stories.wiki

=Splunk Security Content Analytic Story =

----
All the Analytic Stories shipped to different Splunk products. Below is a breakdown by Category.

==Abuse==


===Brand monitoring===
Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Email Email], [https://docs.splunk.com/Documentation/CIM/latest/User/Web Web]
* '''Last Updated''': 2017-12-19
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Monitor_email_for_brand_abuse|Monitor Email For Brand Abuse]]

|
|
|

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Monitor_web_traffic_for_brand_abuse|Monitor Web Traffic For Brand Abuse]]

|
|
|

| TTP
|}

====Kill Chain Phase====

* Delivery


====Reference====

* https://www.zerofox.com/blog/what-is-digital-risk-monitoring/

* https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/

* https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/


''version'': 1
</div>
</div>

----

===Dns amplification attacks===
DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it responds to `ANY` queries. This Analytic Story can help you detect attackers who may be abusing your company's DNS infrastructure to launch amplification attacks, causing Denial of Service to other victims.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution Network_Resolution]
* '''Last Updated''': 2016-09-13
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Large_volume_of_dns_any_queries|Large Volume of DNS ANY Queries]]

|
[https://attack.mitre.org/techniques/T1498/ T1498], 
[https://attack.mitre.org/techniques/T1498.002/ T1498.002]
|
Network Denial of Service, 
Reflection Amplification
|
Impact, 
Impact

| Anomaly
|}

====Kill Chain Phase====

* Actions on Objectives


====Reference====

* https://www.us-cert.gov/ncas/alerts/TA13-088A

* https://www.imperva.com/learn/application-security/dns-amplification/


''version'': 1
</div>
</div>

----

===Data protection===
Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution Network_Resolution]
* '''Last Updated''': 2017-09-14
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_hosts_connecting_to_dynamic_domain_providers|Detect hosts connecting to dynamic domain providers]]

|
[https://attack.mitre.org/techniques/T1189/ T1189]
|
Drive-by Compromise
|
Initial Access

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Command and Control


====Reference====

* https://www.cisecurity.org/controls/data-protection/

* https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022

* https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/


''version'': 1
</div>
</div>

----

===Netsh abuse===
Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2017-01-05
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Processes_launching_netsh|Processes launching netsh]]

|
[https://attack.mitre.org/techniques/T1562.004/ T1562.004], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify System Firewall, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives


====Reference====

* https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)

* https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html

* http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html


''version'': 1
</div>
</div>

----



==Adversary Tactics==


===Active directory discovery===
Monitor for activities and techniques associated with Discovery and Reconnaissance within with Active Directory environments.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-08-20
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Adsisearcher_account_discovery|AdsiSearcher Account Discovery]]

|
[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
[https://attack.mitre.org/techniques/T1087/ T1087]
|
Domain Account, 
Account Discovery
|
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Dsquery_domain_discovery|DSQuery Domain Discovery]]

|
[https://attack.mitre.org/techniques/T1482/ T1482]
|
Domain Trust Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Domain_account_discovery_with_net_app|Domain Account Discovery With Net App]]

|
[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
[https://attack.mitre.org/techniques/T1087/ T1087]
|
Domain Account, 
Account Discovery
|
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Domain_account_discovery_with_dsquery|Domain Account Discovery with Dsquery]]

|
[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
[https://attack.mitre.org/techniques/T1087/ T1087]
|
Domain Account, 
Account Discovery
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Domain_account_discovery_with_wmic|Domain Account Discovery with Wmic]]

|
[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
[https://attack.mitre.org/techniques/T1087/ T1087]
|
Domain Account, 
Account Discovery
|
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Domain_controller_discovery_with_nltest|Domain Controller Discovery with Nltest]]

|
[https://attack.mitre.org/techniques/T1018/ T1018]
|
Remote System Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Domain_controller_discovery_with_wmic|Domain Controller Discovery with Wmic]]

