windows Script Host - Rule", "ESCU - Possible Browser Pass View Parameter - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Process Writing DynamicWrapperX - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Remcos client registry install entry - Rule", "ESCU - Remcos RAT File Creation in Remcos Folder - Rule", "ESCU - Suspicious Image Creation In Appdata Folder - Rule", "ESCU - Suspicious Process DNS Query Known Abuse Web Services - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Suspicious WAV file in Appdata Folder - Rule", "ESCU - System Info Gathering Using Dxdiag Application - Rule", "ESCU - Vbscript Execution Using Wscript App - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Windows Phishing Recent ISO Exec Registry - Rule", "ESCU - Winhlp32 Spawning a Process - Rule", "ESCU - Wscript Or Cscript Suspicious Child Process - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Add or Set Windows Defender Exclusion", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disabling Remote User Account Control", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Executables Or Script Creation In Suspicious Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "Jscript Execution Using Cscript App", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "JavaScript"}]}}, {"name": "Loading Of Dynwrapx Module", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}, {"mitre_attack_technique": "Dynamic-link Library Injection"}]}}, {"name": "Malicious InProcServer32 Modification", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Regsvr32"}, {"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Non Chrome Process Accessing Chrome Default Dir", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Credentials from Password Stores"}, {"mitre_attack_technique": "Credentials from Web Browsers"}]}}, {"name": "Non Firefox Process Access Firefox Profile Dir", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Credentials from Password Stores"}, {"mitre_attack_technique": "Credentials from Web Browsers"}]}}, {"name": "Office Document Executing Macro Code", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Spawn CMD Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Spawning Windows Script Host", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Possible Browser Pass View Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Credentials from Web Browsers"}, {"mitre_attack_technique": "Credentials from Password Stores"}]}}, {"name": "Powershell Windows Defender Exclusion Commands", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Process Deleting Its Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "Process Writing DynamicWrapperX", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "Component Object Model"}]}}, {"name": "Registry Keys Used For Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Registry Run Keys / Startup Folder"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Regsvr32 Silent and Install Param Dll Loading", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvr32"}]}}, {"name": "Regsvr32 with Known Silent Switch Cmdline", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvr32"}]}}, {"name": "Remcos client registry install entry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Remcos RAT File Creation in Remcos Folder", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Screen Capture"}]}}, {"name": "Suspicious Image Creation In Appdata Folder", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Screen Capture"}]}}, {"name": "Suspicious Process DNS Query Known Abuse Web Services", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Visual Basic"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Suspicious Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Suspicious WAV file in Appdata Folder", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Screen Capture"}]}}, {"name": "System Info Gathering Using Dxdiag Application", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Gather Victim Host Information"}]}}, {"name": "Vbscript Execution Using Wscript App", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Visual Basic"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Windows Defender Exclusion Registry Entry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows ISO LNK File Creation", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Malicious Link"}, {"mitre_attack_technique": "User Execution"}]}}, {"name": "Windows Phishing Recent ISO Exec Registry", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}]}}, {"name": "Winhlp32 Spawning a Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Wscript Or Cscript Suspicious Child Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}, {"mitre_attack_technique": "Create or Modify System Process"}, {"mitre_attack_technique": "Parent PID Spoofing"}, {"mitre_attack_technique": "Access Token Manipulation"}]}}]}, {"name": "Reverse Network Proxy", "id": "265e4127-21fd-43e4-adac-ec5d12274111", "version": 1, "date": "2022-11-16", "author": "Michael Haag, Splunk", "description": "The following analytic story describes applications that may be abused to reverse proxy back into an organization, either for persistence or remote access.", "narrative": "This analytic story covers tools like Ngrok which is a legitimate reverse proxy tool that can create a secure tunnel to servers located behind firewalls or on local machines that do not have a public IP. Ngrok in particular has been leveraged by threat actors in several campaigns including use for lateral movement and data exfiltration. There are many open source and closed/paid that fall into this reverse proxy category. The analytic story and complemented analytics will be released as more are identified.", "references": ["https://attack.mitre.org/software/S0508/", "https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf"], "tags": {"name": "Reverse Network Proxy", "analytic_story": "Reverse Network Proxy", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1572", "mitre_attack_technique": "Protocol Tunneling", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["Chimera", "Cobalt Group", "FIN6", "Fox Kitten", "Leviathan", "OilRig"]}, {"mitre_attack_id": "T1090", "mitre_attack_technique": "Proxy", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT41", "Blue Mockingbird", "CopyKittens", "Earth Lusca", "Fox Kitten", "LAPSUS$", "POLONIUM", "Sandworm Team", "Turla", "Windigo"]}, {"mitre_attack_id": "T1102", "mitre_attack_technique": "Web Service", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT32", "EXOTIC LILY", "Ember Bear", "FIN6", "FIN8", "Fox Kitten", "Gamaredon Group", "Inception", "LazyScripter", "Mustang Panda", "Rocke", "TeamTNT", "Turla"]}], "mitre_attack_tactics": ["Command And Control"], "datamodels": ["Endpoint", "Network_Resolution"], "kill_chain_phases": ["Command & Control"]}, "detection_names": ["ESCU - Linux Ngrok Reverse Proxy Usage - Rule", "ESCU - Windows Ngrok Reverse Proxy Usage - Rule", "ESCU - Ngrok Reverse Proxy on Network - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Linux Ngrok Reverse Proxy Usage", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Protocol Tunneling"}, {"mitre_attack_technique": "Proxy"}, {"mitre_attack_technique": "Web Service"}]}}, {"name": "Windows Ngrok Reverse Proxy Usage", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Protocol Tunneling"}, {"mitre_attack_technique": "Proxy"}, {"mitre_attack_technique": "Web Service"}]}}, {"name": "Ngrok Reverse Proxy on Network", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Protocol Tunneling"}, {"mitre_attack_technique": "Proxy"}, {"mitre_attack_technique": "Web Service"}]}}]}, {"name": "Router and Infrastructure Security", "id": "91c676cf-0b23-438d-abee-f6335e177e77", "version": 1, "date": "2017-09-12", "author": "Bhavin Patel, Splunk", "description": "Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers.", "narrative": "Networking devices, such as routers and switches, are often overlooked as resources that attackers will leverage to subvert an enterprise. Advanced threats actors have shown a proclivity to target these critical assets as a means to siphon and redirect network traffic, flash backdoored operating systems, and implement cryptographic weakened algorithms to more easily decrypt network traffic.\\\nThis Analytic Story helps you gain a better understanding of how your network devices are interacting with your hosts. By compromising your network devices, attackers can obtain direct access to the company's internal infrastructure&#151; effectively increasing the attack surface and accessing private services/data.", "references": ["https://web.archive.org/web/20210420020040/https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html", "https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html"], "tags": {"name": "Router and Infrastructure Security", "analytic_story": "Router and Infrastructure Security", "category": ["Best Practices"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1200", "mitre_attack_technique": "Hardware Additions", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["DarkVishnya"]}, {"mitre_attack_id": "T1498", "mitre_attack_technique": "Network Denial of Service", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT28"]}, {"mitre_attack_id": "T1557", "mitre_attack_technique": "Adversary-in-the-Middle", "mitre_attack_tactics": ["Collection", "Credential Access"], "mitre_attack_groups": ["Kimsuky"]}, {"mitre_attack_id": "T1557.002", "mitre_attack_technique": "ARP Cache Poisoning", "mitre_attack_tactics": ["Collection", "Credential Access"], "mitre_attack_groups": ["Cleaver"]}, {"mitre_attack_id": "T1542.005", "mitre_attack_technique": "TFTP Boot", "mitre_attack_tactics": ["Defense Evasion", "Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1542", "mitre_attack_technique": "Pre-OS Boot", "mitre_attack_tactics": ["Defense Evasion", "Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1020", "mitre_attack_technique": "Automated Exfiltration", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["Gamaredon Group", "Ke3chang", "Sidewinder", "Tropic Trooper"]}, {"mitre_attack_id": "T1020.001", "mitre_attack_technique": "Traffic Duplication", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Collection", "Credential Access", "Defense Evasion", "Exfiltration", "Impact", "Initial Access", "Persistence"], "datamodels": ["Authentication", "Network_Traffic"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect Traffic Mirroring - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Detect New Login Attempts to Routers", "source": "application", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}, {"name": "Detect ARP Poisoning", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Hardware Additions"}, {"mitre_attack_technique": "Network Denial of Service"}, {"mitre_attack_technique": "Adversary-in-the-Middle"}, {"mitre_attack_technique": "ARP Cache Poisoning"}]}}, {"name": "Detect IPv6 Network Infrastructure Threats", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Hardware Additions"}, {"mitre_attack_technique": "Network Denial of Service"}, {"mitre_attack_technique": "Adversary-in-the-Middle"}, {"mitre_attack_technique": "ARP Cache Poisoning"}]}}, {"name": "Detect Port Security Violation", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Hardware Additions"}, {"mitre_attack_technique": "Network Denial of Service"}, {"mitre_attack_technique": "Adversary-in-the-Middle"}, {"mitre_attack_technique": "ARP Cache Poisoning"}]}}, {"name": "Detect Rogue DHCP Server", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Hardware Additions"}, {"mitre_attack_technique": "Network Denial of Service"}, {"mitre_attack_technique": "Adversary-in-the-Middle"}]}}, {"name": "Detect Software Download To Network Device", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "TFTP Boot"}, {"mitre_attack_technique": "Pre-OS Boot"}]}}, {"name": "Detect Traffic Mirroring", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Hardware Additions"}, {"mitre_attack_technique": "Automated Exfiltration"}, {"mitre_attack_technique": "Network Denial of Service"}, {"mitre_attack_technique": "Traffic Duplication"}]}}]}, {"name": "Signed Binary Proxy Execution InstallUtil", "id": "9482a314-43dc-11ec-a3c9-acde48001122", "version": 1, "date": "2021-11-12", "author": "Michael Haag, Splunk", "description": "Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility.", "narrative": "InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. InstallUtil is digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\\Windows\\Microsoft.NET\\Framework\\v\\InstallUtil.exe and C:\\Windows\\Microsoft.NET\\Framework64\\v\\InstallUtil.exe. \\\nThere are multiple ways to instantiate InstallUtil and they are all outlined within Atomic Red Team - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md. Two specific ways may be used and that includes invoking via  installer assembly class constructor through .NET and via InstallUtil.exe. \\\nTypically, adversaries will utilize the most commonly found way to invoke via InstallUtil Uninstall method. \\\nNote that parallel processes, and parent process, play a role in how InstallUtil is being used. In particular, a developer using InstallUtil will spawn from VisualStudio. Adversaries, will spawn from non-standard processes like Explorer.exe, cmd.exe or PowerShell.exe. It's important to review the command-line to identify the DLL being loaded. \\\nParallel processes may also include csc.exe being used to compile a local `.cs` file. This file will be the input to the output. Developers usually do not build direct on the command shell, therefore this should raise suspicion.", "references": ["https://attack.mitre.org/techniques/T1218/004/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md"], "tags": {"name": "Signed Binary Proxy Execution InstallUtil", "analytic_story": "Signed Binary Proxy Execution InstallUtil", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1036.003", "mitre_attack_technique": "Rename System Utilities", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT32", "GALLIUM", "Lazarus Group", "menuPass"]}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.004", "mitre_attack_technique": "InstallUtil", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Mustang Panda", "menuPass"]}], "mitre_attack_tactics": ["Defense Evasion"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows InstallUtil Credential Theft - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows InstallUtil Remote Network Connection - Rule", "ESCU - Windows InstallUtil Uninstall Option - Rule", "ESCU - Windows InstallUtil Uninstall Option with Network - Rule", "ESCU - Windows InstallUtil URL in Command Line - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Windows DotNet Binary in Non Standard Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "InstallUtil"}]}}, {"name": "Windows InstallUtil Credential Theft", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "InstallUtil"}, {"mitre_attack_technique": "System Binary Proxy Execution"}]}}, {"name": "Windows InstallUtil in Non Standard Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "InstallUtil"}]}}, {"name": "Windows InstallUtil Remote Network Connection", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "InstallUtil"}, {"mitre_attack_technique": "System Binary Proxy Execution"}]}}, {"name": "Windows InstallUtil Uninstall Option", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "InstallUtil"}, {"mitre_attack_technique": "System Binary Proxy Execution"}]}}, {"name": "Windows InstallUtil Uninstall Option with Network", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "InstallUtil"}, {"mitre_attack_technique": "System Binary Proxy Execution"}]}}, {"name": "Windows InstallUtil URL in Command Line", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "InstallUtil"}, {"mitre_attack_technique": "System Binary Proxy Execution"}]}}]}, {"name": "Silver Sparrow", "id": "cb4f48fe-7699-11eb-af77-acde48001122", "version": 1, "date": "2021-02-24", "author": "Michael Haag, Splunk", "description": "Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking MacOS (Intel and M1) malicious software downloader utilizing JavaScript for execution and a launchAgent to establish persistence.", "narrative": "Silver Sparrow works is a dropper and uses typical persistence mechanisms on a Mac. It is cross platform, covering both Intel and Apple M1 architecture. To this date, no implant has been downloaded for malicious purposes. During installation of the update.pkg or updater.pkg file, the malicious software utilizes JavaScript to generate files and scripts on disk for persistence.These files later download a implant from an S3 bucket every hour. This analytic assists with identifying different types of macOS malware families establishing LaunchAgent persistence. Per SentinelOne source, it is predicted that Silver Sparrow is likely selling itself as a mechanism to 3rd party Caffiliates or pay-per-install (PPI) partners, typically seen as commodity adware/malware. Additional indicators and behaviors may be found within the references.", "references": ["https://redcanary.com/blog/clipping-silver-sparrows-wings/", "https://www.sentinelone.com/blog/5-things-you-need-to-know-about-silver-sparrow/"], "tags": {"name": "Silver Sparrow", "analytic_story": "Silver Sparrow", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1105", "mitre_attack_technique": "Ingress Tool Transfer", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "Chimera", "Cobalt Group", "Confucius", "Darkhotel", "Dragonfly", "Elderwood", "Ember Bear", "Evilnum", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "IndigoZebra", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "Rancor", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Turla", "Volatile Cedar", "WIRTE", "Whitefly", "Windshift", "Winnti Group", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1543.001", "mitre_attack_technique": "Launch Agent", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1074", "mitre_attack_technique": "Data Staged", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["Wizard Spider"]}], "mitre_attack_tactics": ["Collection", "Command And Control", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Suspicious Curl Network Connection - Rule", "ESCU - Suspicious PlistBuddy Usage - Rule", "ESCU - Suspicious PlistBuddy Usage via OSquery - Rule", "ESCU - Suspicious SQLite3 LSQuarantine Behavior - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Suspicious Curl Network Connection", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Suspicious PlistBuddy Usage", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Launch Agent"}, {"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Suspicious PlistBuddy Usage via OSquery", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Launch Agent"}, {"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Suspicious SQLite3 LSQuarantine Behavior", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Staged"}]}}]}, {"name": "Spearphishing Attachments", "id": "57226b40-94f3-4ce5-b101-a75f67759c27", "version": 1, "date": "2019-04-29", "author": "Splunk Research Team, Splunk", "description": "Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack.", "narrative": "Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \\\nAs most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely \"automate\" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \\\nWhile any kind of file may contain a malicious payload, some are more likely to be perceived as benign (and thus more often escape notice) by the average victim&#151;especially when the attacker sends an email that seems to be from one of their contacts. An example is Microsoft Office files. Most corporate users are familiar with documents with the following suffixes: .doc/.docx (MS Word), .xls/.xlsx (MS Excel), and .ppt/.pptx (MS PowerPoint), so they may click without a second thought, slashing a hole in their organizations' security. \\\nFollowing is a typical series of events, according to an [article by Trend Micro](https://blog.trendmicro.com/trendlabs-security-intelligence/rising-trend-attackers-using-lnk-files-download-malware/):\\\n1. Attacker sends a phishing email. Recipient downloads the attached file, which is typically a .docx or .zip file with an embedded .lnk file\\\n1. The .lnk file executes a PowerShell script\\\n1. Powershell executes a reverse shell, rendering the exploit successful </ol>As a side note, adversaries are likely to use a tool like Empire to craft and obfuscate payloads and their post-injection activities, such as [exfiltration, lateral movement, and persistence](https://github.com/EmpireProject/Empire).\\\nThis Analytic Story focuses on detecting signs that a malicious payload has been injected into your environment. For example, one search detects outlook.exe writing a .zip file. Another looks for suspicious .lnk files launching processes.", "references": ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"], "tags": {"name": "Spearphishing Attachments", "analytic_story": "Spearphishing Attachments", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1566", "mitre_attack_technique": "Phishing", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["Axiom", "GOLD SOUTHFIELD"]}, {"mitre_attack_id": "T1566.001", "mitre_attack_technique": "Spearphishing Attachment", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "IndigoZebra", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1566.002", "mitre_attack_technique": "Spearphishing Link", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT1", "APT28", "APT29", "APT3", "APT32", "APT33", "APT39", "BlackTech", "Cobalt Group", "Confucius", "EXOTIC LILY", "Earth Lusca", "Elderwood", "Ember Bear", "Evilnum", "FIN4", "FIN7", "FIN8", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Sandworm Team", "Sidewinder", "TA505", "Transparent Tribe", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1204.001", "mitre_attack_technique": "Malicious Link", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT33", "APT39", "BlackTech", "Cobalt Group", "Confucius", "EXOTIC LILY", "Earth Lusca", "Elderwood", "Ember Bear", "Evilnum", "FIN4", "FIN7", "FIN8", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Sandworm Team", "Sidewinder", "TA505", "Transparent Tribe", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1204", "mitre_attack_technique": "User Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["LAPSUS$"]}], "mitre_attack_tactics": ["Credential Access", "Execution", "Initial Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Installation", "Weaponization"]}, "detection_names": ["ESCU - Excel Spawning PowerShell - Rule", "ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Creating Schedule Task - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Office Product Spawning Windows Script Host - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Office Product Writing cab or inf - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Windows Office Product Spawning MSDT - Rule", "ESCU - Windows Phishing PDF File Executes URL Link - Rule", "ESCU - Windows Spearphishing Attachment Connect To None MS Office Domain - Rule", "ESCU - Windows Spearphishing Attachment Onenote Spawn Mshta - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule", "ESCU - Winword Spawning Windows Script Host - Rule", "ESCU - Gdrive suspicious file sharing - Rule", "ESCU - Gsuite suspicious calendar invite - Rule", "ESCU - Detect Outlook exe writing a zip file - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Splunk Research Team", "detections": [{"name": "Excel Spawning PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Excel Spawning Windows Script Host", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "MSHTML Module Load in Office Product", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Application Spawn rundll32 process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Document Creating Schedule Task", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Document Executing Macro Code", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Document Spawned Child Process To Download", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Spawning BITSAdmin", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Spawning CertUtil", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Spawning MSHTA", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Spawning Rundll32 with no DLL", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Spawning Windows Script Host", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Spawning Wmic", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Writing cab or inf", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Spawning Control", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Process Creating LNK file in Suspicious Location", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Link"}]}}, {"name": "Windows ISO LNK File Creation", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Malicious Link"}, {"mitre_attack_technique": "User Execution"}]}}, {"name": "Windows Office Product Spawning MSDT", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Windows Phishing PDF File Executes URL Link", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}]}}, {"name": "Windows Spearphishing Attachment Connect To None MS Office Domain", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}]}}, {"name": "Windows Spearphishing Attachment Onenote Spawn Mshta", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}]}}, {"name": "Winword Spawning Cmd", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Winword Spawning PowerShell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Winword Spawning Windows Script Host", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Gdrive suspicious file sharing", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}]}}, {"name": "Gsuite suspicious calendar invite", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}]}}, {"name": "Detect Outlook exe writing a zip file", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}]}, {"name": "Splunk Vulnerabilities", "id": "5354df00-dce2-48ac-9a64-8adb48006828", "version": 1, "date": "2022-03-28", "author": "Lou Stella, Splunk", "description": "Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product.", "narrative": "This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly.", "references": ["https://www.splunk.com/en_us/product-security/announcements.html"], "tags": {"name": "Splunk Vulnerabilities", "analytic_story": "Splunk Vulnerabilities", "category": ["Best Practices"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Application Security", "mitre_attack_enrichments": [{"mitre_attack_id": "T1083", "mitre_attack_technique": "File and Directory Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT3", "APT32", "APT38", "APT39", "APT41", "Aoqin Dragon", "BRONZE BUTLER", "Chimera", "Confucius", "Dark Caracal", "Darkhotel", "Dragonfly", "Fox Kitten", "Gamaredon Group", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "Leafminer", "Magic Hound", "MuddyWater", "Mustang Panda", "Patchwork", "Sandworm Team", "Sidewinder", "Sowbug", "TeamTNT", "Tropic Trooper", "Turla", "Windigo", "Winnti Group", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1189", "mitre_attack_technique": "Drive-by Compromise", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT19", "APT28", "APT32", "APT37", "APT38", "Andariel", "Axiom", "BRONZE BUTLER", "Dark Caracal", "Darkhotel", "Dragonfly", "Earth Lusca", "Elderwood", "Lazarus Group", "Leafminer", "Leviathan", "Machete", "Magic Hound", "PLATINUM", "PROMETHIUM", "Patchwork", "RTM", "Threat Group-3390", "Transparent Tribe", "Turla", "Windigo", "Windshift"]}, {"mitre_attack_id": "T1567", "mitre_attack_technique": "Exfiltration Over Web Service", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["APT28"]}, {"mitre_attack_id": "T1587.003", "mitre_attack_technique": "Digital Certificates", "mitre_attack_tactics": ["Resource Development"], "mitre_attack_groups": ["APT29", "PROMETHIUM"]}, {"mitre_attack_id": "T1498", "mitre_attack_technique": "Network Denial of Service", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT28"]}, {"mitre_attack_id": "T1499", "mitre_attack_technique": "Endpoint Denial of Service", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["Sandworm Team"]}, {"mitre_attack_id": "T1055", "mitre_attack_technique": "Process Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT32", "APT37", "APT41", "Cobalt Group", "Kimsuky", "PLATINUM", "Silence", "Turla"]}, {"mitre_attack_id": "T1001.003", "mitre_attack_technique": "Protocol Impersonation", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["Higaisa", "Lazarus Group"]}, {"mitre_attack_id": "T1588.004", "mitre_attack_technique": "Digital Certificates", "mitre_attack_tactics": ["Resource Development"], "mitre_attack_groups": ["BlackTech", "Lazarus Group", "Silent Librarian"]}, {"mitre_attack_id": "T1210", "mitre_attack_technique": "Exploitation of Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT28", "Dragonfly", "Earth Lusca", "FIN7", "Fox Kitten", "MuddyWater", "Threat Group-3390", "Tonto Team", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1548", "mitre_attack_technique": "Abuse Elevation Control Mechanism", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1087", "mitre_attack_technique": "Account Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29"]}, {"mitre_attack_id": "T1040", "mitre_attack_technique": "Network Sniffing", "mitre_attack_tactics": ["Credential Access", "Discovery"], "mitre_attack_groups": ["APT28", "APT33", "DarkVishnya", "Kimsuky", "Sandworm Team"]}], "mitre_attack_tactics": ["Command And Control", "Credential Access", "Defense Evasion", "Discovery", "Execution", "Exfiltration", "Impact", "Initial Access", "Lateral Movement", "Persistence", "Privilege Escalation", "Resource Development"], "datamodels": ["Endpoint", "Splunk_Audit"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk csrf in the ssg kvstore client endpoint - Rule", "ESCU - Splunk Data exfiltration from Analytics Workspace using sid query - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule", "ESCU - Splunk Improperly Formatted Parameter Crashes splunkd - Rule", "ESCU - Persistent XSS in RapidDiag through User Interface Views - Rule", "ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk RCE via Splunk Secure Gateway  Splunk Mobile alerts feature - Rule", "ESCU - Splunk Reflected XSS in the templates lists radio - Rule", "ESCU - Splunk risky Command Abuse disclosed february 2023 - Rule", "ESCU - Splunk Stored XSS via Data Model objectName field - Rule", "ESCU - Splunk unnecessary file extensions allowed by lookup table uploads - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Save table dialog header in search page - Rule", "ESCU - Splunk XSS via View - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Detect Risky SPL using Pretrained ML Model - Rule", "ESCU - Splunk Account Discovery Drilldown Dashboard Disclosure - Rule", "ESCU - Splunk Code Injection via custom dashboard leading to RCE - Rule", "ESCU - Splunk list all nonstandard admin accounts - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"], "investigation_names": [], "baseline_names": ["ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline"], "author_company": "Splunk", "author_name": "Lou Stella", "detections": [{"name": "Path traversal SPL injection", "source": "application", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File and Directory Discovery"}]}}, {"name": "Splunk Command and Scripting Interpreter Delete Usage", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Splunk Command and Scripting Interpreter Risky Commands", "source": "application", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Splunk Command and Scripting Interpreter Risky SPL MLTK", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Splunk csrf in the ssg kvstore client endpoint", "source": "application", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Drive-by Compromise"}]}}, {"name": "Splunk Data exfiltration from Analytics Workspace using sid query", "source": "application", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Web Service"}]}}, {"name": "Splunk Digital Certificates Infrastructure Version", "source": "application", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Digital Certificates"}]}}, {"name": "Splunk Digital Certificates Lack of Encryption", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Digital Certificates"}]}}, {"name": "Splunk DoS via Malformed S2S Request", "source": "application", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Network Denial of Service"}]}}, {"name": "Splunk Endpoint Denial of Service DoS Zip Bomb", "source": "application", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Endpoint Denial of Service"}]}}, {"name": "Splunk Improperly Formatted Parameter Crashes splunkd", "source": "application", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Endpoint Denial of Service"}]}}, {"name": "Persistent XSS in RapidDiag through User Interface Views", "source": "application", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Drive-by Compromise"}]}}, {"name": "Splunk Process Injection Forwarder Bundle Downloads", "source": "application", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Splunk Protocol Impersonation Weak Encryption Configuration", "source": "application", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Protocol Impersonation"}]}}, {"name": "Splunk protocol impersonation weak encryption selfsigned", "source": "application", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Digital Certificates"}]}}, {"name": "Splunk protocol impersonation weak encryption simplerequest", "source": "application", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Digital Certificates"}]}}, {"name": "Splunk RCE via Splunk Secure Gateway  Splunk Mobile alerts feature", "source": "application", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation of Remote Services"}]}}, {"name": "Splunk Reflected XSS in the templates lists radio", "source": "application", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Drive-by Compromise"}]}}, {"name": "Splunk risky Command Abuse disclosed february 2023", "source": "application", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Splunk Stored XSS via Data Model objectName field", "source": "application", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Drive-by Compromise"}]}}, {"name": "Splunk unnecessary file extensions allowed by lookup table uploads", "source": "application", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Drive-by Compromise"}]}}, {"name": "Splunk User Enumeration Attempt", "source": "application", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "Splunk XSS in Save table dialog header in search page", "source": "application", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Drive-by Compromise"}]}}, {"name": "Splunk XSS via View", "source": "application", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Drive-by Compromise"}]}}, {"name": "Open Redirect in Splunk Web", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}, {"name": "Splunk Enterprise Information Disclosure", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}, {"name": "Detect Risky SPL using Pretrained ML Model", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Splunk Account Discovery Drilldown Dashboard Disclosure", "source": "application", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Discovery"}]}}, {"name": "Splunk Code Injection via custom dashboard leading to RCE", "source": "application", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation of Remote Services"}]}}, {"name": "Splunk list all nonstandard admin accounts", "source": "application", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Drive-by Compromise"}]}}, {"name": "Splunk XSS in Monitoring Console", "source": "application", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Drive-by Compromise"}]}}, {"name": "Splunk Identified SSL TLS Certificates", "source": "network", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Network Sniffing"}]}}]}, {"name": "Spring4Shell CVE-2022-22965", "id": "dcc19913-6918-4ed2-bbba-a6b484c10ef4", "version": 1, "date": "2022-04-05", "author": "Michael Haag, Splunk", "description": "Spring4Shell is the nickname given to a zero-day vulnerability in the Spring Core Framework, a programming and configuration model for Java-based enterprise applications.", "narrative": "An attacker could exploit Spring4Shell by sending a specially crafted request to a vulnerable server. However, exploitation of Spring4Shell requires certain prerequisites, whereas the original Log4Shell vulnerability affected all versions of Log4j 2 using the default configuration. \\\nAccording to Spring, the following requirements were included in the vulnerability report, however the post cautions that there may be other ways in which this can be exploited so this may not be a complete list of requirements at this time: \\\n- Java Development Kit (JDK) 9 or greater \\\n- Apache Tomcat as the Servlet container \\\n- Packaged as a WAR \\\n- spring-webmvc or spring-webflux dependency \\\n", "references": ["https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability"], "tags": {"name": "Spring4Shell CVE-2022-22965", "analytic_story": "Spring4Shell CVE-2022-22965", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Application Security", "mitre_attack_enrichments": [{"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}, {"mitre_attack_id": "T1505.003", "mitre_attack_technique": "Web Shell", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT38", "APT39", "BackdoorDiplomacy", "Deep Panda", "Dragonfly", "Fox Kitten", "GALLIUM", "HAFNIUM", "Kimsuky", "Leviathan", "Magic Hound", "Moses Staff", "OilRig", "Sandworm Team", "TEMP.Veles", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Volatile Cedar"]}, {"mitre_attack_id": "T1505", "mitre_attack_technique": "Server Software Component", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Initial Access", "Persistence"], "datamodels": ["Endpoint", "Web"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Java Writing JSP File - Rule", "ESCU - Linux Java Spawning Shell - Rule", "ESCU - Spring4Shell Payload URL Request - Rule", "ESCU - Web JSP Request via URL - Rule", "ESCU - Web Spring4Shell HTTP Request Class Module - Rule", "ESCU - Web Spring Cloud Function FunctionRouter - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Java Writing JSP File", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Linux Java Spawning Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Spring4Shell Payload URL Request", "source": "web", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Web Shell"}, {"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Web JSP Request via URL", "source": "web", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Web Shell"}, {"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Web Spring4Shell HTTP Request Class Module", "source": "web", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "Web Spring Cloud Function FunctionRouter", "source": "web", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}]}, {"name": "SQL Injection", "id": "4f6632f5-449c-4686-80df-57625f59bab3", "version": 1, "date": "2017-09-19", "author": "Bhavin Patel, Splunk", "description": "Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters.", "narrative": "It is very common for attackers to inject SQL parameters into vulnerable web applications, which then interpret the malicious SQL statements.\\\nThis Analytic Story contains a search designed to identify attempts by attackers to leverage this technique to compromise a host and gain a foothold in the target environment.", "references": ["https://capec.mitre.org/data/definitions/66.html", "https://www.incapsula.com/web-application-security/sql-injection.html"], "tags": {"name": "SQL Injection", "analytic_story": "SQL Injection", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}], "mitre_attack_tactics": ["Initial Access"], "datamodels": ["Web"], "kill_chain_phases": ["Delivery"]}, "detection_names": ["ESCU - SQL Injection with Long URLs - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "SQL Injection with Long URLs", "source": "web", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}]}, {"name": "Suspicious AWS Login Activities", "id": "2e8948a5-5239-406b-b56b-6c59f1268af3", "version": 1, "date": "2019-05-01", "author": "Bhavin Patel, Splunk", "description": "Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. ", "narrative": "It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker.", "references": ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"], "tags": {"name": "Suspicious AWS Login Activities", "analytic_story": "Suspicious AWS Login Activities", "category": ["Cloud Security"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1586", "mitre_attack_technique": "Compromise Accounts", "mitre_attack_tactics": ["Resource Development"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1535", "mitre_attack_technique": "Unused/Unsupported Cloud Regions", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1586.003", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Resource Development"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1078.004", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Ke3chang", "LAPSUS$"]}], "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation", "Resource Development"], "datamodels": ["Authentication"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - AWS Successful Console Authentication From Multiple IPs - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect new user AWS Console Login - Rule"], "investigation_names": ["ESCU - AWS Investigate User Activities By ARN - Response Task"], "baseline_names": ["ESCU - Previously seen users in CloudTrail", "ESCU - Update previously seen users in CloudTrail"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "AWS Successful Console Authentication From Multiple IPs", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}, {"name": "Detect AWS Console Login by User from New City", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}, {"name": "Detect AWS Console Login by User from New Country", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}, {"name": "Detect AWS Console Login by User from New Region", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}, {"name": "Detect new user AWS Console Login", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}]}}]}, {"name": "Suspicious AWS S3 Activities", "id": "66732346-8fb0-407b-9633-da16756567d6", "version": 2, "date": "2018-07-24", "author": "Bhavin Patel, Splunk", "description": "Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.", "narrative": "As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\\\nAmazon's \"shared responsibility\" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\\\nAmong things to look out for are S3 access from unfamiliar locations and by unfamiliar users. Some of the searches in this Analytic Story help you detect suspicious behavior and others help you investigate more deeply, when the situation warrants.   ", "references": ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"], "tags": {"name": "Suspicious AWS S3 Activities", "analytic_story": "Suspicious AWS S3 Activities", "category": ["Cloud Security"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1530", "mitre_attack_technique": "Data from Cloud Storage", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["Fox Kitten"]}], "mitre_attack_tactics": ["Collection"], "datamodels": [], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule"], "investigation_names": ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"], "baseline_names": ["ESCU - Baseline of S3 Bucket deletion activity by ARN", "ESCU - Previously seen S3 bucket access by remote IP"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Detect New Open S3 buckets", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data from Cloud Storage"}]}}, {"name": "Detect New Open S3 Buckets over AWS CLI", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data from Cloud Storage"}]}}, {"name": "Detect S3 access from a new IP", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data from Cloud Storage"}]}}, {"name": "Detect Spike in S3 Bucket deletion", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data from Cloud Storage"}]}}]}, {"name": "Suspicious AWS Traffic", "id": "2e8948a5-5239-406b-b56b-6c50f2168af3", "version": 1, "date": "2018-05-07", "author": "Bhavin Patel, Splunk", "description": "Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC).", "narrative": "A virtual private cloud (VPC) is an on-demand managed cloud-computing service that isolates computing resources for each client. Inside the VPC container, the environment resembles a physical network. \\\nAmazon's VPC service enables you to launch EC2 instances and leverage other Amazon resources. The traffic that flows in and out of this VPC can be controlled via network access-control rules and security groups. Amazon also has a feature called VPC Flow Logs that enables you to log IP traffic going to and from the network interfaces in your VPC. This data is stored using Amazon CloudWatch Logs.\\\n Attackers may abuse the AWS infrastructure with insecure VPCs so they can co-opt AWS resources for command-and-control nodes, data exfiltration, and more. Once an EC2 instance is compromised, an attacker may initiate outbound network connections for malicious reasons. Monitoring these network traffic behaviors is crucial for understanding the type of traffic flowing in and out of your network and to alert you to suspicious activities.\\\nThe searches in this Analytic Story will monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors.", "references": ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"], "tags": {"name": "Suspicious AWS Traffic", "analytic_story": "Suspicious AWS Traffic", "category": ["Cloud Security"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [], "mitre_attack_tactics": [], "datamodels": [], "kill_chain_phases": ["Actions on Objectives", "Command & Control"]}, "detection_names": ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"], "investigation_names": ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"], "baseline_names": ["ESCU - Baseline of blocked outbound traffic from AWS"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Detect Spike in blocked Outbound Traffic from your AWS", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}]}, {"name": "Suspicious Cloud Authentication Activities", "id": "6380ebbb-55c5-4fce-b754-01fd565fb73c", "version": 1, "date": "2020-06-04", "author": "Rico Valdez, Splunk", "description": "Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. ", "narrative": "It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\\\nThis Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS.", "references": ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"], "tags": {"name": "Suspicious Cloud Authentication Activities", "analytic_story": "Suspicious Cloud Authentication Activities", "category": ["Cloud Security"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1586", "mitre_attack_technique": "Compromise Accounts", "mitre_attack_tactics": ["Resource Development"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1586.003", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Resource Development"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1535", "mitre_attack_technique": "Unused/Unsupported Cloud Regions", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1552", "mitre_attack_technique": "Unsecured Credentials", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Resource Development"], "datamodels": ["Authentication"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"], "baseline_names": ["ESCU - Previously Seen AWS Cross Account Activity - Initial", "ESCU - Previously Seen AWS Cross Account Activity - Update", "ESCU - Previously Seen Users in CloudTrail - Initial", "ESCU - Previously Seen Users In CloudTrail - Update"], "author_company": "Splunk", "author_name": "Rico Valdez", "detections": [{"name": "Detect AWS Console Login by User from New City", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}, {"name": "Detect AWS Console Login by User from New Country", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}, {"name": "Detect AWS Console Login by User from New Region", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Unused/Unsupported Cloud Regions"}]}}, {"name": "AWS Cross Account Activity From Previously Unseen Account", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "Detect AWS Console Login by New User", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compromise Accounts"}, {"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Unsecured Credentials"}]}}]}, {"name": "Suspicious Cloud Instance Activities", "id": "8168ca88-392e-42f4-85a2-767579c660ce", "version": 1, "date": "2020-08-25", "author": "David Dorsey, Splunk", "description": "Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.", "narrative": "Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities.", "references": ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"], "tags": {"name": "Suspicious Cloud Instance Activities", "analytic_story": "Suspicious Cloud Instance Activities", "category": ["Cloud Security"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1537", "mitre_attack_technique": "Transfer Data to Cloud Account", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1078.004", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Ke3chang", "LAPSUS$"]}, {"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}], "mitre_attack_tactics": ["Defense Evasion", "Exfiltration", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": ["Change"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule"], "investigation_names": ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial", "ESCU - Previously Seen Cloud Instance Modifications By User - Update"], "author_company": "Splunk", "author_name": "David Dorsey", "detections": [{"name": "Detect shared ec2 snapshot", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Transfer Data to Cloud Account"}]}}, {"name": "Abnormally High Number Of Cloud Instances Destroyed", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "Abnormally High Number Of Cloud Instances Launched", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "Cloud Instance Modified By Previously Unseen User", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Valid Accounts"}]}}]}, {"name": "Suspicious Cloud Provisioning Activities", "id": "51045ded-1575-4ba6-aef7-af6c73cffd86", "version": 1, "date": "2018-08-20", "author": "David Dorsey, Splunk", "description": "Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.", "narrative": "Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\\\nThis Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further.", "references": ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"], "tags": {"name": "Suspicious Cloud Provisioning Activities", "analytic_story": "Suspicious Cloud Provisioning Activities", "category": ["Cloud Security"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}], "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": ["Change"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task"], "baseline_names": ["ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial", "ESCU - Previously Seen Cloud Provisioning Activity Sources - Update"], "author_company": "Splunk", "author_name": "David Dorsey", "detections": [{"name": "Cloud Provisioning Activity From Previously Unseen City", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "Cloud Provisioning Activity From Previously Unseen Country", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "Cloud Provisioning Activity From Previously Unseen IP Address", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "Cloud Provisioning Activity From Previously Unseen Region", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}]}, {"name": "Suspicious Cloud User Activities", "id": "1ed5ce7d-5469-4232-92af-89d1a3595b39", "version": 1, "date": "2020-09-04", "author": "David Dorsey, Splunk", "description": "Detect and investigate suspicious activities by users and roles in your cloud environments.", "narrative": "It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\\\nIn addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage.", "references": ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"], "tags": {"name": "Suspicious Cloud User Activities", "analytic_story": "Suspicious Cloud User Activities", "category": ["Cloud Security"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1078.004", "mitre_attack_technique": "Cloud Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT33", "Ke3chang", "LAPSUS$"]}, {"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1580", "mitre_attack_technique": "Cloud Infrastructure Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1204", "mitre_attack_technique": "User Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["LAPSUS$"]}], "mitre_attack_tactics": ["Defense Evasion", "Discovery", "Execution", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": ["Change"], "kill_chain_phases": ["Actions on Objectives", "Reconnaissance"]}, "detection_names": ["ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS Lambda UpdateFunctionCode - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule"], "investigation_names": ["ESCU - AWS Investigate User Activities By ARN - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Infrastructure API Calls Per User", "ESCU - Baseline Of Cloud Security Group API Calls Per User", "ESCU - Previously Seen Cloud API Calls Per User Role - Initial", "ESCU - Previously Seen Cloud API Calls Per User Role - Update"], "author_company": "Splunk", "author_name": "David Dorsey", "detections": [{"name": "Abnormally High Number Of Cloud Infrastructure API Calls", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "AWS IAM AccessDenied Discovery Events", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Infrastructure Discovery"}]}}, {"name": "AWS Lambda UpdateFunctionCode", "source": "cloud", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "User Execution"}]}}, {"name": "Abnormally High Number Of Cloud Security Group API Calls", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cloud Accounts"}, {"mitre_attack_technique": "Valid Accounts"}]}}, {"name": "Cloud API Calls From Previously Unseen User Roles", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}]}}]}, {"name": "Suspicious Command-Line Executions", "id": "f4368ddf-d59f-4192-84f6-778ac5a3ffc7", "version": 2, "date": "2020-02-03", "author": "Bhavin Patel, Splunk", "description": "Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems.", "narrative": "The ability to execute arbitrary commands via the Windows CLI is a primary goal for the adversary. With access to the shell, an attacker can easily run scripts and interact with the target system. Often, attackers may only have limited access to the shell or may obtain access in unusual ways. In addition, malware may execute and interact with the CLI in ways that would be considered unusual and inconsistent with typical user activity. This provides defenders with opportunities to identify suspicious use and investigate, as appropriate. This Analytic Story contains various searches to help identify this suspicious activity, as well as others to aid you in deeper investigation.", "references": ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"], "tags": {"name": "Suspicious Command-Line Executions", "analytic_story": "Suspicious Command-Line Executions", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059.001", "mitre_attack_technique": "PowerShell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT38", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "CopyKittens", "DarkHydrus", "DarkVishnya", "Deep Panda", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "Inception", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Poseidon Group", "Sandworm Team", "Sidewinder", "Silence", "Stealth Falcon", "TA459", "TA505", "TEMP.Veles", "TeamTNT", "Threat Group-3390", "Thrip", "Tonto Team", "Turla", "WIRTE", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1036.003", "mitre_attack_technique": "Rename System Utilities", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT32", "GALLIUM", "Lazarus Group", "menuPass"]}], "mitre_attack_tactics": ["Defense Evasion", "Execution"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Exploitation"]}, "detection_names": ["ESCU - First time seen command line argument - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Potentially malicious code on commandline - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Detect suspicious processnames using a pretrained model in DSDL - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"], "baseline_names": ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "First time seen command line argument", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "PowerShell"}, {"mitre_attack_technique": "Windows Command Shell"}]}}, {"name": "Detect Prohibited Applications Spawning cmd exe", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "Windows Command Shell"}]}}, {"name": "Detect Use of cmd exe to Launch Script Interpreters", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "Windows Command Shell"}]}}, {"name": "Potentially malicious code on commandline", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Command Shell"}]}}, {"name": "System Processes Run From Unexpected Locations", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rename System Utilities"}]}}, {"name": "Detect suspicious processnames using a pretrained model in DSDL", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Unusually Long Command Line", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "Unusually Long Command Line - MLTK", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}]}, {"name": "Suspicious Compiled HTML Activity", "id": "a09db4d1-3827-4833-87b8-3a397e532119", "version": 1, "date": "2021-02-11", "author": "Michael Haag, Splunk", "description": "Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.", "narrative": "Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. CHM content is displayed using underlying components of the Internet Explorer browser loaded by the HTML Help executable program (hh.exe). \\\nHH.exe relies upon hhctrl.ocx to load CHM topics.This will load upon execution of a chm file. \\\nDuring investigation, review all parallel processes and child processes. It is possible for file modification events to occur and it is best to capture the CHM file and decompile it for further analysis. \\\nUpon usage of InfoTech Storage Handlers, ms-its, its, mk, itss.dll will load.", "references": ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://attack.mitre.org/techniques/T1218/001/", "https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa"], "tags": {"name": "Suspicious Compiled HTML Activity", "analytic_story": "Suspicious Compiled HTML Activity", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.001", "mitre_attack_technique": "Compiled HTML File", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT38", "APT41", "Dark Caracal", "OilRig", "Silence"]}], "mitre_attack_tactics": ["Defense Evasion"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Delivery"]}, "detection_names": ["ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule", "ESCU - Windows System Binary Proxy Execution Compiled HTML File Decompile - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Detect HTML Help Renamed", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Compiled HTML File"}]}}, {"name": "Detect HTML Help Spawn Child Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Compiled HTML File"}]}}, {"name": "Detect HTML Help URL in Command Line", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Compiled HTML File"}]}}, {"name": "Detect HTML Help Using InfoTech Storage Handlers", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Compiled HTML File"}]}}, {"name": "Windows System Binary Proxy Execution Compiled HTML File Decompile", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compiled HTML File"}, {"mitre_attack_technique": "System Binary Proxy Execution"}]}}]}, {"name": "Suspicious DNS Traffic", "id": "3c3835c0-255d-4f9e-ab84-e29ec9ec9b56", "version": 1, "date": "2017-09-18", "author": "Rico Valdez, Splunk", "description": "Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses.", "narrative": "Although DNS is one of the fundamental underlying protocols that make the Internet work, it is often ignored (perhaps because of its complexity and effectiveness).  