|
[https://attack.mitre.org/techniques/T1018/ T1018]
|
Remote System Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Domain_group_discovery_with_dsquery|Domain Group Discovery With Dsquery]]

|
[https://attack.mitre.org/techniques/T1069/ T1069], 
[https://attack.mitre.org/techniques/T1069.002/ T1069.002]
|
Permission Groups Discovery, 
Domain Groups
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Domain_group_discovery_with_net|Domain Group Discovery With Net]]

|
[https://attack.mitre.org/techniques/T1069/ T1069], 
[https://attack.mitre.org/techniques/T1069.002/ T1069.002]
|
Permission Groups Discovery, 
Domain Groups
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Domain_group_discovery_with_wmic|Domain Group Discovery With Wmic]]

|
[https://attack.mitre.org/techniques/T1069/ T1069], 
[https://attack.mitre.org/techniques/T1069.002/ T1069.002]
|
Permission Groups Discovery, 
Domain Groups
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Domain_group_discovery_with_adsisearcher|Domain Group Discovery with Adsisearcher]]

|
[https://attack.mitre.org/techniques/T1069/ T1069], 
[https://attack.mitre.org/techniques/T1069.002/ T1069.002]
|
Permission Groups Discovery, 
Domain Groups
|
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Elevated_group_discovery_with_net|Elevated Group Discovery With Net]]

|
[https://attack.mitre.org/techniques/T1069/ T1069], 
[https://attack.mitre.org/techniques/T1069.002/ T1069.002]
|
Permission Groups Discovery, 
Domain Groups
|
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Elevated_group_discovery_with_wmic|Elevated Group Discovery With Wmic]]

|
[https://attack.mitre.org/techniques/T1069/ T1069], 
[https://attack.mitre.org/techniques/T1069.002/ T1069.002]
|
Permission Groups Discovery, 
Domain Groups
|
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Elevated_group_discovery_with_powerview|Elevated Group Discovery with PowerView]]

|
[https://attack.mitre.org/techniques/T1069/ T1069], 
[https://attack.mitre.org/techniques/T1069.002/ T1069.002]
|
Permission Groups Discovery, 
Domain Groups
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Get_addefaultdomainpasswordpolicy_with_powershell|Get ADDefaultDomainPasswordPolicy with Powershell]]

|
[https://attack.mitre.org/techniques/T1201/ T1201]
|
Password Policy Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Get_addefaultdomainpasswordpolicy_with_powershell_script_block|Get ADDefaultDomainPasswordPolicy with Powershell Script Block]]

|
[https://attack.mitre.org/techniques/T1201/ T1201]
|
Password Policy Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Get_aduser_with_powershell|Get ADUser with PowerShell]]

|
[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
[https://attack.mitre.org/techniques/T1087/ T1087]
|
Domain Account, 
Account Discovery
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Get_aduser_with_powershell_script_block|Get ADUser with PowerShell Script Block]]

|
[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
[https://attack.mitre.org/techniques/T1087/ T1087]
|
Domain Account, 
Account Discovery
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Get_aduserresultantpasswordpolicy_with_powershell|Get ADUserResultantPasswordPolicy with Powershell]]

|
[https://attack.mitre.org/techniques/T1201/ T1201]
|
Password Policy Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Get_aduserresultantpasswordpolicy_with_powershell_script_block|Get ADUserResultantPasswordPolicy with Powershell Script Block]]

|
[https://attack.mitre.org/techniques/T1201/ T1201]
|
Password Policy Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Get_domainpolicy_with_powershell|Get DomainPolicy with Powershell]]

|
[https://attack.mitre.org/techniques/T1201/ T1201]
|
Password Policy Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Get_domainpolicy_with_powershell_script_block|Get DomainPolicy with Powershell Script Block]]

|
[https://attack.mitre.org/techniques/T1201/ T1201]
|
Password Policy Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Get_domainuser_with_powershell|Get DomainUser with PowerShell]]