However, attackers have discovered ways to abuse the protocol to meet their objectives. One potential abuse involves manipulating DNS to hijack traffic and redirect it to an IP address under the attacker's control. This could inadvertently send users intending to visit google.com, for example, to an unrelated malicious website. Another technique involves using the DNS protocol for command-and-control activities with the attacker's malicious code or to covertly exfiltrate data. The searches within this Analytic Story look for these types of abuses.", "references": ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"], "tags": {"name": "Suspicious DNS Traffic", "analytic_story": "Suspicious DNS Traffic", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1048.003", "mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["APT32", "APT33", "FIN6", "FIN8", "Lazarus Group", "OilRig", "Thrip", "Wizard Spider"]}, {"mitre_attack_id": "T1071.004", "mitre_attack_technique": "DNS", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT18", "APT39", "APT41", "Chimera", "Cobalt Group", "FIN7", "Ke3chang", "LazyScripter", "OilRig", "Tropic Trooper"]}, {"mitre_attack_id": "T1048", "mitre_attack_technique": "Exfiltration Over Alternative Protocol", "mitre_attack_tactics": ["Exfiltration"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1568.002", "mitre_attack_technique": "Domain Generation Algorithms", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT41", "TA551"]}, {"mitre_attack_id": "T1071", "mitre_attack_technique": "Application Layer Protocol", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["Dragonfly", "Magic Hound", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1189", "mitre_attack_technique": "Drive-by Compromise", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT19", "APT28", "APT32", "APT37", "APT38", "Andariel", "Axiom", "BRONZE BUTLER", "Dark Caracal", "Darkhotel", "Dragonfly", "Earth Lusca", "Elderwood", "Lazarus Group", "Leafminer", "Leviathan", "Machete", "Magic Hound", "PLATINUM", "PROMETHIUM", "Patchwork", "RTM", "Threat Group-3390", "Transparent Tribe", "Turla", "Windigo", "Windshift"]}], "mitre_attack_tactics": ["Command And Control", "Exfiltration", "Initial Access"], "datamodels": ["Endpoint", "Network_Resolution"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Exploitation"]}, "detection_names": ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Detect DGA domains using pretrained model in DSDL - Rule", "ESCU - Detect suspicious DNS TXT records using pretrained model in DSDL - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule"], "investigation_names": ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"], "baseline_names": ["ESCU - Baseline of DNS Query Length - MLTK"], "author_company": "Splunk", "author_name": "Rico Valdez", "detections": [{"name": "Clients Connecting to Multiple DNS Servers", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}]}}, {"name": "Detect Long DNS TXT Record Response", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}]}}, {"name": "Detection of DNS Tunnels", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}]}}, {"name": "DNS Query Requests Resolved by Unauthorized DNS Servers", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DNS"}]}}, {"name": "DNS Exfiltration Using Nslookup App", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}, {"name": "Excessive Usage of NSLOOKUP App", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}, {"name": "Detect DGA domains using pretrained model in DSDL", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Generation Algorithms"}]}}, {"name": "Detect suspicious DNS TXT records using pretrained model in DSDL", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Generation Algorithms"}]}}, {"name": "DNS Query Length Outliers - MLTK", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DNS"}, {"mitre_attack_technique": "Application Layer Protocol"}]}}, {"name": "Excessive DNS Failures", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DNS"}, {"mitre_attack_technique": "Application Layer Protocol"}]}}, {"name": "Detect hosts connecting to dynamic domain providers", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Drive-by Compromise"}]}}, {"name": "DNS Query Length With High Standard Deviation", "source": "network", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exfiltration Over Unencrypted Non-C2 Protocol"}, {"mitre_attack_technique": "Exfiltration Over Alternative Protocol"}]}}]}, {"name": "Suspicious Emails", "id": "2b1800dd-92f9-47ec-a981-fdf1351e5d55", "version": 1, "date": "2020-01-27", "author": "Bhavin Patel, Splunk", "description": "Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story.", "narrative": "It is a common practice for attackers of all types to leverage targeted spearphishing campaigns and mass mailers to deliver weaponized email messages and attachments. Fortunately, there are a number of ways to monitor email data in Splunk to detect suspicious content.\\\nOnce a phishing message has been detected, the next steps are to answer the following questions: \\\n1. Which users have received this or a similar message in the past?\\\n1. When did the targeted campaign begin?\\\n1. Have any users interacted with the content of the messages (by downloading an attachment or clicking on a malicious URL)?This Analytic Story provides detection searches to identify suspicious emails, as well as contextual and investigative searches to help answer some of these questions.", "references": ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"], "tags": {"name": "Suspicious Emails", "analytic_story": "Suspicious Emails", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1566", "mitre_attack_technique": "Phishing", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["Axiom", "GOLD SOUTHFIELD"]}, {"mitre_attack_id": "T1566.001", "mitre_attack_technique": "Spearphishing Attachment", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "IndigoZebra", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}], "mitre_attack_tactics": ["Initial Access"], "datamodels": ["Email", "UEBA"], "kill_chain_phases": ["Delivery"]}, "detection_names": ["ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"], "investigation_names": ["ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"], "baseline_names": ["ESCU - DNSTwist Domain Names"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Suspicious Email - UBA Anomaly", "source": "deprecated", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}]}}, {"name": "Email Attachments With Lots Of Spaces", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "Monitor Email For Brand Abuse", "source": "application", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}, {"name": "Suspicious Email Attachment Extensions", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Spearphishing Attachment"}, {"mitre_attack_technique": "Phishing"}]}}]}, {"name": "Suspicious GCP Storage Activities", "id": "4d656b2e-d6be-11ea-87d0-0242ac130003", "version": 1, "date": "2020-08-05", "author": "Shannon Davis, Splunk", "description": "Use the searches in this Analytic Story to monitor your GCP Storage buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open storage buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.", "narrative": "Similar to other cloud providers, GCP operates on a shared responsibility model. This means the end user, you, are responsible for setting appropriate access control lists and permissions on your GCP resources.\\ This Analytics Story concentrates on detecting things like open storage buckets (both read and write) along with storage bucket access from unfamiliar users and IP addresses.", "references": ["https://cloud.google.com/blog/products/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security", "https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/"], "tags": {"name": "Suspicious GCP Storage Activities", "analytic_story": "Suspicious GCP Storage Activities", "category": ["Cloud Security"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1530", "mitre_attack_technique": "Data from Cloud Storage", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["Fox Kitten"]}], "mitre_attack_tactics": ["Collection"], "datamodels": [], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Detect New Open GCP Storage Buckets - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Shannon Davis", "detections": [{"name": "Detect GCP Storage access from a new IP", "source": "cloud", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data from Cloud Storage"}]}}, {"name": "Detect New Open GCP Storage Buckets", "source": "cloud", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data from Cloud Storage"}]}}]}, {"name": "Suspicious MSHTA Activity", "id": "1e5a5a53-540b-462a-8fb7-f44a4292f5dc", "version": 2, "date": "2021-01-20", "author": "Bhavin Patel, Michael Haag, Splunk", "description": "Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.", "narrative": "One common adversary tactic is to bypass application control solutions via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta suffix. In these cases, attackers use the trusted Windows utility to proxy execution of malicious files, whether an .hta application, javascript, or VBScript.\\\nThe searches in this story help you detect and investigate suspicious activity that may indicate that an attacker is leveraging mshta.exe to execute malicious code.\\\nTriage\\\nValidate execution \\\n1. Determine if MSHTA.exe executed. Validate the OriginalFileName of MSHTA.exe and further PE metadata. If executed outside of c:\\windows\\system32 or c:\\windows\\syswow64, it should be highly suspect.\\\n1. Determine if script code was executed with MSHTA.\\\nSituational Awareness\\\nThe objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSHTA.exe.\\\n1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\\\n1. Module loads. Are the known MSHTA.exe modules being loaded by a non-standard application? Is MSHTA loading any suspicious .DLLs?\\\n1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\\\nRetrieval of script code\\\nThe objective of this step is to confirm the executed script code is benign or malicious.", "references": ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/techniques/T1218/005/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5"], "tags": {"name": "Suspicious MSHTA Activity", "analytic_story": "Suspicious MSHTA Activity", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.005", "mitre_attack_technique": "Mshta", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "APT32", "Confucius", "Earth Lusca", "FIN7", "Gamaredon Group", "Inception", "Kimsuky", "Lazarus Group", "LazyScripter", "MuddyWater", "Mustang Panda", "SideCopy", "Sidewinder", "TA551"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1547.001", "mitre_attack_technique": "Registry Run Keys / Startup Folder", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Dark Caracal", "Darkhotel", "Dragonfly", "FIN10", "FIN6", "FIN7", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Putter Panda", "RTM", "Rocke", "Sidewinder", "Silence", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Defense Evasion", "Execution", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"], "baseline_names": ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"], "author_company": "Michael Haag, Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Detect mshta inline hta execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Mshta"}]}}, {"name": "Detect mshta renamed", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Mshta"}]}}, {"name": "Detect MSHTA Url in Command Line", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Mshta"}]}}, {"name": "Detect Prohibited Applications Spawning cmd exe", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "Windows Command Shell"}]}}, {"name": "Detect Rundll32 Inline HTA Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Mshta"}]}}, {"name": "Registry Keys Used For Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Registry Run Keys / Startup Folder"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Suspicious mshta child process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Mshta"}]}}, {"name": "Suspicious mshta spawn", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Mshta"}]}}]}, {"name": "Suspicious Okta Activity", "id": "9cbd34af-8f39-4476-a423-bacd126c750b", "version": 1, "date": "2020-04-02", "author": "Rico Valdez, Splunk", "description": "Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors.", "narrative": "Okta is the leading single sign on (SSO) provider, allowing users to authenticate once to Okta, and from there access a variety of web-based applications. These applications are assigned to users and allow administrators to centrally manage which users are allowed to access which applications. It also provides centralized logging to help understand how the applications are used and by whom. \\\nWhile SSO is a major convenience for users, it also provides attackers with an opportunity. If the attacker can gain access to Okta, they can access a variety of applications. As such monitoring the environment is important. \\\nWith people moving quickly to adopt web-based applications and ways to manage them, many are still struggling to understand how best to monitor these environments. This analytic story provides searches to help monitor this environment, and identify events and activity that warrant further investigation such as credential stuffing or password spraying attacks, and users logging in from multiple locations when travel is disallowed.", "references": ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"], "tags": {"name": "Suspicious Okta Activity", "analytic_story": "Suspicious Okta Activity", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1078", "mitre_attack_technique": "Valid Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT28", "APT29", "APT33", "APT39", "APT41", "Axiom", "Carbanak", "Chimera", "Dragonfly", "FIN10", "FIN4", "FIN5", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Ke3chang", "LAPSUS$", "Lazarus Group", "Leviathan", "OilRig", "POLONIUM", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "Suckfly", "TEMP.Veles", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1110", "mitre_attack_technique": "Brute Force", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT38", "APT39", "DarkVishnya", "Dragonfly", "FIN5", "Fox Kitten", "HEXANE", "Lazarus Group", "OilRig", "Turla"]}, {"mitre_attack_id": "T1078.001", "mitre_attack_technique": "Default Accounts", "mitre_attack_tactics": ["Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Initial Access", "Persistence", "Privilege Escalation"], "datamodels": ["Risk"], "kill_chain_phases": ["Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - Okta Risk Threshold Exceeded - Rule", "ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Locked Out - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta MFA Exhaustion Hunt - Rule", "ESCU - Okta New API Token Created - Rule", "ESCU - Okta New Device Enrolled on Account - Rule", "ESCU - Okta Suspicious Activity Reported - Rule", "ESCU - Okta ThreatInsight Threat Detected - Rule", "ESCU - Okta Two or More Rejected Okta Pushes - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule"], "investigation_names": ["ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate User Activities In Okta - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Rico Valdez", "detections": [{"name": "Okta Risk Threshold Exceeded", "source": "application", "type": "Correlation", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Brute Force"}]}}, {"name": "Multiple Okta Users With Invalid Credentials From The Same IP", "source": "application", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Default Accounts"}]}}, {"name": "Okta Account Locked Out", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Brute Force"}]}}, {"name": "Okta Account Lockout Events", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Default Accounts"}]}}, {"name": "Okta Failed SSO Attempts", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Default Accounts"}]}}, {"name": "Okta MFA Exhaustion Hunt", "source": "application", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Brute Force"}]}}, {"name": "Okta New API Token Created", "source": "application", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Default Accounts"}]}}, {"name": "Okta New Device Enrolled on Account", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Default Accounts"}]}}, {"name": "Okta Suspicious Activity Reported", "source": "application", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Default Accounts"}]}}, {"name": "Okta ThreatInsight Threat Detected", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Default Accounts"}]}}, {"name": "Okta Two or More Rejected Okta Pushes", "source": "application", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Brute Force"}]}}, {"name": "Okta User Logins From Multiple Cities", "source": "application", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Valid Accounts"}, {"mitre_attack_technique": "Default Accounts"}]}}]}, {"name": "Suspicious Regsvcs Regasm Activity", "id": "2cdf33a0-4805-4b61-b025-59c20f418fbe", "version": 1, "date": "2021-02-11", "author": "Michael Haag, Splunk", "description": "Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.", "narrative": " Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. The following queries assist with detecting suspicious and malicious usage of Regasm.exe and Regsvcs.exe. Upon reviewing usage of Regasm.exe Regsvcs.exe, review file modification events for possible script code written. Review parallel process events for csc.exe being utilized to compile script code.", "references": ["https://attack.mitre.org/techniques/T1218/009/", "https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/evasion/windows/applocker_evasion_regasm_regsvcs.md", "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/"], "tags": {"name": "Suspicious Regsvcs Regasm Activity", "analytic_story": "Suspicious Regsvcs Regasm Activity", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.009", "mitre_attack_technique": "Regsvcs/Regasm", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Defense Evasion"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Detect Regasm with Network Connection - Rule", "ESCU - Detect Regasm with no Command Line Arguments - Rule", "ESCU - Detect Regsvcs Spawning a Process - Rule", "ESCU - Detect Regsvcs with Network Connection - Rule", "ESCU - Detect Regsvcs with No Command Line Arguments - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Detect Regasm Spawning a Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvcs/Regasm"}]}}, {"name": "Detect Regasm with Network Connection", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvcs/Regasm"}]}}, {"name": "Detect Regasm with no Command Line Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvcs/Regasm"}]}}, {"name": "Detect Regsvcs Spawning a Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvcs/Regasm"}]}}, {"name": "Detect Regsvcs with Network Connection", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvcs/Regasm"}]}}, {"name": "Detect Regsvcs with No Command Line Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvcs/Regasm"}]}}]}, {"name": "Suspicious Regsvr32 Activity", "id": "b8bee41e-624f-11eb-ae93-0242ac130002", "version": 1, "date": "2021-01-29", "author": "Michael Haag, Splunk", "description": "Monitor and detect techniques used by attackers who leverage the regsvr32.exe process to execute malicious code.", "narrative": "One common adversary tactic is to bypass application control solutions via the regsvr32.exe process. This particular bypass was popularized with \"SquiblyDoo\" using the \"scrobj.dll\" dll to load .sct scriptlets. This technique is still widely used by adversaries to bypass detection and prevention controls. The file extension of the DLL is irrelevant (it may load a .txt file extension for example). The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging regsvr32.exe to execute malicious code. Validate execution Determine if regsvr32.exe executed. Validate the OriginalFileName of regsvr32.exe and further PE metadata. If executed outside of c:\\windows\\system32 or c:\\windows\\syswow64, it should be highly suspect. Determine if script code was executed with regsvr32. Situational Awareness - The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by regsvr32.exe. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? Module loads.  Is regsvr32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths. Network connections. Any network connections? Review the reputation of the remote IP or domain. Retrieval of Script Code - confirm the executed script code is benign or malicious.", "references": ["https://attack.mitre.org/techniques/T1218/010/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md", "https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/"], "tags": {"name": "Suspicious Regsvr32 Activity", "analytic_story": "Suspicious Regsvr32 Activity", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.010", "mitre_attack_technique": "Regsvr32", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "Blue Mockingbird", "Cobalt Group", "Deep Panda", "Inception", "Kimsuky", "Lazarus Group", "Leviathan", "TA551", "WIRTE"]}, {"mitre_attack_id": "T1112", "mitre_attack_technique": "Modify Registry", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "APT38", "APT41", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN8", "Gamaredon Group", "Gorgon Group", "Kimsuky", "Magic Hound", "Patchwork", "Silence", "TA505", "Threat Group-3390", "Turla", "Wizard Spider"]}], "mitre_attack_tactics": ["Defense Evasion"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - Malicious InProcServer32 Modification - Rule", "ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Detect Regsvr32 Application Control Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvr32"}]}}, {"name": "Malicious InProcServer32 Modification", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Regsvr32"}, {"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Regsvr32 Silent and Install Param Dll Loading", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvr32"}]}}, {"name": "Regsvr32 with Known Silent Switch Cmdline", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvr32"}]}}, {"name": "Suspicious Regsvr32 Register Suspicious Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Regsvr32"}]}}]}, {"name": "Suspicious Rundll32 Activity", "id": "80a65487-854b-42f1-80a1-935e4c170694", "version": 1, "date": "2021-02-03", "author": "Michael Haag, Splunk", "description": "Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code.", "narrative": "One common adversary tactic is to bypass application control solutions via the rundll32.exe process. Natively, rundll32.exe will load DLLs and is a great example of a Living off the Land Binary. Rundll32.exe may load malicious DLLs by ordinals, function names or directly. The queries in this story focus on loading default DLLs, syssetup.dll, ieadvpack.dll, advpack.dll and setupapi.dll from disk that may be abused by adversaries. Additionally, two analytics developed to assist with identifying DLLRegisterServer, Start and StartW functions being called. The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging rundll32.exe to execute malicious code.", "references": ["https://attack.mitre.org/techniques/T1218/011/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md", "https://lolbas-project.github.io/lolbas/Binaries/Rundll32"], "tags": {"name": "Suspicious Rundll32 Activity", "analytic_story": "Suspicious Rundll32 Activity", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1218.011", "mitre_attack_technique": "Rundll32", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "CopyKittens", "Gamaredon Group", "HAFNIUM", "Kimsuky", "Lazarus Group", "LazyScripter", "Magic Hound", "MuddyWater", "Sandworm Team", "TA505", "TA551"]}, {"mitre_attack_id": "T1036.003", "mitre_attack_technique": "Rename System Utilities", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT32", "GALLIUM", "Lazarus Group", "menuPass"]}, {"mitre_attack_id": "T1003.001", "mitre_attack_technique": "LSASS Memory", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT1", "APT28", "APT3", "APT32", "APT33", "APT39", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Cleaver", "Earth Lusca", "FIN6", "FIN8", "Fox Kitten", "GALLIUM", "HAFNIUM", "Indrik Spider", "Ke3chang", "Kimsuky", "Leafminer", "Leviathan", "Magic Hound", "MuddyWater", "OilRig", "PLATINUM", "Sandworm Team", "Silence", "TEMP.Veles", "Threat Group-3390", "Whitefly"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation"]}, "detection_names": ["ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Suspicious Rundll32 Rename", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rundll32"}, {"mitre_attack_technique": "Rename System Utilities"}]}}, {"name": "Detect Rundll32 Application Control Bypass - advpack", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Detect Rundll32 Application Control Bypass - setupapi", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Detect Rundll32 Application Control Bypass - syssetup", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Dump LSASS via comsvcs DLL", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Memory"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Rundll32 Control RunDLL Hunt", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Rundll32 Control RunDLL World Writable Directory", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Rundll32 with no Command Line Arguments with Network", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "RunDLL Loading DLL By Ordinal", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Suspicious Rundll32 dllregisterserver", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Suspicious Rundll32 StartW", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Suspicious Rundll32 no Command Line Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}]}, {"name": "Suspicious Windows Registry Activities", "id": "2b1800dd-92f9-47dd-a981-fdf1351e5d55", "version": 1, "date": "2018-05-31", "author": "Bhavin Patel, Splunk", "description": "Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system.", "narrative": "Attackers are developing increasingly sophisticated techniques for hijacking target servers, while evading detection. One such technique that has become progressively more common is registry modification.