|
[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
[https://attack.mitre.org/techniques/T1087/ T1087]
|
Domain Account, 
Account Discovery
|
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Get_domainuser_with_powershell_script_block|Get DomainUser with PowerShell Script Block]]

|
[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
[https://attack.mitre.org/techniques/T1087/ T1087]
|
Domain Account, 
Account Discovery
|
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Get_wmiobject_group_discovery|Get WMIObject Group Discovery]]

|
[https://attack.mitre.org/techniques/T1069/ T1069], 
[https://attack.mitre.org/techniques/T1069.001/ T1069.001]
|
Permission Groups Discovery, 
Local Groups
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Get_wmiobject_group_discovery_with_script_block_logging|Get WMIObject Group Discovery with Script Block Logging]]

|
[https://attack.mitre.org/techniques/T1069/ T1069], 
[https://attack.mitre.org/techniques/T1069.001/ T1069.001]
|
Permission Groups Discovery, 
Local Groups
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Get-domaintrust_with_powershell|Get-DomainTrust with PowerShell]]

|
[https://attack.mitre.org/techniques/T1482/ T1482]
|
Domain Trust Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Get-domaintrust_with_powershell_script_block|Get-DomainTrust with PowerShell Script Block]]

|
[https://attack.mitre.org/techniques/T1482/ T1482]
|
Domain Trust Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Get-foresttrust_with_powershell|Get-ForestTrust with PowerShell]]

|
[https://attack.mitre.org/techniques/T1482/ T1482]
|
Domain Trust Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Get-foresttrust_with_powershell_script_block|Get-ForestTrust with PowerShell Script Block]]

|
[https://attack.mitre.org/techniques/T1482/ T1482]
|
Domain Trust Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Getadcomputer_with_powershell|GetAdComputer with PowerShell]]

|
[https://attack.mitre.org/techniques/T1018/ T1018]
|
Remote System Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Getadcomputer_with_powershell_script_block|GetAdComputer with PowerShell Script Block]]

|
[https://attack.mitre.org/techniques/T1018/ T1018]
|
Remote System Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Getadgroup_with_powershell|GetAdGroup with PowerShell]]

|
[https://attack.mitre.org/techniques/T1069/ T1069], 
[https://attack.mitre.org/techniques/T1069.002/ T1069.002]
|
Permission Groups Discovery, 
Domain Groups
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Getadgroup_with_powershell_script_block|GetAdGroup with PowerShell Script Block]]

|
[https://attack.mitre.org/techniques/T1069/ T1069], 
[https://attack.mitre.org/techniques/T1069.002/ T1069.002]
|
Permission Groups Discovery, 
Domain Groups
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Getcurrent_user_with_powershell|GetCurrent User with PowerShell]]

|
[https://attack.mitre.org/techniques/T1033/ T1033]
|
System Owner/User Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Getcurrent_user_with_powershell_script_block|GetCurrent User with PowerShell Script Block]]

|
[https://attack.mitre.org/techniques/T1033/ T1033]
|
System Owner/User Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Getdomaincomputer_with_powershell|GetDomainComputer with PowerShell]]

|
[https://attack.mitre.org/techniques/T1018/ T1018]
|
Remote System Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Getdomaincomputer_with_powershell_script_block|GetDomainComputer with PowerShell Script Block]]

|
[https://attack.mitre.org/techniques/T1018/ T1018]
|
Remote System Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Getdomaincontroller_with_powershell|GetDomainController with PowerShell]]

|
[https://attack.mitre.org/techniques/T1018/ T1018]
|
Remote System Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Getdomaincontroller_with_powershell_script_block|GetDomainController with PowerShell Script Block]]

|
[https://attack.mitre.org/techniques/T1018/ T1018]
|
Remote System Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Getdomaingroup_with_powershell|GetDomainGroup with PowerShell]]