\\\n The registry is a key component of the Windows operating system. It has a hierarchical database called \"registry\" that contains settings, options, and values for executables. Once the threat actor gains access to a machine, they can use reg.exe to modify their account to obtain administrator-level privileges, maintain persistence, and move laterally within the environment.\\\n The searches in this story are designed to help you detect behaviors associated with manipulation of the Windows registry.", "references": ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"], "tags": {"name": "Suspicious Windows Registry Activities", "analytic_story": "Suspicious Windows Registry Activities", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1564.001", "mitre_attack_technique": "Hidden Files and Directories", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT32", "Lazarus Group", "Mustang Panda", "Rocke", "Transparent Tribe", "Tropic Trooper"]}, {"mitre_attack_id": "T1546.001", "mitre_attack_technique": "Change Default File Association", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Kimsuky"]}, {"mitre_attack_id": "T1548.002", "mitre_attack_technique": "Bypass User Account Control", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT29", "APT37", "BRONZE BUTLER", "Cobalt Group", "Earth Lusca", "Evilnum", "MuddyWater", "Patchwork", "Threat Group-3390"]}, {"mitre_attack_id": "T1548", "mitre_attack_technique": "Abuse Elevation Control Mechanism", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547.010", "mitre_attack_technique": "Port Monitors", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1546.011", "mitre_attack_technique": "Application Shimming", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["FIN7"]}, {"mitre_attack_id": "T1546", "mitre_attack_technique": "Event Triggered Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547.001", "mitre_attack_technique": "Registry Run Keys / Startup Folder", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Dark Caracal", "Darkhotel", "Dragonfly", "FIN10", "FIN6", "FIN7", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Putter Panda", "RTM", "Rocke", "Sidewinder", "Silence", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1546.012", "mitre_attack_technique": "Image File Execution Options Injection", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["TEMP.Veles"]}, {"mitre_attack_id": "T1218.005", "mitre_attack_technique": "Mshta", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "APT32", "Confucius", "Earth Lusca", "FIN7", "Gamaredon Group", "Inception", "Kimsuky", "Lazarus Group", "LazyScripter", "MuddyWater", "Mustang Panda", "SideCopy", "Sidewinder", "TA551"]}, {"mitre_attack_id": "T1574.011", "mitre_attack_technique": "Services Registry Permissions Weakness", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Windows Mshta Execution In Registry - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Reg exe used to hide files directories via registry keys", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Hidden Files and Directories"}]}}, {"name": "Remote Registry Key modifications", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}, {"name": "Suspicious Changes to File Associations", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Change Default File Association"}]}}, {"name": "Disable UAC Remote Restriction", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Disabling Remote User Account Control", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Monitor Registry Keys for Print Monitors", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Port Monitors"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Registry Keys for Creating SHIM Databases", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Application Shimming"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "Registry Keys Used For Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Registry Run Keys / Startup Folder"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Registry Keys Used For Privilege Escalation", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Image File Execution Options Injection"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "Windows Mshta Execution In Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Mshta"}]}}, {"name": "Windows Service Creation Using Registry Entry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Services Registry Permissions Weakness"}]}}]}, {"name": "Suspicious WMI Use", "id": "c8ddc5be-69bc-4202-b3ab-4010b27d7ad5", "version": 2, "date": "2018-10-23", "author": "Rico Valdez, Splunk", "description": "Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred.", "narrative": "WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems. In the event that unauthorized WMI execution occurs, it will be important for analysts and investigators to determine the context of the event. These details may provide insights related to how WMI was used and to what end.", "references": ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://web.archive.org/web/20210921091529/https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"], "tags": {"name": "Suspicious WMI Use", "analytic_story": "Suspicious WMI Use", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1546.003", "mitre_attack_technique": "Windows Management Instrumentation Event Subscription", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT29", "APT33", "Blue Mockingbird", "FIN8", "Leviathan", "Mustang Panda", "Turla"]}, {"mitre_attack_id": "T1546", "mitre_attack_technique": "Event Triggered Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1047", "mitre_attack_technique": "Windows Management Instrumentation", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT29", "APT32", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "Earth Lusca", "FIN6", "FIN7", "FIN8", "GALLIUM", "Gamaredon Group", "Indrik Spider", "Lazarus Group", "Leviathan", "Magic Hound", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "Stealth Falcon", "Threat Group-3390", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1220", "mitre_attack_technique": "XSL Script Processing", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Cobalt Group", "Higaisa", "Lazarus Group"]}], "mitre_attack_tactics": ["Defense Evasion", "Execution", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - Detect WMI Event Subscription Persistence - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - Windows WMI Process Call Create - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMIC XSL Execution via URL - Rule", "ESCU - XSL Script Execution With WMIC - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Temporary Event Subscription - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Rico Valdez", "detections": [{"name": "Detect WMI Event Subscription Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation Event Subscription"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "Process Execution via WMI", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation"}]}}, {"name": "Remote Process Instantiation via WMI", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation"}]}}, {"name": "Remote WMI Command Attempt", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation"}]}}, {"name": "Script Execution via WMI", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation"}]}}, {"name": "Windows WMI Process Call Create", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation"}]}}, {"name": "WMI Permanent Event Subscription - Sysmon", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation Event Subscription"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "WMIC XSL Execution via URL", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "XSL Script Processing"}]}}, {"name": "XSL Script Execution With WMIC", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "XSL Script Processing"}]}}, {"name": "WMI Permanent Event Subscription", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation"}]}}, {"name": "WMI Temporary Event Subscription", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation"}]}}]}, {"name": "Suspicious Zoom Child Processes", "id": "aa3749a6-49c7-491e-a03f-4eaee5fe0258", "version": 1, "date": "2020-04-13", "author": "David Dorsey, Splunk", "description": "Attackers are using Zoom as an vector to increase privileges on a sytems. This story detects new child processes of zoom and provides investigative actions for this detection.", "narrative": "Zoom is a leader in modern enterprise video communications and its usage has increased dramatically with a large amount of the population under stay-at-home orders due to the COVID-19 pandemic. With increased usage has come increased scrutiny and several security flaws have been found with this application on both Windows and macOS systems.\\\nCurrent detections focus on finding new child processes of this application on a per host basis. Investigative searches are included to gather information needed during an investigation.", "references": ["https://blog.rapid7.com/2020/04/02/dispelling-zoom-bugbears-what-you-need-to-know-about-the-latest-zoom-vulnerabilities/", "https://threatpost.com/two-zoom-zero-day-flaws-uncovered/154337/"], "tags": {"name": "Suspicious Zoom Child Processes", "analytic_story": "Suspicious Zoom Child Processes", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1068", "mitre_attack_technique": "Exploitation for Privilege Escalation", "mitre_attack_tactics": ["Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT33", "BITTER", "Cobalt Group", "FIN6", "FIN8", "LAPSUS$", "PLATINUM", "Threat Group-3390", "Tonto Team", "Turla", "Whitefly", "ZIRCONIUM"]}], "mitre_attack_tactics": ["Execution", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Child Process of Zoom - Rule"], "investigation_names": ["ESCU - Get Process File Activity - Response Task"], "baseline_names": ["ESCU - Previously Seen Zoom Child Processes - Initial", "ESCU - Previously Seen Zoom Child Processes - Update"], "author_company": "Splunk", "author_name": "David Dorsey", "detections": [{"name": "Detect Prohibited Applications Spawning cmd exe", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}, {"mitre_attack_technique": "Windows Command Shell"}]}}, {"name": "First Time Seen Child Process of Zoom", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation for Privilege Escalation"}]}}]}, {"name": "Swift Slicer", "id": "234c9dd7-52fb-4d6f-aec9-075ef88a2cea", "version": 1, "date": "2023-02-01", "author": "Teoderick Contreras, Rod Soto, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the swift slicer malware including overwriting of files and etc.", "narrative": "Swift Slicer is one of Windows destructive malware found by ESET that was used in a targeted organizarion to wipe critical files like windows drivers and other files to destroy and left the machine inoperable. This malware like Caddy Wiper was deliver through GPO which suggests that the attacker had taken control of the victims active directory environment.", "references": ["https://twitter.com/ESETresearch/status/1618960022150729728", "https://www.welivesecurity.com/2023/01/27/swiftslicer-new-destructive-wiper-malware-ukraine/"], "tags": {"name": "Swift Slicer", "analytic_story": "Swift Slicer", "category": ["Data Destruction", "Malware", "Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1485", "mitre_attack_technique": "Data Destruction", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "Gamaredon Group", "LAPSUS$", "Lazarus Group", "Sandworm Team"]}], "mitre_attack_tactics": ["Defense Evasion", "Impact", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Windows Data Destruction Recursive Exec Files Deletion - Rule", "ESCU - Windows High File Deletion Frequency - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Rod Soto, Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Executables Or Script Creation In Suspicious Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "Suspicious Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Windows Data Destruction Recursive Exec Files Deletion", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Windows High File Deletion Frequency", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}]}, {"name": "Text4Shell CVE-2022-42889", "id": "95ae800d-485e-47f7-866e-8be281aa497b", "version": 1, "date": "2022-10-26", "author": "Michael Haag, Splunk", "description": "A new critical vulnerability CVE-2022-42889 a.k.a. Text4shell, similar to the old Spring4Shell and Log4Shell, was originally reported by Alvaro Munoz on the very popular Apache Commons Text library.", "narrative": "Apache Commons Text is a Java library described as \"a library focused on algorithms working on strings.\" We can see it as a general-purpose text manipulation toolkit. This vulnerability affects the StringSubstitutor interpolator class, which is included in the Commons Text library. A default interpolator allows for string lookups that can lead to Remote Code Execution. This is due to a logic flaw that makes the \"script,\" \"dns,\" and \"url\" lookup keys interpolated by default, as opposed to what it should be, according to the documentation of the StringLookupFactory class. Those keys allow an attacker to execute arbitrary code via lookups. In order to exploit the vulnerabilities, the following requirements must be met - Run a version of Apache Commons Text from version 1.5 to 1.9 and use the StringSubstitutor interpolator. It is important to specify that the StringSubstitutor interpolator is not as widely used as the string substitution in Log4j, which led to Log4Shell. According to the CVSSv3 system, it scores 9.8 as CRITICAL severity. The severity is Critical due to the easy exploitability and huge potential impact in terms of confidentiality, integrity, and availability. As we showed in the previous section, you can take full control over the vulnerable system with a crafted request. However, it is not likely the vulnerabilities will have the same impacts as the previous Log4Shell and Spring4Shell.", "references": ["https://sysdig.com/blog/cve-2022-42889-text4shell/"], "tags": {"name": "Text4Shell CVE-2022-42889", "analytic_story": "Text4Shell CVE-2022-42889", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Application Security", "mitre_attack_enrichments": [{"mitre_attack_id": "T1505.003", "mitre_attack_technique": "Web Shell", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT38", "APT39", "BackdoorDiplomacy", "Deep Panda", "Dragonfly", "Fox Kitten", "GALLIUM", "HAFNIUM", "Kimsuky", "Leviathan", "Magic Hound", "Moses Staff", "OilRig", "Sandworm Team", "TEMP.Veles", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Volatile Cedar"]}, {"mitre_attack_id": "T1505", "mitre_attack_technique": "Server Software Component", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}], "mitre_attack_tactics": ["Initial Access", "Persistence"], "datamodels": ["Web"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Exploit Public Facing Application via Apache Commons Text - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Exploit Public Facing Application via Apache Commons Text", "source": "web", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Web Shell"}, {"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "Exploit Public-Facing Application"}]}}]}, {"name": "Trickbot", "id": "16f93769-8342-44c0-9b1d-f131937cce8e", "version": 1, "date": "2021-04-20", "author": "Rod Soto, Teoderick Contreras, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection even in LDAP environment.", "narrative": "trickbot banking trojan campaigns targeting banks and other vertical sectors.This malware is known in Microsoft Windows OS where target security Microsoft Defender to prevent its detection and removal. steal Verizon credentials and targeting banks using its multi component modules that collect and exfiltrate data.", "references": ["https://en.wikipedia.org/wiki/Trickbot", "https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/"], "tags": {"name": "Trickbot", "analytic_story": "Trickbot", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1087.002", "mitre_attack_technique": "Domain Account", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "BRONZE BUTLER", "Chimera", "Dragonfly", "FIN6", "Fox Kitten", "Ke3chang", "LAPSUS$", "Lazarus Group", "MuddyWater", "OilRig", "Poseidon Group", "Sandworm Team", "Turla", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1087", "mitre_attack_technique": "Account Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29"]}, {"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1055", "mitre_attack_technique": "Process Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT32", "APT37", "APT41", "Cobalt Group", "Kimsuky", "PLATINUM", "Silence", "Turla"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021.002", "mitre_attack_technique": "SMB/Windows Admin Shares", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT39", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "FIN8", "Fox Kitten", "Ke3chang", "Lazarus Group", "Moses Staff", "Orangeworm", "Sandworm Team", "Threat Group-1314", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.005", "mitre_attack_technique": "Mshta", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "APT32", "Confucius", "Earth Lusca", "FIN7", "Gamaredon Group", "Inception", "Kimsuky", "Lazarus Group", "LazyScripter", "MuddyWater", "Mustang Panda", "SideCopy", "Sidewinder", "TA551"]}, {"mitre_attack_id": "T1566", "mitre_attack_technique": "Phishing", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["Axiom", "GOLD SOUTHFIELD"]}, {"mitre_attack_id": "T1566.001", "mitre_attack_technique": "Spearphishing Attachment", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "IndigoZebra", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1218.011", "mitre_attack_technique": "Rundll32", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "CopyKittens", "Gamaredon Group", "HAFNIUM", "Kimsuky", "Lazarus Group", "LazyScripter", "Magic Hound", "MuddyWater", "Sandworm Team", "TA505", "TA551"]}, {"mitre_attack_id": "T1590", "mitre_attack_technique": "Gather Victim Network Information", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": ["HAFNIUM"]}, {"mitre_attack_id": "T1590.005", "mitre_attack_technique": "IP Addresses", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": ["Andariel", "HAFNIUM"]}, {"mitre_attack_id": "T1027", "mitre_attack_technique": "Obfuscated Files or Information", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "Aquatic Panda", "BITTER", "BackdoorDiplomacy", "BlackOasis", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Earth Lusca", "Elderwood", "Ember Bear", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Group5", "HEXANE", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leafminer", "Leviathan", "Magic Hound", "Mofang", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Putter Panda", "Rocke", "Sandworm Team", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Transparent Tribe", "Tropic Trooper", "Turla", "Whitefly", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}], "mitre_attack_tactics": ["Defense Evasion", "Discovery", "Execution", "Initial Access", "Lateral Movement", "Persistence", "Privilege Escalation", "Reconnaissance"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Reconnaissance"]}, "detection_names": ["ESCU - Account Discovery With Net App - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Executable File Written in Administrative SMB Share - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawn CMD Process - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Powershell Remote Thread To Known Windows Process - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Trickbot Named Pipe - Rule", "ESCU - Wermgr Process Connecting To IP Check Web Services - Rule", "ESCU - Wermgr Process Create Executable File - Rule", "ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Teoderick Contreras, Splunk", "author_name": "Rod Soto", "detections": [{"name": "Account Discovery With Net App", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Domain Account"}, {"mitre_attack_technique": "Account Discovery"}]}}, {"name": "Attempt To Stop Security Service", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Cobalt Strike Named Pipes", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Executable File Written in Administrative SMB Share", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "SMB/Windows Admin Shares"}]}}, {"name": "Executables Or Script Creation In Suspicious Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "Mshta spawning Rundll32 OR Regsvr32 Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Mshta"}]}}, {"name": "Office Application Spawn rundll32 process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Document Executing Macro Code", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Spawn CMD Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Office Product Spawning CertUtil", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Phishing"}, {"mitre_attack_technique": "Spearphishing Attachment"}]}}, {"name": "Powershell Remote Thread To Known Windows Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Schedule Task with Rundll32 Command Trigger", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Scheduled Task Deleted Or Created via CMD", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Suspicious Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Suspicious Rundll32 StartW", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Trickbot Named Pipe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Wermgr Process Connecting To IP Check Web Services", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Gather Victim Network Information"}, {"mitre_attack_technique": "IP Addresses"}]}}, {"name": "Wermgr Process Create Executable File", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Obfuscated Files or Information"}]}}, {"name": "Wermgr Process Spawned CMD Or Powershell Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}]}}]}, {"name": "Trusted Developer Utilities Proxy Execution", "id": "270a67a6-55d8-11eb-ae93-0242ac130002", "version": 1, "date": "2021-01-12", "author": "Michael Haag, Splunk", "description": "Monitor and detect behaviors used by attackers who leverage trusted developer utilities to execute malicious code.", "narrative": "Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.\\\nThe searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging microsoft.workflow.compiler.exe to execute malicious code.", "references": ["https://attack.mitre.org/techniques/T1127/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md", "https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/"], "tags": {"name": "Trusted Developer Utilities Proxy Execution", "analytic_story": "Trusted Developer Utilities Proxy Execution", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1127", "mitre_attack_technique": "Trusted Developer Utilities Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1036.003", "mitre_attack_technique": "Rename System Utilities", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT32", "GALLIUM", "Lazarus Group", "menuPass"]}], "mitre_attack_tactics": ["Defense Evasion"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious microsoft workflow compiler usage - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Suspicious microsoft workflow compiler rename", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}, {"mitre_attack_technique": "Rename System Utilities"}]}}, {"name": "Suspicious microsoft workflow compiler usage", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}]}}]}, {"name": "Trusted Developer Utilities Proxy Execution MSBuild", "id": "be3418e2-551b-11eb-ae93-0242ac130002", "version": 1, "date": "2021-01-21", "author": "Michael Haag, Splunk", "description": "Monitor and detect techniques used by attackers who leverage the msbuild.exe process to execute malicious code.", "narrative": "Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio and is native to Windows. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.\\\nThe inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.\\\nThe searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging msbuild.exe to execute malicious code.\\\nTriage\\\nValidate execution\\\n1. Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further PE metadata.\\\n1. Determine if script code was executed with MSBuild.\\\nSituational Awareness\\\nThe objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSBuild.exe.\\\n1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\\\n1. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is MSbuild loading any suspicious .DLLs?\\\n1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\\\nRetrieval of script code\\\nThe objective of this step is to confirm the executed script code is benign or malicious.", "references": ["https://attack.mitre.org/techniques/T1127/001/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md", "https://github.com/infosecn1nja/MaliciousMacroMSBuild", "https://github.com/xorrior/RandomPS-Scripts/blob/master/Invoke-ExecuteMSBuild.ps1", "https://lolbas-project.github.io/lolbas/Binaries/Msbuild/", "https://github.com/MHaggis/CBR-Queries/blob/master/msbuild.md"], "tags": {"name": "Trusted Developer Utilities Proxy Execution MSBuild", "analytic_story": "Trusted Developer Utilities Proxy Execution MSBuild", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1127.001", "mitre_attack_technique": "MSBuild", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1127", "mitre_attack_technique": "Trusted Developer Utilities Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1036.003", "mitre_attack_technique": "Rename System Utilities", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT32", "GALLIUM", "Lazarus Group", "menuPass"]}], "mitre_attack_tactics": ["Defense Evasion"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - MSBuild Suspicious Spawned By Script Process - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious MSBuild Spawn - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "MSBuild Suspicious Spawned By Script Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "MSBuild"}, {"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}]}}, {"name": "Suspicious msbuild path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}, {"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "MSBuild"}]}}, {"name": "Suspicious MSBuild Rename", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}, {"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "MSBuild"}]}}, {"name": "Suspicious MSBuild Spawn", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}, {"mitre_attack_technique": "MSBuild"}]}}]}, {"name": "Unusual Processes", "id": "f4368e3f-d59f-4192-84f6-748ac5a3ddb6", "version": 2, "date": "2020-02-04", "author": "Bhavin Patel, Splunk", "description": "Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation.", "narrative": "Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\\\nThis Analytic Story lets you identify processes that are either a) not typically seen running or b) have some sort of suspicious command-line arguments associated with them. This Analytic Story will also help you identify the user running these processes and the associated process activity on the host.\\\nIn the event an unusual process is identified, it is imperative to better understand how that process was able to execute on the host, when it first executed, and whether other hosts are affected. This extra information may provide clues that can help the analyst further investigate any suspicious activity.", "references": ["https://web.archive.org/web/20210921093439/https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"], "tags": {"name": "Unusual Processes", "analytic_story": "Unusual Processes", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1204.002", "mitre_attack_technique": "Malicious File", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT-C-36", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "Ajax Security Team", "Andariel", "Aoqin Dragon", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "Dark Caracal", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Earth Lusca", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HEXANE", "Higaisa", "Inception", "IndigoZebra", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "PROMETHIUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Whitefly", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1036.005", "mitre_attack_technique": "Match Legitimate Name or Location", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT1", "APT28", "APT29", "APT32", "APT39", "APT41", "Aoqin Dragon", "BRONZE BUTLER", "BackdoorDiplomacy", "Blue Mockingbird", "Carbanak", "Chimera", "Darkhotel", "Earth Lusca", "FIN7", "Ferocious Kitten", "Fox Kitten", "Gamaredon Group", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Poseidon Group", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "Sowbug", "TEMP.Veles", "TeamTNT", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Whitefly", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1595", "mitre_attack_technique": "Active Scanning", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1016", "mitre_attack_technique": "System Network Configuration Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT1", "APT19", "APT3", "APT32", "APT41", "Chimera", "Darkhotel", "Dragonfly", "Earth Lusca", "GALLIUM", "HEXANE", "Higaisa", "Ke3chang", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "SideCopy", "Sidewinder", "Stealth Falcon", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1112", "mitre_attack_technique": "Modify Registry", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "APT38", "APT41", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN8", "Gamaredon Group", "Gorgon Group", "Kimsuky", "Magic Hound", "Patchwork", "Silence", "TA505", "Threat Group-3390", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.011", "mitre_attack_technique": "Rundll32", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT28", "APT29", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "CopyKittens", "Gamaredon Group", "HAFNIUM", "Kimsuky", "Lazarus Group", "LazyScripter", "Magic Hound", "MuddyWater", "Sandworm Team", "TA505", "TA551"]}, {"mitre_attack_id": "T1036.003", "mitre_attack_technique": "Rename System Utilities", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT32", "GALLIUM", "Lazarus Group", "menuPass"]}, {"mitre_attack_id": "T1218.012", "mitre_attack_technique": "Verclsid", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1218.004", "mitre_attack_technique": "InstallUtil", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Mustang Panda", "menuPass"]}, {"mitre_attack_id": "T1588.002", "mitre_attack_technique": "Tool", "mitre_attack_tactics": ["Resource Development"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT19", "APT28", "APT29", "APT32", "APT33", "APT38", "APT39", "APT41", "Aoqin Dragon", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Carbanak", "Chimera", "Cleaver", "Cobalt Group", "CopyKittens", "DarkHydrus", "DarkVishnya", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN5", "FIN6", "Ferocious Kitten", "GALLIUM", "Gorgon Group", "HEXANE", "Inception", "IndigoZebra", "Ke3chang", "Kimsuky", "LAPSUS$", "Lazarus Group", "Leafminer", "Magic Hound", "Moses Staff", "MuddyWater", "POLONIUM", "Patchwork", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "TA505", "TEMP.Veles", "Threat Group-3390", "Thrip", "Turla", "WIRTE", "Whitefly", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1055", "mitre_attack_technique": "Process Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT32", "APT37", "APT41", "Cobalt Group", "Kimsuky", "PLATINUM", "Silence", "Turla"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1134.004", "mitre_attack_technique": "Parent PID Spoofing", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1134", "mitre_attack_technique": "Access Token Manipulation", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["Blue Mockingbird", "FIN6"]}, {"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Discovery", "Execution", "Initial Access", "Persistence", "Privilege Escalation", "Reconnaissance", "Resource Development"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Exploitation", "Installation"]}, "detection_names": ["ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Rundll32 Shimcache Flush - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Suspicious Copy on System32 - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Verclsid CLSID Execution - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Remote Assistance Spawning Process - Rule", "ESCU - Wscript Or Cscript Suspicious Child Process - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - WinRM Spawning a Process - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"], "baseline_names": ["ESCU - Baseline of Command Line Length - MLTK"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Uncommon Processes On Endpoint", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Malicious File"}]}}, {"name": "Attacker Tools On Endpoint", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Match Legitimate Name or Location"}, {"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "OS Credential Dumping"}, {"mitre_attack_technique": "Active Scanning"}]}}, {"name": "Detect processes used for System Network Configuration Discovery", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Configuration Discovery"}]}}, {"name": "Rundll32 Shimcache Flush", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "RunDLL Loading DLL By Ordinal", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Rundll32"}]}}, {"name": "Suspicious Copy on System32", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "Masquerading"}]}}, {"name": "System Processes Run From Unexpected Locations", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rename System Utilities"}]}}, {"name": "Verclsid CLSID Execution", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Verclsid"}, {"mitre_attack_technique": "System Binary Proxy Execution"}]}}, {"name": "Windows DotNet Binary in Non Standard Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "InstallUtil"}]}}, {"name": "Windows InstallUtil in Non Standard Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "InstallUtil"}]}}, {"name": "Windows NirSoft AdvancedRun", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Tool"}]}}, {"name": "Windows Remote Assistance Spawning Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Wscript Or Cscript Suspicious Child Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}, {"mitre_attack_technique": "Create or Modify System Process"}, {"mitre_attack_technique": "Parent PID Spoofing"}, {"mitre_attack_technique": "Access Token Manipulation"}]}}, {"name": "Detect Rare Executables", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "Unusually Long Command Line", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "Unusually Long Command Line - MLTK", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": []}}, {"name": "WinRM Spawning a Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}]}, {"name": "Use of Cleartext Protocols", "id": "826e6431-aeef-41b4-9fc0-6d0985d65a21", "version": 1, "date": "2017-09-15", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted.", "narrative": "Various legacy protocols operate by default in the clear, without the protections of encryption. This potentially leaks sensitive information that can be exploited by passively sniffing network traffic. Depending on the protocol, this information could be highly sensitive, or could allow for session hijacking. In addition, these protocols send authentication information, which would allow for the harvesting of usernames and passwords that could potentially be used to authenticate and compromise secondary systems.", "references": ["https://www.monkey.org/~dugsong/dsniff/"], "tags": {"name": "Use of Cleartext Protocols", "analytic_story": "Use of Cleartext Protocols", "category": ["Best Practices"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [], "mitre_attack_tactics": [], "datamodels": ["Network_Traffic"], "kill_chain_phases": ["Actions on Objectives", "Reconnaissance"]}, "detection_names": ["ESCU - Protocols passing authentication in cleartext - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Protocols passing authentication in cleartext", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}]}, {"name": "VMware Server Side Injection and Privilege Escalation", "id": "d6d51cc2-a092-43b7-9f61-1159943afe39", "version": 1, "date": "2022-05-19", "author": "Michael Haag, Splunk", "description": "Recently disclosed CVE-2022-22954 and CVE-2022-22960 have been identified in the wild abusing VMware products to compromise internet faced devices and escalate privileges.", "narrative": "On April 6, 2022, VMware published VMSA-2022-0011, which discloses multiple vulnerabilities discovered by Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute. The most critical of the CVEs published in VMSA-2022-0011 is CVE-2022-22954, which is a server-side template injection issue with a CVSSv3 base score of 9.8. The vulnerability allows an unauthenticated user with network access to the web interface to execute an arbitrary shell command as the VMware user. To further exacerbate this issue, VMware also disclosed a local privilege escalation issue, CVE-2022-22960, which permits the attacker to gain root after exploiting CVE-2022-22954. Products affected include - VMware Workspace ONE Access (Access) 20.10.0.0 - 20.10.0.1, 21.08.0.0 - 21.08.0.1 and VMware Identity Manager (vIDM) 3.3.3 - 3.3.6.", "references": ["https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis", "https://www.cisa.gov/uscert/ncas/alerts/aa22-138b"], "tags": {"name": "VMware Server Side Injection and Privilege Escalation", "analytic_story": "VMware Server Side Injection and Privilege Escalation", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1190", "mitre_attack_technique": "Exploit Public-Facing Application", "mitre_attack_tactics": ["Initial Access"], "mitre_attack_groups": ["APT28", "APT29", "APT39", "APT41", "Axiom", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "HAFNIUM", "Ke3chang", "Kimsuky", "Magic Hound", "Moses Staff", "MuddyWater", "Rocke", "Threat Group-3390", "Volatile Cedar", "menuPass"]}], "mitre_attack_tactics": ["Initial Access"], "datamodels": ["Web"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - VMware Server Side Template Injection Hunt - Rule", "ESCU - VMware Workspace ONE Freemarker Server-side Template Injection - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "VMware Server Side Template Injection Hunt", "source": "web", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}, {"name": "VMware Workspace ONE Freemarker Server-side Template Injection", "source": "web", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploit Public-Facing Application"}]}}]}, {"name": "WhisperGate", "id": "0150e6e5-3171-442e-83f8-1ccd8599569b", "version": 1, "date": "2022-01-19", "author": "Teoderick Contreras, Splunk", "description": "This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive malware targeting Ukrainian organizations also known as \"WhisperGate\". This analytic story looks for suspicious process execution, command-line activity, downloads, DNS queries and more.", "narrative": "WhisperGate/DEV-0586 is destructive malware operation found by MSTIC (Microsoft Threat Inteligence Center) targeting multiple organizations in Ukraine. This operation campaign consist of several malware component like the downloader that abuses discord platform, overwrite or destroy master boot record (MBR) of the targeted host, wiper and also windows defender evasion techniques.", "references": ["https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/", "https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3"], "tags": {"name": "WhisperGate", "analytic_story": "WhisperGate", "category": ["Data Destruction", "Malware", "Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1059.003", "mitre_attack_technique": "Windows Command Shell", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT1", "APT18", "APT28", "APT29", "APT3", "APT32", "APT37", "APT38", "APT41", "Aquatic Panda", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Dragonfly", "Ember Bear", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "Higaisa", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "Silence", "Sowbug", "Suckfly", "TA505", "TA551", "TeamTNT", "Threat Group-1314", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1485", "mitre_attack_technique": "Data Destruction", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "Gamaredon Group", "LAPSUS$", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1021.002", "mitre_attack_technique": "SMB/Windows Admin Shares", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT28", "APT29", "APT3", "APT32", "APT39", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "FIN8", "Fox Kitten", "Ke3chang", "Lazarus Group", "Moses Staff", "Orangeworm", "Sandworm Team", "Threat Group-1314", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1021.003", "mitre_attack_technique": "Distributed Component Object Model", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1047", "mitre_attack_technique": "Windows Management Instrumentation", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT29", "APT32", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "Earth Lusca", "FIN6", "FIN7", "FIN8", "GALLIUM", "Gamaredon Group", "Indrik Spider", "Lazarus Group", "Leviathan", "Magic Hound", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "Stealth Falcon", "Threat Group-3390", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1027", "mitre_attack_technique": "Obfuscated Files or Information", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "Aquatic Panda", "BITTER", "BackdoorDiplomacy", "BlackOasis", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Earth Lusca", "Elderwood", "Ember Bear", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Group5", "HEXANE", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leafminer", "Leviathan", "Magic Hound", "Mofang", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Putter Panda", "Rocke", "Sandworm Team", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Transparent Tribe", "Tropic Trooper", "Turla", "Whitefly", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1497", "mitre_attack_technique": "Virtualization/Sandbox Evasion", "mitre_attack_tactics": ["Defense Evasion", "Discovery"], "mitre_attack_groups": ["Darkhotel"]}, {"mitre_attack_id": "T1497.003", "mitre_attack_technique": "Time Based Evasion", "mitre_attack_tactics": ["Defense Evasion", "Discovery"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1070", "mitre_attack_technique": "Indicator Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Lazarus Group"]}, {"mitre_attack_id": "T1059.005", "mitre_attack_technique": "Visual Basic", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT32", "APT33", "APT37", "APT38", "APT39", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Earth Lusca", "FIN4", "FIN7", "Gamaredon Group", "Gorgon Group", "HEXANE", "Higaisa", "Inception", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "Transparent Tribe", "Turla", "WIRTE", "Windshift"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1036.003", "mitre_attack_technique": "Rename System Utilities", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT32", "GALLIUM", "Lazarus Group", "menuPass"]}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1218.004", "mitre_attack_technique": "InstallUtil", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Mustang Panda", "menuPass"]}, {"mitre_attack_id": "T1588.002", "mitre_attack_technique": "Tool", "mitre_attack_tactics": ["Resource Development"], "mitre_attack_groups": ["APT-C-36", "APT1", "APT19", "APT28", "APT29", "APT32", "APT33", "APT38", "APT39", "APT41", "Aoqin Dragon", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "BlackTech", "Blue Mockingbird", "Carbanak", "Chimera", "Cleaver", "Cobalt Group", "CopyKittens", "DarkHydrus", "DarkVishnya", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN10", "FIN5", "FIN6", "Ferocious Kitten", "GALLIUM", "Gorgon Group", "HEXANE", "Inception", "IndigoZebra", "Ke3chang", "Kimsuky", "LAPSUS$", "Lazarus Group", "Leafminer", "Magic Hound", "Moses Staff", "MuddyWater", "POLONIUM", "Patchwork", "PittyTiger", "Sandworm Team", "Silence", "Silent Librarian", "TA505", "TEMP.Veles", "Threat Group-3390", "Thrip", "Turla", "WIRTE", "Whitefly", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1561.002", "mitre_attack_technique": "Disk Structure Wipe", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT37", "APT38", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1561", "mitre_attack_technique": "Disk Wipe", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1055", "mitre_attack_technique": "Process Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT32", "APT37", "APT41", "Cobalt Group", "Kimsuky", "PLATINUM", "Silence", "Turla"]}, {"mitre_attack_id": "T1134.004", "mitre_attack_technique": "Parent PID Spoofing", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1134", "mitre_attack_technique": "Access Token Manipulation", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["Blue Mockingbird", "FIN6"]}], "mitre_attack_tactics": ["Defense Evasion", "Discovery", "Execution", "Impact", "Lateral Movement", "Persistence", "Privilege Escalation", "Resource Development"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Exploitation", "Installation"]}, "detection_names": ["ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Excessive File Deletion In WinDefender Folder - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Ping Sleep Batch Command - Rule", "ESCU - Powershell Remove Windows Defender Directory - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Suspicious Process DNS Query Known Abuse Web Services - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Suspicious Process With Discord DNS Query - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows High File Deletion Frequency - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows NirSoft Utilities - Rule", "ESCU - Windows Raw Access To Master Boot Record Drive - Rule", "ESCU - Wscript Or Cscript Suspicious Child Process - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Add or Set Windows Defender Exclusion", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Attempt To Stop Security Service", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "CMD Carry Out String Command Parameter", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Command Shell"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Excessive File Deletion In WinDefender Folder", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Executables Or Script Creation In Suspicious Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "Impacket Lateral Movement Commandline Parameters", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}, {"mitre_attack_technique": "SMB/Windows Admin Shares"}, {"mitre_attack_technique": "Distributed Component Object Model"}, {"mitre_attack_technique": "Windows Management Instrumentation"}, {"mitre_attack_technique": "Windows Service"}]}}, {"name": "Malicious PowerShell Process - Encoded Command", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Obfuscated Files or Information"}]}}, {"name": "Ping Sleep Batch Command", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Virtualization/Sandbox Evasion"}, {"mitre_attack_technique": "Time Based Evasion"}]}}, {"name": "Powershell Remove Windows Defender Directory", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Powershell Windows Defender Exclusion Commands", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Process Deleting Its Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "Suspicious Process DNS Query Known Abuse Web Services", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Visual Basic"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Suspicious Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Suspicious Process With Discord DNS Query", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Visual Basic"}, {"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Windows DotNet Binary in Non Standard Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "InstallUtil"}]}}, {"name": "Windows High File Deletion Frequency", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Windows InstallUtil in Non Standard Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rename System Utilities"}, {"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "InstallUtil"}]}}, {"name": "Windows NirSoft AdvancedRun", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Tool"}]}}, {"name": "Windows NirSoft Utilities", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Tool"}]}}, {"name": "Windows Raw Access To Master Boot Record Drive", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disk Structure Wipe"}, {"mitre_attack_technique": "Disk Wipe"}]}}, {"name": "Wscript Or Cscript Suspicious Child Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}, {"mitre_attack_technique": "Create or Modify System Process"}, {"mitre_attack_technique": "Parent PID Spoofing"}, {"mitre_attack_technique": "Access Token Manipulation"}]}}]}, {"name": "Windows Certificate Services", "id": "b92b4ac7-0026-4408-a6b5-c1d20658e124", "version": 1, "date": "2023-02-01", "author": "Michael Haag, Splunk", "description": "Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material.", "narrative": "The following analytic story focuses on remote and local endpoint certificate theft and abuse. Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files), misplaced certificate files (i.e. Unsecured Credentials), or directly from the Windows certificate store via various crypto APIs.With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Abusing certificates for authentication credentials may enable other behaviors such as Lateral Movement. Certificate-related misconfigurations may also enable opportunities for Privilege Escalation, by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable Persistence via stealing or forging certificates that can be used as Valid Accounts for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts. (MITRE ATT&CK)", "references": ["https://attack.mitre.org/techniques/T1649/"], "tags": {"name": "Windows Certificate Services", "analytic_story": "Windows Certificate Services", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1552.004", "mitre_attack_technique": "Private Keys", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1552", "mitre_attack_technique": "Unsecured Credentials", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1649", "mitre_attack_technique": "Steal or Forge Authentication Certificates", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Installation"]}, "detection_names": ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Windows Export Certificate - Rule", "ESCU - Windows Mimikatz Crypto Export File Extensions - Rule", "ESCU - Windows PowerShell Export Certificate - Rule", "ESCU - Windows PowerShell Export PfxCertificate - Rule", "ESCU - Windows Steal Authentication Certificates Certificate Issued - Rule", "ESCU - Windows Steal Authentication Certificates Certificate Request - Rule", "ESCU - Windows Steal Authentication Certificates CertUtil Backup - Rule", "ESCU - Windows Steal Authentication Certificates CryptoAPI - Rule", "ESCU - Windows Steal Authentication Certificates CS Backup - Rule", "ESCU - Windows Steal Authentication Certificates Export Certificate - Rule", "ESCU - Windows Steal Authentication Certificates Export PfxCertificate - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Certutil exe certificate extraction", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}, {"name": "Windows Export Certificate", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Private Keys"}, {"mitre_attack_technique": "Unsecured Credentials"}, {"mitre_attack_technique": "Steal or Forge Authentication Certificates"}]}}, {"name": "Windows Mimikatz Crypto Export File Extensions", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Authentication Certificates"}]}}, {"name": "Windows PowerShell Export Certificate", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Private Keys"}, {"mitre_attack_technique": "Unsecured Credentials"}, {"mitre_attack_technique": "Steal or Forge Authentication Certificates"}]}}, {"name": "Windows PowerShell Export PfxCertificate", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Private Keys"}, {"mitre_attack_technique": "Unsecured Credentials"}, {"mitre_attack_technique": "Steal or Forge Authentication Certificates"}]}}, {"name": "Windows Steal Authentication Certificates Certificate Issued", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Authentication Certificates"}]}}, {"name": "Windows Steal Authentication Certificates Certificate Request", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Authentication Certificates"}]}}, {"name": "Windows Steal Authentication Certificates CertUtil Backup", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Authentication Certificates"}]}}, {"name": "Windows Steal Authentication Certificates CryptoAPI", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Authentication Certificates"}]}}, {"name": "Windows Steal Authentication Certificates CS Backup", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Authentication Certificates"}]}}, {"name": "Windows Steal Authentication Certificates Export Certificate", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Authentication Certificates"}]}}, {"name": "Windows Steal Authentication Certificates Export PfxCertificate", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Authentication Certificates"}]}}]}, {"name": "Windows Defense Evasion Tactics", "id": "56e24a28-5003-4047-b2db-e8f3c4618064", "version": 1, "date": "2018-05-31", "author": "David Dorsey, Splunk", "description": "Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others ", "narrative": "Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms.", "references": ["https://attack.mitre.org/wiki/Defense_Evasion"], "tags": {"name": "Windows Defense Evasion Tactics", "analytic_story": "Windows Defense Evasion Tactics", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1564.001", "mitre_attack_technique": "Hidden Files and Directories", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT32", "Lazarus Group", "Mustang Panda", "Rocke", "Transparent Tribe", "Tropic Trooper"]}, {"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1027.004", "mitre_attack_technique": "Compile After Delivery", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Gamaredon Group", "MuddyWater", "Rocke"]}, {"mitre_attack_id": "T1027", "mitre_attack_technique": "Obfuscated Files or Information", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "Aquatic Panda", "BITTER", "BackdoorDiplomacy", "BlackOasis", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dark Caracal", "Darkhotel", "Earth Lusca", "Elderwood", "Ember Bear", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "GOLD SOUTHFIELD", "Gallmaker", "Gamaredon Group", "Group5", "HEXANE", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leafminer", "Leviathan", "Magic Hound", "Mofang", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Putter Panda", "Rocke", "Sandworm Team", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Transparent Tribe", "Tropic Trooper", "Turla", "Whitefly", "Windshift", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1112", "mitre_attack_technique": "Modify Registry", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "APT38", "APT41", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN8", "Gamaredon Group", "Gorgon Group", "Kimsuky", "Magic Hound", "Patchwork", "Silence", "TA505", "Threat Group-3390", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1564", "mitre_attack_technique": "Hide Artifacts", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1548.002", "mitre_attack_technique": "Bypass User Account Control", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT29", "APT37", "BRONZE BUTLER", "Cobalt Group", "Earth Lusca", "Evilnum", "MuddyWater", "Patchwork", "Threat Group-3390"]}, {"mitre_attack_id": "T1548", "mitre_attack_technique": "Abuse Elevation Control Mechanism", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1490", "mitre_attack_technique": "Inhibit System Recovery", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1562.004", "mitre_attack_technique": "Disable or Modify System Firewall", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "APT38", "Carbanak", "Dragonfly", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1222", "mitre_attack_technique": "File and Directory Permissions Modification", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1222.001", "mitre_attack_technique": "Windows File and Directory Permissions Modification", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Wizard Spider"]}, {"mitre_attack_id": "T1218.014", "mitre_attack_technique": "MMC", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1059", "mitre_attack_technique": "Command and Scripting Interpreter", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT19", "APT32", "APT37", "APT39", "Dragonfly", "FIN5", "FIN6", "FIN7", "Fox Kitten", "Ke3chang", "OilRig", "Stealth Falcon", "Whitefly", "Windigo"]}, {"mitre_attack_id": "T1562.002", "mitre_attack_technique": "Disable Windows Event Logging", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Sandworm Team", "Threat Group-3390"]}, {"mitre_attack_id": "T1505", "mitre_attack_technique": "Server Software Component", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1505.004", "mitre_attack_technique": "IIS Components", "mitre_attack_tactics": ["Persistence"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1574.001", "mitre_attack_technique": "DLL Search Order Hijacking", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT41", "Aquatic Panda", "BackdoorDiplomacy", "Evilnum", "RTM", "Threat Group-3390", "Tonto Team", "Whitefly", "menuPass"]}, {"mitre_attack_id": "T1574", "mitre_attack_technique": "Hijack Execution Flow", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1055", "mitre_attack_technique": "Process Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT32", "APT37", "APT41", "Cobalt Group", "Kimsuky", "PLATINUM", "Silence", "Turla"]}, {"mitre_attack_id": "T1055.001", "mitre_attack_technique": "Dynamic-link Library Injection", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["BackdoorDiplomacy", "Lazarus Group", "Leviathan", "Putter Panda", "TA505", "Tropic Trooper", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1218", "mitre_attack_technique": "System Binary Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}], "mitre_attack_tactics": ["Defense Evasion", "Execution", "Impact", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - CSC Net On The Fly Compilation - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - Firewall Allowed Program Enable - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - Windows Command and Scripting Interpreter Hunting Path Traversal - Rule", "ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable Notification Center - Rule", "ESCU - Windows Disable Windows Event Logging Disable HTTP Logging - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows DISM Remove Defender - Rule", "ESCU - Windows DLL Search Order Hijacking Hunt - Rule", "ESCU - Windows DLL Search Order Hijacking Hunt with Sysmon - Rule", "ESCU - Windows DLL Search Order Hijacking with iscsicpl - Rule", "ESCU - Windows Event For Service Disabled - Rule", "ESCU - Windows Excessive Disabled Services Event - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows Impair Defense Delete Win Defender Context Menu - Rule", "ESCU - Windows Impair Defense Delete Win Defender Profile Registry - Rule", "ESCU - Windows Impair Defenses Disable Win Defender Auto Logging - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows PowerShell Disable HTTP Logging - Rule", "ESCU - Windows Process With NamedPipe CommandLine - Rule", "ESCU - Windows Rasautou DLL Execution - Rule", "ESCU - WSReset UAC Bypass - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "David Dorsey", "detections": [{"name": "Reg exe used to hide files directories via registry keys", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Hidden Files and Directories"}]}}, {"name": "Remote Registry Key modifications", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}, {"name": "Add or Set Windows Defender Exclusion", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "CSC Net On The Fly Compilation", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Compile After Delivery"}, {"mitre_attack_technique": "Obfuscated Files or Information"}]}}, {"name": "Disable Registry Tool", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Security Logs Using MiniNt Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Disable Show Hidden Files", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Hidden Files and Directories"}, {"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Hide Artifacts"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable UAC Remote Restriction", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Disable Windows Behavior Monitoring", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Windows SmartScreen Protection", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disabling CMD Application", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disabling ControlPanel", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disabling Firewall with Netsh", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disabling FolderOptions Windows Feature", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disabling NoRun Windows App", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disabling Remote User Account Control", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Disabling SystemRestore In Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Disabling Task Manager", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Eventvwr UAC Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Excessive number of service control start as disabled", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Firewall Allowed Program Enable", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify System Firewall"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "FodHelper UAC Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}, {"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Hiding Files And Directories With Attrib exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File and Directory Permissions Modification"}, {"mitre_attack_technique": "Windows File and Directory Permissions Modification"}]}}, {"name": "NET Profiler UAC bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Powershell Windows Defender Exclusion Commands", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Sdclt UAC Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "SilentCleanup UAC Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "SLUI RunAs Elevated", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "SLUI Spawning a Process", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Suspicious Reg exe Process", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "UAC Bypass MMC Load Unsigned Dll", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}, {"mitre_attack_technique": "MMC"}]}}, {"name": "Windows Command and Scripting Interpreter Hunting Path Traversal", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Windows Command and Scripting Interpreter Path Traversal Exec", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Command and Scripting Interpreter"}]}}, {"name": "Windows Defender Exclusion Registry Entry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows Disable Change Password Through Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Disable Lock Workstation Feature Through Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Disable Notification Center", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Disable Windows Event Logging Disable HTTP Logging", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable Windows Event Logging"}, {"mitre_attack_technique": "Impair Defenses"}, {"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "IIS Components"}]}}, {"name": "Windows Disable Windows Group Policy Features Through Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows DisableAntiSpyware Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows DISM Remove Defender", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows DLL Search Order Hijacking Hunt", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DLL Search Order Hijacking"}, {"mitre_attack_technique": "Hijack Execution Flow"}]}}, {"name": "Windows DLL Search Order Hijacking Hunt with Sysmon", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DLL Search Order Hijacking"}, {"mitre_attack_technique": "Hijack Execution Flow"}]}}, {"name": "Windows DLL Search Order Hijacking with iscsicpl", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DLL Search Order Hijacking"}]}}, {"name": "Windows Event For Service Disabled", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows Excessive Disabled Services Event", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows Hide Notification Features Through Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Impair Defense Delete Win Defender Context Menu", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows Impair Defense Delete Win Defender Profile Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows Impair Defenses Disable Win Defender Auto Logging", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows Modify Show Compress Color And Info Tip Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows PowerShell Disable HTTP Logging", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Impair Defenses"}, {"mitre_attack_technique": "Disable Windows Event Logging"}, {"mitre_attack_technique": "Server Software Component"}, {"mitre_attack_technique": "IIS Components"}]}}, {"name": "Windows Process With NamedPipe CommandLine", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Process Injection"}]}}, {"name": "Windows Rasautou DLL Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Dynamic-link Library Injection"}, {"mitre_attack_technique": "System Binary Proxy Execution"}, {"mitre_attack_technique": "Process Injection"}]}}, {"name": "WSReset UAC Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}]}, {"name": "Windows Discovery Techniques", "id": "f7aba570-7d59-11eb-825e-acde48001122", "version": 1, "date": "2021-03-04", "author": "Michael Hart, Splunk", "description": "Monitors for behaviors associated with adversaries discovering objects in the environment that can be leveraged in the progression of the attack.", "narrative": "Attackers may not have much if any insight into their target's environment before the initial compromise.  Once a foothold has been established, attackers will start enumerating objects in the environment (accounts, services, network shares, etc.) that can be used to achieve their objectives.  This Analytic Story provides searches to help identify activities consistent with adversaries gaining knowledge of compromised Windows environments.", "references": ["https://attack.mitre.org/tactics/TA0007/", "https://cyberd.us/penetration-testing", "https://attack.mitre.org/software/S0521/"], "tags": {"name": "Windows Discovery Techniques", "analytic_story": "Windows Discovery Techniques", "category": ["Adversary Tactics"], "product": ["Splunk Behavioral Analytics", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1069", "mitre_attack_technique": "Permission Groups Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "APT3", "TA505"]}, {"mitre_attack_id": "T1069.001", "mitre_attack_technique": "Local Groups", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["Chimera", "HEXANE", "OilRig", "Tonto Team", "Turla", "admin@338"]}], "mitre_attack_tactics": ["Discovery"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Reconnaissance"]}, "detection_names": ["ESCU - Net Localgroup Discovery - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Hart", "detections": [{"name": "Net Localgroup Discovery", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Local Groups"}]}}]}, {"name": "Windows DNS SIGRed CVE-2020-1350", "id": "36dbb206-d073-11ea-87d0-0242ac130003", "version": 1, "date": "2020-07-28", "author": "Shannon Davis, Splunk", "description": "Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). An attacker can use the malicious payload to cause a buffer overflow on the vulnerable system, leading to compromise.  The included searches in this Analytic Story are designed to identify the large response payload for SIG and KEY DNS records which can be used for the exploit.", "narrative": "When a client requests a DNS record for a particular domain, that request gets routed first through the client's locally configured DNS server, then to any DNS server(s) configured as forwarders, and then onto the target domain's own DNS server(s).  If a attacker wanted to, they could host a malicious DNS server that responds to the initial request with a specially crafted large response (~65KB).  This response would flow through to the client's local DNS server, which if not patched for CVE-2020-1350, would cause the buffer overflow. The detection searches in this Analytic Story use wire data to detect the malicious behavior. Searches for Splunk Stream and Zeek are included.  The Splunk Stream search correlates across stream:dns and stream:tcp, while the Zeek search correlates across bro:dns:json and bro:conn:json.  These correlations are required to pick up both the DNS record types (SIG and KEY) along with the payload size (>65KB).", "references": ["https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/", "https://support.microsoft.com/en-au/help/4569509/windows-dns-server-remote-code-execution-vulnerability"], "tags": {"name": "Windows DNS SIGRed CVE-2020-1350", "analytic_story": "Windows DNS SIGRed CVE-2020-1350", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1203", "mitre_attack_technique": "Exploitation for Client Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT12", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT41", "Andariel", "Aoqin Dragon", "Axiom", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Elderwood", "Ember Bear", "Higaisa", "Inception", "Lazarus Group", "Leviathan", "MuddyWater", "Mustang Panda", "Patchwork", "Sandworm Team", "Sidewinder", "TA459", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "admin@338"]}], "mitre_attack_tactics": ["Execution"], "datamodels": ["Network_Resolution"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Detect Windows DNS SIGRed via Zeek - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Shannon Davis", "detections": [{"name": "Detect Windows DNS SIGRed via Splunk Stream", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation for Client Execution"}]}}, {"name": "Detect Windows DNS SIGRed via Zeek", "source": "network", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation for Client Execution"}]}}]}, {"name": "Windows Drivers", "id": "d0a9323f-9411-4da6-86b2-18c184d750c0", "version": 1, "date": "2022-03-30", "author": "Michael Haag, Splunk", "description": "Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.", "narrative": "A rootkit on Windows may sometimes be in the form of a Windows Driver. A driver typically has a file extension of .sys, however the internals of a sys file is similar to a Windows DLL. For Microsoft Windows to load a driver, a few requirements are needed. First, it must have a valid signature. Second, typically it should load from the windows\\system32\\drivers path. There are a few methods to investigate drivers in the environment. Drivers are noisy. An inventory of all drivers is important to understand prevalence. A driver location (Path) is also important when attempting to baseline. Looking at a driver name and path is not enough, we must also explore the signing information. Product, description, company name, signer and signing result are all items to take into account when reviewing drivers. What makes a driver malicious? Depending if a driver was dropped during a campaign or you are baselining drivers after, triaging a driver to determine maliciousness may be tough. We break this into two categories - 1. vulnerable drivers 2. driver rootkits. Attempt to identify prevelance of the driver. Is it on one or many? Review the signing information if it is present. Is it common? A lot of driver hunting will lead down rabbit holes, but we hope to help lead the way.", "references": ["https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/", "https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage", "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf", "https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/"], "tags": {"name": "Windows Drivers", "analytic_story": "Windows Drivers", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1014", "mitre_attack_technique": "Rootkit", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT41", "Rocke", "TeamTNT", "Winnti Group"]}, {"mitre_attack_id": "T1068", "mitre_attack_technique": "Exploitation for Privilege Escalation", "mitre_attack_tactics": ["Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT33", "BITTER", "Cobalt Group", "FIN6", "FIN8", "LAPSUS$", "PLATINUM", "Threat Group-3390", "Tonto Team", "Turla", "Whitefly", "ZIRCONIUM"]}, {"mitre_attack_id": "T1553.004", "mitre_attack_technique": "Install Root Certificate", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1553", "mitre_attack_technique": "Subvert Trust Controls", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Axiom"]}, {"mitre_attack_id": "T1547.001", "mitre_attack_technique": "Registry Run Keys / Startup Folder", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Dark Caracal", "Darkhotel", "Dragonfly", "FIN10", "FIN6", "FIN7", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Putter Panda", "RTM", "Rocke", "Sidewinder", "Silence", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Delivery", "Exploitation", "Installation"]}, "detection_names": ["ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Windows Driver Load Non-Standard Path - Rule", "ESCU - Windows Drivers Loaded by Signature - Rule", "ESCU - Windows Registry Certificate Added - Rule", "ESCU - Windows Registry Modification for Safe Mode Persistence - Rule", "ESCU - Windows Service Create Kernel Mode Driver - Rule", "ESCU - Windows System File on Disk - Rule", "ESCU - Windows Driver Inventory - Rule", "ESCU - Windows Vulnerable Driver Loaded - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Sc exe Manipulating Windows Services", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Service"}, {"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Windows Driver Load Non-Standard Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Rootkit"}]}}, {"name": "Windows Drivers Loaded by Signature", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Rootkit"}, {"mitre_attack_technique": "Exploitation for Privilege Escalation"}]}}, {"name": "Windows Registry Certificate Added", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Install Root Certificate"}, {"mitre_attack_technique": "Subvert Trust Controls"}]}}, {"name": "Windows Registry Modification for Safe Mode Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Registry Run Keys / Startup Folder"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Windows Service Create Kernel Mode Driver", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Service"}, {"mitre_attack_technique": "Create or Modify System Process"}, {"mitre_attack_technique": "Exploitation for Privilege Escalation"}]}}, {"name": "Windows System File on Disk", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation for Privilege Escalation"}]}}, {"name": "Windows Driver Inventory", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation for Privilege Escalation"}]}}, {"name": "Windows Vulnerable Driver Loaded", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Service"}]}}]}, {"name": "Windows File Extension and Association Abuse", "id": "30552a76-ac78-48e4-b3c0-de4e34e9563d", "version": 1, "date": "2018-01-26", "author": "Rico Valdez, Splunk", "description": "Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques.", "narrative": "Attackers use a variety of techniques to entice users to run malicious code or to persist on an endpoint. One way to accomplish these goals is to leverage file extensions and the mechanism Windows uses to associate files with specific applications. \\\n Since its earliest days, Windows has used extensions to identify file types. Users have become familiar with these extensions and their application associations. For example, if users see that a file ends in `.doc` or `.docx`, they will assume that it is a Microsoft Word document and expect that double-clicking will open it using `winword.exe`. The user will typically also presume that the `.docx` file is safe. \\\n Attackers take advantage of this expectation by obfuscating the true file extension. They can accomplish this in a couple of ways. One technique involves inserting multiple spaces in the file name before the extension to hide the extension from the GUI, obscuring the true nature of the file. Another approach involves prepending the real extension with a different one. This is especially effective when Windows is configured to \"hide extensions for known file types.\" In this case, the real extension is not displayed, but the prepended one is, leading end users to believe the file is a different type than it actually is.\\\nChanging the association between a file extension and an application can allow an attacker to execute arbitrary code. The technique typically involves changing the association for an often-launched file type to associate instead with a malicious program the attacker has dropped on the endpoint. When the end user launches a file that has been manipulated in this way, it will execute the attacker's malware. It will also execute the application the end user expected to run, cleverly obscuring the fact that something suspicious has occurred.\\\nRun the searches in this story to detect and investigate suspicious behavior that may indicate abuse or manipulation of Windows file extensions and/or associations.", "references": ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"], "tags": {"name": "Windows File Extension and Association Abuse", "analytic_story": "Windows File Extension and Association Abuse", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1036.003", "mitre_attack_technique": "Rename System Utilities", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT32", "GALLIUM", "Lazarus Group", "menuPass"]}, {"mitre_attack_id": "T1546.001", "mitre_attack_technique": "Change Default File Association", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Kimsuky"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}], "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Execution of File with Multiple Extensions - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Rico Valdez", "detections": [{"name": "Execution of File With Spaces Before Extension", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Rename System Utilities"}]}}, {"name": "Suspicious Changes to File Associations", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Change Default File Association"}]}}, {"name": "Execution of File with Multiple Extensions", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "Rename System Utilities"}]}}]}, {"name": "Windows Log Manipulation", "id": "b6db2c60-a281-48b4-95f1-2cd99ed56835", "version": 2, "date": "2017-09-12", "author": "Rico Valdez, Splunk", "description": "Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense.", "narrative": "Because attackers often modify system logs to cover their tracks and/or to thwart the investigative process, log monitoring is an industry-recognized best practice. While there are legitimate reasons to manipulate system logs, it is still worthwhile to keep track of who manipulated the logs, when they manipulated them, and in what way they manipulated them (determining which accesses, tools, or utilities were employed). Even if no malicious activity is detected, the knowledge of an attempt to manipulate system logs may be indicative of a broader security risk that should be thoroughly investigated.\\\nThe Analytic Story gives users two different ways to detect manipulation of Windows Event Logs and one way to detect deletion of the Update Sequence Number (USN) Change Journal. The story helps determine the history of the host and the users who have accessed it. Finally, the story aides in investigation by retrieving all the information on the process that caused these events (if the process has been identified).", "references": ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"], "tags": {"name": "Windows Log Manipulation", "analytic_story": "Windows Log Manipulation", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1490", "mitre_attack_technique": "Inhibit System Recovery", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1070", "mitre_attack_technique": "Indicator Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Lazarus Group"]}, {"mitre_attack_id": "T1070.001", "mitre_attack_technique": "Clear Windows Event Logs", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT32", "APT38", "APT41", "Chimera", "Dragonfly", "FIN5", "FIN8", "Indrik Spider"]}], "mitre_attack_tactics": ["Defense Evasion", "Impact"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Rico Valdez", "detections": [{"name": "Deleting Shadow Copies", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Suspicious Event Log Service Behavior", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}, {"mitre_attack_technique": "Clear Windows Event Logs"}]}}, {"name": "Suspicious wevtutil Usage", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Clear Windows Event Logs"}, {"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "USN Journal Deletion", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}]}}, {"name": "Windows Event Log Cleared", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}, {"mitre_attack_technique": "Clear Windows Event Logs"}]}}]}, {"name": "Windows Persistence Techniques", "id": "30874d4f-20a1-488f-85ec-5d52ef74e3f9", "version": 2, "date": "2018-05-31", "author": "Bhavin Patel, Splunk", "description": "Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.", "narrative": "Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment.", "references": ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"], "tags": {"name": "Windows Persistence Techniques", "analytic_story": "Windows Persistence Techniques", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1564.001", "mitre_attack_technique": "Hidden Files and Directories", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT32", "Lazarus Group", "Mustang Panda", "Rocke", "Transparent Tribe", "Tropic Trooper"]}, {"mitre_attack_id": "T1547.014", "mitre_attack_technique": "Active Setup", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1546.001", "mitre_attack_technique": "Change Default File Association", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Kimsuky"]}, {"mitre_attack_id": "T1546", "mitre_attack_technique": "Event Triggered Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1574.009", "mitre_attack_technique": "Path Interception by Unquoted Path", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1574", "mitre_attack_technique": "Hijack Execution Flow", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1562.006", "mitre_attack_technique": "Indicator Blocking", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1127", "mitre_attack_technique": "Trusted Developer Utilities Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1222", "mitre_attack_technique": "File and Directory Permissions Modification", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1222.001", "mitre_attack_technique": "Windows File and Directory Permissions Modification", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Wizard Spider"]}, {"mitre_attack_id": "T1037", "mitre_attack_technique": "Boot or Logon Initialization Scripts", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Rocke"]}, {"mitre_attack_id": "T1037.001", "mitre_attack_technique": "Logon Script (Windows)", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "Cobalt Group"]}, {"mitre_attack_id": "T1547.010", "mitre_attack_technique": "Port Monitors", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1574.011", "mitre_attack_technique": "Services Registry Permissions Weakness", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1546.011", "mitre_attack_technique": "Application Shimming", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["FIN7"]}, {"mitre_attack_id": "T1547.001", "mitre_attack_technique": "Registry Run Keys / Startup Folder", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Dark Caracal", "Darkhotel", "Dragonfly", "FIN10", "FIN6", "FIN7", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Putter Panda", "RTM", "Rocke", "Sidewinder", "Silence", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1546.002", "mitre_attack_technique": "Screensaver", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547.003", "mitre_attack_technique": "Time Providers", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1546.012", "mitre_attack_technique": "Image File Execution Options Injection", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["TEMP.Veles"]}, {"mitre_attack_id": "T1218.005", "mitre_attack_technique": "Mshta", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "APT32", "Confucius", "Earth Lusca", "FIN7", "Gamaredon Group", "Inception", "Kimsuky", "Lazarus Group", "LazyScripter", "MuddyWater", "Mustang Panda", "SideCopy", "Sidewinder", "TA551"]}, {"mitre_attack_id": "T1547.012", "mitre_attack_technique": "Print Processors", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}], "mitre_attack_tactics": ["Defense Evasion", "Execution", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation"]}, "detection_names": ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Active Setup Registry Autostart - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - Windows Event Triggered Image File Execution Options Injection - Rule", "ESCU - Windows Mshta Execution In Registry - Rule", "ESCU - Windows Registry Delete Task SD - Rule", "ESCU - Windows Schtasks Create Run As System - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Print Processor Registry Autostart - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Reg exe used to hide files directories via registry keys", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Hidden Files and Directories"}]}}, {"name": "Remote Registry Key modifications", "source": "deprecated", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}, {"name": "Active Setup Registry Autostart", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Active Setup"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Certutil exe certificate extraction", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": []}}, {"name": "Change Default File Association", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Change Default File Association"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "Detect Path Interception By Creation Of program exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Path Interception by Unquoted Path"}, {"mitre_attack_technique": "Hijack Execution Flow"}]}}, {"name": "ETW Registry Disabled", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Blocking"}, {"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Hiding Files And Directories With Attrib exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File and Directory Permissions Modification"}, {"mitre_attack_technique": "Windows File and Directory Permissions Modification"}]}}, {"name": "Logon Script Event Trigger Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Boot or Logon Initialization Scripts"}, {"mitre_attack_technique": "Logon Script (Windows)"}]}}, {"name": "Monitor Registry Keys for Print Monitors", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Port Monitors"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Reg exe Manipulating Windows Services Registry Keys", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Services Registry Permissions Weakness"}, {"mitre_attack_technique": "Hijack Execution Flow"}]}}, {"name": "Registry Keys for Creating SHIM Databases", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Application Shimming"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "Registry Keys Used For Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Registry Run Keys / Startup Folder"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Sc exe Manipulating Windows Services", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Service"}, {"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Schedule Task with HTTP Command Arguments", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Schedule Task with Rundll32 Command Trigger", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Scheduled Task Deleted Or Created via CMD", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Schtasks used for forcing a reboot", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Screensaver Event Trigger Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Event Triggered Execution"}, {"mitre_attack_technique": "Screensaver"}]}}, {"name": "Shim Database File Creation", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Application Shimming"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "Shim Database Installation With Suspicious Parameters", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Application Shimming"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "Suspicious Scheduled Task from Public Directory", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Time Provider Persistence Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Time Providers"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Windows Event Triggered Image File Execution Options Injection", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Image File Execution Options Injection"}]}}, {"name": "Windows Mshta Execution In Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Mshta"}]}}, {"name": "Windows Registry Delete Task SD", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows Schtasks Create Run As System", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Windows Service Creation Using Registry Entry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Services Registry Permissions Weakness"}]}}, {"name": "WinEvent Scheduled Task Created to Spawn Shell", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "WinEvent Scheduled Task Created Within Public Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "WinEvent Windows Task Scheduler Event Action Started", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}]}}, {"name": "Print Processor Registry Autostart", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Print Processors"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}]}, {"name": "Windows Post-Exploitation", "id": "992899b7-a5cf-4bcd-bb0d-cf81762188ba", "version": 1, "date": "2022-11-30", "author": "Teoderick Contreras, Splunk", "description": "This analytic story identifies popular Windows post exploitation tools for example winpeas.bat, winpeas.exe, WinPrivCheck.bat and many more.", "narrative": "These tools allow operators to find possible exploits or paths for privilege escalation and persistence on a targeted host. Ransomware operator like the \"Prestige ransomware\" also used or abuses these post exploitation tools such as winPEAS to scan for possible avenue to gain privileges and persistence to a targeted Windows Operating System.", "references": ["https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"], "tags": {"name": "Windows Post-Exploitation", "analytic_story": "Windows Post-Exploitation", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Security Monitoring", "mitre_attack_enrichments": [{"mitre_attack_id": "T1070", "mitre_attack_technique": "Indicator Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Lazarus Group"]}, {"mitre_attack_id": "T1070.005", "mitre_attack_technique": "Network Share Connection Removal", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Threat Group-3390"]}, {"mitre_attack_id": "T1069", "mitre_attack_technique": "Permission Groups Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "APT3", "TA505"]}, {"mitre_attack_id": "T1069.002", "mitre_attack_technique": "Domain Groups", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "Dragonfly", "Inception", "Ke3chang", "LAPSUS$", "OilRig", "Turla"]}, {"mitre_attack_id": "T1222", "mitre_attack_technique": "File and Directory Permissions Modification", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1531", "mitre_attack_technique": "Account Access Removal", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["LAPSUS$"]}, {"mitre_attack_id": "T1069.001", "mitre_attack_technique": "Local Groups", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["Chimera", "HEXANE", "OilRig", "Tonto Team", "Turla", "admin@338"]}, {"mitre_attack_id": "T1049", "mitre_attack_technique": "System Network Connections Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT1", "APT3", "APT32", "APT38", "APT41", "Andariel", "BackdoorDiplomacy", "Chimera", "Earth Lusca", "GALLIUM", "HEXANE", "Ke3chang", "Lazarus Group", "Magic Hound", "MuddyWater", "Mustang Panda", "OilRig", "Poseidon Group", "Sandworm Team", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1016", "mitre_attack_technique": "System Network Configuration Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT1", "APT19", "APT3", "APT32", "APT41", "Chimera", "Darkhotel", "Dragonfly", "Earth Lusca", "GALLIUM", "HEXANE", "Higaisa", "Ke3chang", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "SideCopy", "Sidewinder", "Stealth Falcon", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Wizard Spider", "ZIRCONIUM", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1016.001", "mitre_attack_technique": "Internet Connection Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29", "Gamaredon Group", "HEXANE", "Turla"]}, {"mitre_attack_id": "T1592", "mitre_attack_technique": "Gather Victim Host Information", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1003.005", "mitre_attack_technique": "Cached Domain Credentials", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT33", "Leafminer", "MuddyWater", "OilRig"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1115", "mitre_attack_technique": "Clipboard Data", "mitre_attack_tactics": ["Collection"], "mitre_attack_groups": ["APT38", "APT39"]}, {"mitre_attack_id": "T1555", "mitre_attack_technique": "Credentials from Password Stores", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "APT33", "APT39", "Evilnum", "FIN6", "HEXANE", "Leafminer", "MuddyWater", "OilRig", "Stealth Falcon"]}, {"mitre_attack_id": "T1552.002", "mitre_attack_technique": "Credentials in Registry", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT32"]}, {"mitre_attack_id": "T1552", "mitre_attack_technique": "Unsecured Credentials", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1202", "mitre_attack_technique": "Indirect Command Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Lazarus Group"]}, {"mitre_attack_id": "T1082", "mitre_attack_technique": "System Information Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT18", "APT19", "APT29", "APT3", "APT32", "APT37", "APT38", "Aquatic Panda", "Blue Mockingbird", "Chimera", "Confucius", "Darkhotel", "Gamaredon Group", "HEXANE", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "Magic Hound", "Moses Staff", "MuddyWater", "Mustang Panda", "OilRig", "Patchwork", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Sowbug", "Stealth Falcon", "TeamTNT", "Tropic Trooper", "Turla", "Windigo", "Windshift", "Wizard Spider", "ZIRCONIUM", "admin@338"]}, {"mitre_attack_id": "T1012", "mitre_attack_technique": "Query Registry", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT32", "APT39", "Chimera", "Dragonfly", "Fox Kitten", "Kimsuky", "Lazarus Group", "OilRig", "Stealth Falcon", "Threat Group-3390", "Turla", "ZIRCONIUM"]}, {"mitre_attack_id": "T1555.005", "mitre_attack_technique": "Password Managers", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Fox Kitten", "Threat Group-3390"]}, {"mitre_attack_id": "T1552.004", "mitre_attack_technique": "Private Keys", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "Rocke", "TeamTNT"]}, {"mitre_attack_id": "T1547.005", "mitre_attack_technique": "Security Support Provider", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1558", "mitre_attack_technique": "Steal or Forge Kerberos Tickets", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1033", "mitre_attack_technique": "System Owner/User Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT37", "APT38", "APT39", "APT41", "Chimera", "Dragonfly", "Earth Lusca", "FIN10", "GALLIUM", "Gamaredon Group", "HEXANE", "Ke3chang", "Lazarus Group", "Magic Hound", "MuddyWater", "OilRig", "Patchwork", "Sandworm Team", "Sidewinder", "Stealth Falcon", "Threat Group-3390", "Tropic Trooper", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1047", "mitre_attack_technique": "Windows Management Instrumentation", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT29", "APT32", "APT41", "Blue Mockingbird", "Chimera", "Deep Panda", "Earth Lusca", "FIN6", "FIN7", "FIN8", "GALLIUM", "Gamaredon Group", "Indrik Spider", "Lazarus Group", "Leviathan", "Magic Hound", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Sandworm Team", "Stealth Falcon", "Threat Group-3390", "Windshift", "Wizard Spider", "menuPass"]}], "mitre_attack_tactics": ["Collection", "Credential Access", "Defense Evasion", "Discovery", "Execution", "Impact", "Persistence", "Privilege Escalation", "Reconnaissance"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Reconnaissance"]}, "detection_names": ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - Domain Group Discovery With Net - Rule", "ESCU - Excessive Usage Of Cacls App - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Net Localgroup Discovery - Rule", "ESCU - Network Connection Discovery With Arp - Rule", "ESCU - Network Connection Discovery With Net - Rule", "ESCU - Network Connection Discovery With Netstat - Rule", "ESCU - Network Discovery Using Route Windows App - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Windows Cached Domain Credentials Reg Query - Rule", "ESCU - Windows ClipBoard Data via Get-ClipBoard - Rule", "ESCU - Windows Credentials from Password Stores Query - Rule", "ESCU - Windows Credentials in Registry Reg Query - Rule", "ESCU - Windows Indirect Command Execution Via Series Of Forfiles - Rule", "ESCU - Windows Information Discovery Fsutil - Rule", "ESCU - Windows Modify Registry Reg Restore - Rule", "ESCU - Windows Password Managers Discovery - Rule", "ESCU - Windows Private Keys Discovery - Rule", "ESCU - Windows Query Registry Reg Save - Rule", "ESCU - Windows Security Support Provider Reg Query - Rule", "ESCU - Windows Steal or Forge Kerberos Tickets Klist - Rule", "ESCU - Windows System Network Config Discovery Display DNS - Rule", "ESCU - Windows System Network Connections Discovery Netsh - Rule", "ESCU - Windows System User Discovery Via Quser - Rule", "ESCU - Windows WMI Process And Service List - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Create or delete windows shares using net exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Removal"}, {"mitre_attack_technique": "Network Share Connection Removal"}]}}, {"name": "Domain Group Discovery With Net", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Domain Groups"}]}}, {"name": "Excessive Usage Of Cacls App", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File and Directory Permissions Modification"}]}}, {"name": "Excessive Usage Of Net App", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Access Removal"}]}}, {"name": "Net Localgroup Discovery", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Permission Groups Discovery"}, {"mitre_attack_technique": "Local Groups"}]}}, {"name": "Network Connection Discovery With Arp", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Connections Discovery"}]}}, {"name": "Network Connection Discovery With Net", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Connections Discovery"}]}}, {"name": "Network Connection Discovery With Netstat", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Connections Discovery"}]}}, {"name": "Network Discovery Using Route Windows App", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Configuration Discovery"}, {"mitre_attack_technique": "Internet Connection Discovery"}]}}, {"name": "Recon AVProduct Through Pwh or WMI", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Gather Victim Host Information"}]}}, {"name": "Windows Cached Domain Credentials Reg Query", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Cached Domain Credentials"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Windows ClipBoard Data via Get-ClipBoard", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Clipboard Data"}]}}, {"name": "Windows Credentials from Password Stores Query", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Credentials from Password Stores"}]}}, {"name": "Windows Credentials in Registry Reg Query", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Credentials in Registry"}, {"mitre_attack_technique": "Unsecured Credentials"}]}}, {"name": "Windows Indirect Command Execution Via Series Of Forfiles", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indirect Command Execution"}]}}, {"name": "Windows Information Discovery Fsutil", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Information Discovery"}]}}, {"name": "Windows Modify Registry Reg Restore", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Query Registry"}]}}, {"name": "Windows Password Managers Discovery", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Password Managers"}]}}, {"name": "Windows Private Keys Discovery", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Private Keys"}, {"mitre_attack_technique": "Unsecured Credentials"}]}}, {"name": "Windows Query Registry Reg Save", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Query Registry"}]}}, {"name": "Windows Security Support Provider Reg Query", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Support Provider"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Windows Steal or Forge Kerberos Tickets Klist", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}]}}, {"name": "Windows System Network Config Discovery Display DNS", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Configuration Discovery"}]}}, {"name": "Windows System Network Connections Discovery Netsh", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Network Connections Discovery"}]}}, {"name": "Windows System User Discovery Via Quser", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Owner/User Discovery"}]}}, {"name": "Windows WMI Process And Service List", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Management Instrumentation"}]}}]}, {"name": "Windows Privilege Escalation", "id": "644e22d3-598a-429c-a007-16fdb802cae5", "version": 2, "date": "2020-02-04", "author": "David Dorsey, Splunk", "description": "Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more.", "narrative": "Privilege escalation is a \"land-and-expand\" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Windows machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment.", "references": ["https://attack.mitre.org/tactics/TA0004/"], "tags": {"name": "Windows Privilege Escalation", "analytic_story": "Windows Privilege Escalation", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1204.002", "mitre_attack_technique": "Malicious File", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT-C-36", "APT12", "APT19", "APT28", "APT29", "APT30", "APT32", "APT33", "APT37", "APT38", "APT39", "Ajax Security Team", "Andariel", "Aoqin Dragon", "BITTER", "BRONZE BUTLER", "BlackTech", "Cobalt Group", "Confucius", "Dark Caracal", "DarkHydrus", "Darkhotel", "Dragonfly", "EXOTIC LILY", "Earth Lusca", "Elderwood", "Ember Bear", "FIN4", "FIN6", "FIN7", "FIN8", "Ferocious Kitten", "Gallmaker", "Gamaredon Group", "Gorgon Group", "HEXANE", "Higaisa", "Inception", "IndigoZebra", "Indrik Spider", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Machete", "Magic Hound", "Mofang", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "Nomadic Octopus", "OilRig", "PLATINUM", "PROMETHIUM", "Patchwork", "RTM", "Rancor", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA459", "TA505", "TA551", "The White Company", "Threat Group-3390", "Tonto Team", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Whitefly", "Windshift", "Wizard Spider", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1547.014", "mitre_attack_technique": "Active Setup", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1546.001", "mitre_attack_technique": "Change Default File Association", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Kimsuky"]}, {"mitre_attack_id": "T1546", "mitre_attack_technique": "Event Triggered Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1562.006", "mitre_attack_technique": "Indicator Blocking", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1127", "mitre_attack_technique": "Trusted Developer Utilities Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1558", "mitre_attack_technique": "Steal or Forge Kerberos Tickets", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1558.003", "mitre_attack_technique": "Kerberoasting", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT29", "FIN7", "Wizard Spider"]}, {"mitre_attack_id": "T1037", "mitre_attack_technique": "Boot or Logon Initialization Scripts", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Rocke"]}, {"mitre_attack_id": "T1037.001", "mitre_attack_technique": "Logon Script (Windows)", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "Cobalt Group"]}, {"mitre_attack_id": "T1574.002", "mitre_attack_technique": "DLL Side-Loading", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT41", "BRONZE BUTLER", "BlackTech", "Chimera", "Earth Lusca", "GALLIUM", "Higaisa", "Lazarus Group", "MuddyWater", "Mustang Panda", "Naikon", "Patchwork", "SideCopy", "Sidewinder", "Threat Group-3390", "Tropic Trooper", "menuPass"]}, {"mitre_attack_id": "T1574", "mitre_attack_technique": "Hijack Execution Flow", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1546.008", "mitre_attack_technique": "Accessibility Features", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT29", "APT3", "APT41", "Axiom", "Deep Panda", "Fox Kitten"]}, {"mitre_attack_id": "T1546.012", "mitre_attack_technique": "Image File Execution Options Injection", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["TEMP.Veles"]}, {"mitre_attack_id": "T1134", "mitre_attack_technique": "Access Token Manipulation", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["Blue Mockingbird", "FIN6"]}, {"mitre_attack_id": "T1134.001", "mitre_attack_technique": "Token Impersonation/Theft", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT28", "FIN8"]}, {"mitre_attack_id": "T1546.002", "mitre_attack_technique": "Screensaver", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547.003", "mitre_attack_technique": "Time Providers", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1068", "mitre_attack_technique": "Exploitation for Privilege Escalation", "mitre_attack_tactics": ["Privilege Escalation"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "APT33", "BITTER", "Cobalt Group", "FIN6", "FIN8", "LAPSUS$", "PLATINUM", "Threat Group-3390", "Tonto Team", "Turla", "Whitefly", "ZIRCONIUM"]}, {"mitre_attack_id": "T1547.012", "mitre_attack_technique": "Print Processors", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Execution", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"]}, "detection_names": ["ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Active Setup Registry Autostart - Rule", "ESCU - Change Default File Association - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - MSI Module Loaded by Non-System Binary - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Runas Execution in CommandLine - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Print Processor Registry Autostart - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"], "baseline_names": [], "author_company": "Splunk", "author_name": "David Dorsey", "detections": [{"name": "Uncommon Processes On Endpoint", "source": "deprecated", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Malicious File"}]}}, {"name": "Active Setup Registry Autostart", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Active Setup"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Change Default File Association", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Change Default File Association"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "ETW Registry Disabled", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Blocking"}, {"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Kerberoasting spn request with RC4 encryption", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Steal or Forge Kerberos Tickets"}, {"mitre_attack_technique": "Kerberoasting"}]}}, {"name": "Logon Script Event Trigger Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Boot or Logon Initialization Scripts"}, {"mitre_attack_technique": "Logon Script (Windows)"}]}}, {"name": "MSI Module Loaded by Non-System Binary", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "DLL Side-Loading"}, {"mitre_attack_technique": "Hijack Execution Flow"}]}}, {"name": "Overwriting Accessibility Binaries", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Event Triggered Execution"}, {"mitre_attack_technique": "Accessibility Features"}]}}, {"name": "Registry Keys Used For Privilege Escalation", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Image File Execution Options Injection"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "Runas Execution in CommandLine", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Access Token Manipulation"}, {"mitre_attack_technique": "Token Impersonation/Theft"}]}}, {"name": "Screensaver Event Trigger Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Event Triggered Execution"}, {"mitre_attack_technique": "Screensaver"}]}}, {"name": "Time Provider Persistence Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Time Providers"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Child Processes of Spoolsv exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Exploitation for Privilege Escalation"}]}}, {"name": "Print Processor Registry Autostart", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Print Processors"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}]}, {"name": "Windows Registry Abuse", "id": "78df1df1-25f1-4387-90f9-c4ea31ce6b75", "version": 1, "date": "2022-03-17", "author": "Teoderick Contreras, Splunk", "description": "Windows services are often used by attackers for persistence, privilege escalation, lateral movement, defense evasion, collection of data, a tool for recon, credential dumping and payload impact. This Analytic Story helps you monitor your environment for indications that Windows registry are being modified or created in a suspicious manner.", "narrative": "Windows Registry is one of the powerful and yet still mysterious Windows features that can tweak or manipulate Windows policies and low-level configuration settings. Because of this capability,  most malware, adversaries or threat actors abuse this hierarchical database to do their malicious intent on a targeted host or network environment. In these cases, attackers often use tools to create or modify registry in ways that are not typical for most environments, providing opportunities for detection.", "references": ["https://attack.mitre.org/techniques/T1112/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/"], "tags": {"name": "Windows Registry Abuse", "analytic_story": "Windows Registry Abuse", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1021.001", "mitre_attack_technique": "Remote Desktop Protocol", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": ["APT1", "APT29", "APT3", "APT39", "APT41", "Axiom", "Blue Mockingbird", "Chimera", "Cobalt Group", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "HEXANE", "Kimsuky", "Lazarus Group", "Leviathan", "Magic Hound", "OilRig", "Patchwork", "Silence", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1021", "mitre_attack_technique": "Remote Services", "mitre_attack_tactics": ["Lateral Movement"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1548", "mitre_attack_technique": "Abuse Elevation Control Mechanism", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1552.002", "mitre_attack_technique": "Credentials in Registry", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT32"]}, {"mitre_attack_id": "T1552", "mitre_attack_technique": "Unsecured Credentials", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1546.001", "mitre_attack_technique": "Change Default File Association", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Kimsuky"]}, {"mitre_attack_id": "T1546", "mitre_attack_technique": "Event Triggered Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1112", "mitre_attack_technique": "Modify Registry", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT19", "APT32", "APT38", "APT41", "Blue Mockingbird", "Dragonfly", "Earth Lusca", "Ember Bear", "FIN8", "Gamaredon Group", "Gorgon Group", "Kimsuky", "Magic Hound", "Patchwork", "Silence", "TA505", "Threat Group-3390", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1564.001", "mitre_attack_technique": "Hidden Files and Directories", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT32", "Lazarus Group", "Mustang Panda", "Rocke", "Transparent Tribe", "Tropic Trooper"]}, {"mitre_attack_id": "T1564", "mitre_attack_technique": "Hide Artifacts", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1548.002", "mitre_attack_technique": "Bypass User Account Control", "mitre_attack_tactics": ["Defense Evasion", "Privilege Escalation"], "mitre_attack_groups": ["APT29", "APT37", "BRONZE BUTLER", "Cobalt Group", "Earth Lusca", "Evilnum", "MuddyWater", "Patchwork", "Threat Group-3390"]}, {"mitre_attack_id": "T1490", "mitre_attack_technique": "Inhibit System Recovery", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1562.006", "mitre_attack_technique": "Indicator Blocking", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1127", "mitre_attack_technique": "Trusted Developer Utilities Proxy Execution", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1491", "mitre_attack_technique": "Defacement", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547.010", "mitre_attack_technique": "Port Monitors", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547", "mitre_attack_technique": "Boot or Logon Autostart Execution", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1546.011", "mitre_attack_technique": "Application Shimming", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["FIN7"]}, {"mitre_attack_id": "T1547.001", "mitre_attack_technique": "Registry Run Keys / Startup Folder", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT18", "APT19", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT39", "APT41", "BRONZE BUTLER", "Cobalt Group", "Confucius", "Dark Caracal", "Darkhotel", "Dragonfly", "FIN10", "FIN6", "FIN7", "Gamaredon Group", "Gorgon Group", "Higaisa", "Inception", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Putter Panda", "RTM", "Rocke", "Sidewinder", "Silence", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Turla", "Windshift", "Wizard Spider", "ZIRCONIUM"]}, {"mitre_attack_id": "T1546.012", "mitre_attack_technique": "Image File Execution Options Injection", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["TEMP.Veles"]}, {"mitre_attack_id": "T1546.002", "mitre_attack_technique": "Screensaver", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547.003", "mitre_attack_technique": "Time Providers", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1547.008", "mitre_attack_technique": "LSASS Driver", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1485", "mitre_attack_technique": "Data Destruction", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["APT38", "Gamaredon Group", "LAPSUS$", "Lazarus Group", "Sandworm Team"]}, {"mitre_attack_id": "T1553.004", "mitre_attack_technique": "Install Root Certificate", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1553", "mitre_attack_technique": "Subvert Trust Controls", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Axiom"]}, {"mitre_attack_id": "T1053.005", "mitre_attack_technique": "Scheduled Task", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT-C-36", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "BITTER", "BRONZE BUTLER", "Blue Mockingbird", "Chimera", "Cobalt Group", "Confucius", "Dragonfly", "FIN10", "FIN6", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "HEXANE", "Higaisa", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "Molerats", "MuddyWater", "Mustang Panda", "Naikon", "OilRig", "Patchwork", "Rancor", "Silence", "Stealth Falcon", "TEMP.Veles", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1574.011", "mitre_attack_technique": "Services Registry Permissions Weakness", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Credential Access", "Defense Evasion", "Execution", "Impact", "Lateral Movement", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Installation"]}, "detection_names": ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Auto Admin Logon Registry Entry - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable Defender AntiVirus Registry - Rule", "ESCU - Disable Defender BlockAtFirstSeen Feature - Rule", "ESCU - Disable Defender Enhanced Notification - Rule", "ESCU - Disable Defender MpEngine Registry - Rule", "ESCU - Disable Defender Spynet Reporting - Rule", "ESCU - Disable Defender Submit Samples Consent Feature - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows App Hotkeys - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Defender Services - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Enable WDigest UseLogonCredential Registry - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Hide User Account From Sign-In Screen - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Remcos client registry install entry - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - Windows Autostart Execution LSASS Driver Registry Modification - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Notification Center - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows Impair Defense Delete Win Defender Context Menu - Rule", "ESCU - Windows Impair Defense Delete Win Defender Profile Registry - Rule", "ESCU - Windows Impair Defenses Disable Win Defender Auto Logging - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Registry Certificate Added - Rule", "ESCU - Windows Registry Delete Task SD - Rule", "ESCU - Windows Registry Modification for Safe Mode Persistence - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - WSReset UAC Bypass - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Allow Inbound Traffic By Firewall Rule Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Desktop Protocol"}, {"mitre_attack_technique": "Remote Services"}]}}, {"name": "Allow Operation with Consent Admin", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Attempted Credential Dump From Registry via Reg exe", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "Auto Admin Logon Registry Entry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Credentials in Registry"}, {"mitre_attack_technique": "Unsecured Credentials"}]}}, {"name": "Change Default File Association", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Change Default File Association"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "Disable AMSI Through Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Defender AntiVirus Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Defender BlockAtFirstSeen Feature", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Defender Enhanced Notification", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Defender MpEngine Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Defender Spynet Reporting", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Defender Submit Samples Consent Feature", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable ETW Through Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Registry Tool", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Security Logs Using MiniNt Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Disable Show Hidden Files", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Hidden Files and Directories"}, {"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Hide Artifacts"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable UAC Remote Restriction", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Disable Windows App Hotkeys", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Windows Behavior Monitoring", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disable Windows SmartScreen Protection", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disabling CMD Application", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disabling ControlPanel", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disabling Defender Services", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disabling FolderOptions Windows Feature", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disabling NoRun Windows App", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disabling Remote User Account Control", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Disabling SystemRestore In Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Inhibit System Recovery"}]}}, {"name": "Disabling Task Manager", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Enable RDP In Other Port Number", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Remote Services"}]}}, {"name": "Enable WDigest UseLogonCredential Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}, {"name": "ETW Registry Disabled", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Indicator Blocking"}, {"mitre_attack_technique": "Trusted Developer Utilities Proxy Execution"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Eventvwr UAC Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Hide User Account From Sign-In Screen", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Modification Of Wallpaper", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Defacement"}]}}, {"name": "Monitor Registry Keys for Print Monitors", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Port Monitors"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Registry Keys for Creating SHIM Databases", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Application Shimming"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "Registry Keys Used For Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Registry Run Keys / Startup Folder"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Registry Keys Used For Privilege Escalation", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Image File Execution Options Injection"}, {"mitre_attack_technique": "Event Triggered Execution"}]}}, {"name": "Remcos client registry install entry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Revil Registry Entry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Screensaver Event Trigger Execution", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Event Triggered Execution"}, {"mitre_attack_technique": "Screensaver"}]}}, {"name": "Sdclt UAC Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "SilentCleanup UAC Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}, {"name": "Time Provider Persistence Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Time Providers"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Windows Autostart Execution LSASS Driver Registry Modification", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "LSASS Driver"}]}}, {"name": "Windows Disable Lock Workstation Feature Through Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Disable LogOff Button Through Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Disable Memory Crash Dump", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Data Destruction"}]}}, {"name": "Windows Disable Notification Center", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Disable Shutdown Button Through Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Disable Windows Group Policy Features Through Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows DisableAntiSpyware Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows Hide Notification Features Through Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Impair Defense Delete Win Defender Context Menu", "source": "endpoint", "type": "Hunting", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows Impair Defense Delete Win Defender Profile Registry", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows Impair Defenses Disable Win Defender Auto Logging", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows Modify Show Compress Color And Info Tip Registry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Modify Registry"}]}}, {"name": "Windows Registry Certificate Added", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Install Root Certificate"}, {"mitre_attack_technique": "Subvert Trust Controls"}]}}, {"name": "Windows Registry Delete Task SD", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Windows Registry Modification for Safe Mode Persistence", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Registry Run Keys / Startup Folder"}, {"mitre_attack_technique": "Boot or Logon Autostart Execution"}]}}, {"name": "Windows Service Creation Using Registry Entry", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Services Registry Permissions Weakness"}]}}, {"name": "WSReset UAC Bypass", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Bypass User Account Control"}, {"mitre_attack_technique": "Abuse Elevation Control Mechanism"}]}}]}, {"name": "Windows Service Abuse", "id": "6dbd810e-f66d-414b-8dfc-e46de55cbfe2", "version": 3, "date": "2017-11-02", "author": "Rico Valdez, Splunk", "description": "Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner.", "narrative": "The Windows operating system uses a services architecture to allow for running code in the background, similar to a UNIX daemon. Attackers will often leverage Windows services for persistence, hiding in plain sight, seeking the ability to run privileged code that can interact with the kernel. In many cases, attackers will create a new service to host their malicious code. Attackers have also been observed modifying unnecessary or unused services to point to their own code, as opposed to what was intended. In these cases, attackers often use tools to create or modify services in ways that are not typical for most environments, providing opportunities for detection.", "references": ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"], "tags": {"name": "Windows Service Abuse", "analytic_story": "Windows Service Abuse", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1574.011", "mitre_attack_technique": "Services Registry Permissions Weakness", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1574", "mitre_attack_technique": "Hijack Execution Flow", "mitre_attack_tactics": ["Defense Evasion", "Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1569", "mitre_attack_technique": "System Services", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["TeamTNT"]}, {"mitre_attack_id": "T1569.002", "mitre_attack_technique": "Service Execution", "mitre_attack_tactics": ["Execution"], "mitre_attack_groups": ["APT32", "APT38", "APT39", "APT41", "Blue Mockingbird", "Chimera", "FIN6", "Ke3chang", "Silence", "Wizard Spider"]}], "mitre_attack_tactics": ["Defense Evasion", "Execution", "Persistence", "Privilege Escalation"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Installation"]}, "detection_names": ["ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - First Time Seen Running Windows Service - Rule"], "investigation_names": ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"], "baseline_names": ["ESCU - Previously Seen Running Windows Services - Initial", "ESCU - Previously Seen Running Windows Services - Update"], "author_company": "Splunk", "author_name": "Rico Valdez", "detections": [{"name": "Reg exe Manipulating Windows Services Registry Keys", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Services Registry Permissions Weakness"}, {"mitre_attack_technique": "Hijack Execution Flow"}]}}, {"name": "Sc exe Manipulating Windows Services", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Service"}, {"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "First Time Seen Running Windows Service", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "System Services"}, {"mitre_attack_technique": "Service Execution"}]}}]}, {"name": "Windows System Binary Proxy Execution MSIExec", "id": "bea2e16b-4599-46ad-a95b-116078726c68", "version": 1, "date": "2022-06-16", "author": "Michael Haag, Splunk", "description": "Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).", "narrative": "Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. Msiexec.exe can also execute DLLs. Since it may be signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse. Msiexec.exe execution may also be elevated to SYSTEM privileges if the AlwaysInstallElevated policy is enabled.", "references": ["https://attack.mitre.org/techniques/T1218/007/"], "tags": {"name": "Windows System Binary Proxy Execution MSIExec", "analytic_story": "Windows System Binary Proxy Execution MSIExec", "category": ["Adversary Tactics"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1218.007", "mitre_attack_technique": "Msiexec", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Machete", "Molerats", "Rancor", "TA505", "ZIRCONIUM"]}], "mitre_attack_tactics": ["Defense Evasion"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Exploitation"]}, "detection_names": ["ESCU - Windows MSIExec DLLRegisterServer - Rule", "ESCU - Windows MSIExec Remote Download - Rule", "ESCU - Windows MSIExec Spawn Discovery Command - Rule", "ESCU - Windows MSIExec Unregister DLLRegisterServer - Rule", "ESCU - Windows MSIExec With Network Connections - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Splunk", "author_name": "Michael Haag", "detections": [{"name": "Windows MSIExec DLLRegisterServer", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Msiexec"}]}}, {"name": "Windows MSIExec Remote Download", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Msiexec"}]}}, {"name": "Windows MSIExec Spawn Discovery Command", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Msiexec"}]}}, {"name": "Windows MSIExec Unregister DLLRegisterServer", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Msiexec"}]}}, {"name": "Windows MSIExec With Network Connections", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Msiexec"}]}}]}, {"name": "XMRig", "id": "06723e6a-6bd8-4817-ace2-5fb8a7b06628", "version": 1, "date": "2021-05-07", "author": "Teoderick Contreras, Rod Soto Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the xmrig monero, including looking for file writes associated with its payload, process command-line, defense evasion (killing services, deleting users, modifying files or folder permission, killing other malware or other coin miner) and hacking tools including Telegram as mean of command and control (C2) to download other files. Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems which may impact system and/or hosted service availability. One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive. (1) Servers and cloud-based (2) systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining.", "narrative": "XMRig is a high performance, open source, cross platform RandomX, KawPow, CryptoNight and AstroBWT unified CPU/GPU miner. This monero is seen in the wild on May 2017.", "references": ["https://github.com/xmrig/xmrig", "https://www.getmonero.org/resources/user-guides/mine-to-pool.html", "https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/", "https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/"], "tags": {"name": "XMRig", "analytic_story": "XMRig", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1036.005", "mitre_attack_technique": "Match Legitimate Name or Location", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT1", "APT28", "APT29", "APT32", "APT39", "APT41", "Aoqin Dragon", "BRONZE BUTLER", "BackdoorDiplomacy", "Blue Mockingbird", "Carbanak", "Chimera", "Darkhotel", "Earth Lusca", "FIN7", "Ferocious Kitten", "Fox Kitten", "Gamaredon Group", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "Machete", "Magic Hound", "MuddyWater", "Mustang Panda", "Naikon", "PROMETHIUM", "Patchwork", "Poseidon Group", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "Sowbug", "TEMP.Veles", "TeamTNT", "Transparent Tribe", "Tropic Trooper", "WIRTE", "Whitefly", "admin@338", "menuPass"]}, {"mitre_attack_id": "T1036", "mitre_attack_technique": "Masquerading", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT28", "APT29", "APT32", "BRONZE BUTLER", "Dragonfly", "Kimsuky", "Lazarus Group", "LazyScripter", "Nomadic Octopus", "OilRig", "PLATINUM", "TA551", "TeamTNT", "Windshift", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}, {"mitre_attack_id": "T1595", "mitre_attack_technique": "Active Scanning", "mitre_attack_tactics": ["Reconnaissance"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1531", "mitre_attack_technique": "Account Access Removal", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["LAPSUS$"]}, {"mitre_attack_id": "T1562.001", "mitre_attack_technique": "Disable or Modify Tools", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["APT29", "Aquatic Panda", "BRONZE BUTLER", "Ember Bear", "FIN6", "Gamaredon Group", "Gorgon Group", "Indrik Spider", "Kimsuky", "Lazarus Group", "Magic Hound", "MuddyWater", "Putter Panda", "Rocke", "TA505", "TeamTNT", "Turla", "Wizard Spider"]}, {"mitre_attack_id": "T1562", "mitre_attack_technique": "Impair Defenses", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": ["Magic Hound"]}, {"mitre_attack_id": "T1105", "mitre_attack_technique": "Ingress Tool Transfer", "mitre_attack_tactics": ["Command And Control"], "mitre_attack_groups": ["APT-C-36", "APT18", "APT28", "APT29", "APT3", "APT32", "APT33", "APT37", "APT38", "APT39", "APT41", "Ajax Security Team", "Andariel", "Aquatic Panda", "BITTER", "BRONZE BUTLER", "BackdoorDiplomacy", "Chimera", "Cobalt Group", "Confucius", "Darkhotel", "Dragonfly", "Elderwood", "Ember Bear", "Evilnum", "FIN7", "FIN8", "Fox Kitten", "GALLIUM", "Gamaredon Group", "Gorgon Group", "HAFNIUM", "HEXANE", "IndigoZebra", "Indrik Spider", "Ke3chang", "Kimsuky", "Lazarus Group", "LazyScripter", "Leviathan", "Magic Hound", "Molerats", "Moses Staff", "MuddyWater", "Mustang Panda", "Nomadic Octopus", "OilRig", "PLATINUM", "Patchwork", "Rancor", "Rocke", "Sandworm Team", "SideCopy", "Sidewinder", "Silence", "TA505", "TA551", "TeamTNT", "Threat Group-3390", "Tonto Team", "Tropic Trooper", "Turla", "Volatile Cedar", "WIRTE", "Whitefly", "Windshift", "Winnti Group", "ZIRCONIUM", "menuPass"]}, {"mitre_attack_id": "T1087", "mitre_attack_technique": "Account Discovery", "mitre_attack_tactics": ["Discovery"], "mitre_attack_groups": ["APT29"]}, {"mitre_attack_id": "T1489", "mitre_attack_technique": "Service Stop", "mitre_attack_tactics": ["Impact"], "mitre_attack_groups": ["Indrik Spider", "Lazarus Group", "Wizard Spider"]}, {"mitre_attack_id": "T1222", "mitre_attack_technique": "File and Directory Permissions Modification", "mitre_attack_tactics": ["Defense Evasion"], "mitre_attack_groups": []}, {"mitre_attack_id": "T1053", "mitre_attack_technique": "Scheduled Task/Job", "mitre_attack_tactics": ["Execution", "Persistence", "Privilege Escalation"], "mitre_attack_groups": ["Earth Lusca"]}, {"mitre_attack_id": "T1543.003", "mitre_attack_technique": "Windows Service", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": ["APT19", "APT3", "APT32", "APT38", "APT41", "Blue Mockingbird", "Carbanak", "Cobalt Group", "DarkVishnya", "Earth Lusca", "FIN7", "Ke3chang", "Kimsuky", "Lazarus Group", "PROMETHIUM", "TeamTNT", "Threat Group-3390", "Tropic Trooper", "Wizard Spider"]}, {"mitre_attack_id": "T1543", "mitre_attack_technique": "Create or Modify System Process", "mitre_attack_tactics": ["Persistence", "Privilege Escalation"], "mitre_attack_groups": []}], "mitre_attack_tactics": ["Command And Control", "Credential Access", "Defense Evasion", "Discovery", "Execution", "Impact", "Persistence", "Privilege Escalation", "Reconnaissance"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives", "Command & Control", "Exploitation", "Installation"]}, "detection_names": ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Deleting Of Net Users - Rule", "ESCU - Disable Windows App Hotkeys - Rule", "ESCU - Disabling Net User Account - Rule", "ESCU - Download Files Using Telegram - Rule", "ESCU - Enumerate Users Local Group Using Telegram - Rule", "ESCU - Excessive Attempt To Disable Services - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Cacls App - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of Taskkill - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Hide User Account From Sign-In Screen - Rule", "ESCU - Icacls Deny Command - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Modify ACL permission To Files Or Folder - Rule", "ESCU - Process Kill Base On File Path - Rule", "ESCU - Schtasks Run Task On Demand - Rule", "ESCU - Suspicious Driver Loaded Path - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - XMRIG Driver Loaded - Rule"], "investigation_names": [], "baseline_names": [], "author_company": "Rod Soto Splunk", "author_name": "Teoderick Contreras", "detections": [{"name": "Attacker Tools On Endpoint", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Match Legitimate Name or Location"}, {"mitre_attack_technique": "Masquerading"}, {"mitre_attack_technique": "OS Credential Dumping"}, {"mitre_attack_technique": "Active Scanning"}]}}, {"name": "Deleting Of Net Users", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Access Removal"}]}}, {"name": "Disable Windows App Hotkeys", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Disabling Net User Account", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Access Removal"}]}}, {"name": "Download Files Using Telegram", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Ingress Tool Transfer"}]}}, {"name": "Enumerate Users Local Group Using Telegram", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Discovery"}]}}, {"name": "Excessive Attempt To Disable Services", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Service Stop"}]}}, {"name": "Excessive Service Stop Attempt", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Service Stop"}]}}, {"name": "Excessive Usage Of Cacls App", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File and Directory Permissions Modification"}]}}, {"name": "Excessive Usage Of Net App", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Account Access Removal"}]}}, {"name": "Excessive Usage Of Taskkill", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Executables Or Script Creation In Suspicious Path", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Masquerading"}]}}, {"name": "Hide User Account From Sign-In Screen", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Icacls Deny Command", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File and Directory Permissions Modification"}]}}, {"name": "ICACLS Grant Command", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File and Directory Permissions Modification"}]}}, {"name": "Modify ACL permission To Files Or Folder", "source": "endpoint", "type": "Anomaly", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "File and Directory Permissions Modification"}]}}, {"name": "Process Kill Base On File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Disable or Modify Tools"}, {"mitre_attack_technique": "Impair Defenses"}]}}, {"name": "Schtasks Run Task On Demand", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Scheduled Task/Job"}]}}, {"name": "Suspicious Driver Loaded Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Service"}, {"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "Suspicious Process File Path", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Create or Modify System Process"}]}}, {"name": "XMRIG Driver Loaded", "source": "endpoint", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Windows Service"}, {"mitre_attack_technique": "Create or Modify System Process"}]}}]}]}