|
[https://attack.mitre.org/techniques/T1069/ T1069], 
[https://attack.mitre.org/techniques/T1069.002/ T1069.002]
|
Permission Groups Discovery, 
Domain Groups
|
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Getdomaingroup_with_powershell_script_block|GetDomainGroup with PowerShell Script Block]]

|
[https://attack.mitre.org/techniques/T1069/ T1069], 
[https://attack.mitre.org/techniques/T1069.002/ T1069.002]
|
Permission Groups Discovery, 
Domain Groups
|
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Getlocaluser_with_powershell|GetLocalUser with PowerShell]]

|
[https://attack.mitre.org/techniques/T1087/ T1087], 
[https://attack.mitre.org/techniques/T1087.001/ T1087.001]
|
Account Discovery, 
Local Account
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Getlocaluser_with_powershell_script_block|GetLocalUser with PowerShell Script Block]]

|
[https://attack.mitre.org/techniques/T1087/ T1087], 
[https://attack.mitre.org/techniques/T1087.001/ T1087.001]
|
Account Discovery, 
Local Account
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Getnettcpconnection_with_powershell|GetNetTcpconnection with PowerShell]]

|
[https://attack.mitre.org/techniques/T1049/ T1049]
|
System Network Connections Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Getnettcpconnection_with_powershell_script_block|GetNetTcpconnection with PowerShell Script Block]]

|
[https://attack.mitre.org/techniques/T1049/ T1049]
|
System Network Connections Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Getwmiobject_ds_user_with_powershell|GetWmiObject DS User with PowerShell]]

|
[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
[https://attack.mitre.org/techniques/T1087/ T1087]
|
Domain Account, 
Account Discovery
|
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Getwmiobject_ds_user_with_powershell_script_block|GetWmiObject DS User with PowerShell Script Block]]

|
[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
[https://attack.mitre.org/techniques/T1087/ T1087]
|
Domain Account, 
Account Discovery
|
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Getwmiobject_ds_computer_with_powershell|GetWmiObject Ds Computer with PowerShell]]

|
[https://attack.mitre.org/techniques/T1018/ T1018]
|
Remote System Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Getwmiobject_ds_computer_with_powershell_script_block|GetWmiObject Ds Computer with PowerShell Script Block]]

|
[https://attack.mitre.org/techniques/T1018/ T1018]
|
Remote System Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Getwmiobject_ds_group_with_powershell|GetWmiObject Ds Group with PowerShell]]

|
[https://attack.mitre.org/techniques/T1069/ T1069], 
[https://attack.mitre.org/techniques/T1069.002/ T1069.002]
|
Permission Groups Discovery, 
Domain Groups
|
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Getwmiobject_ds_group_with_powershell_script_block|GetWmiObject Ds Group with PowerShell Script Block]]

|
[https://attack.mitre.org/techniques/T1069/ T1069], 
[https://attack.mitre.org/techniques/T1069.002/ T1069.002]
|
Permission Groups Discovery, 
Domain Groups
|
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Getwmiobject_user_account_with_powershell|GetWmiObject User Account with PowerShell]]

|
[https://attack.mitre.org/techniques/T1087/ T1087], 
[https://attack.mitre.org/techniques/T1087.001/ T1087.001]
|
Account Discovery, 
Local Account
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Getwmiobject_user_account_with_powershell_script_block|GetWmiObject User Account with PowerShell Script Block]]

|
[https://attack.mitre.org/techniques/T1087/ T1087], 
[https://attack.mitre.org/techniques/T1087.001/ T1087.001]
|
Account Discovery, 
Local Account
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Local_account_discovery_with_wmic|Local Account Discovery With Wmic]]

|
[https://attack.mitre.org/techniques/T1087/ T1087], 
[https://attack.mitre.org/techniques/T1087.001/ T1087.001]
|
Account Discovery, 
Local Account
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Local_account_discovery_with_net|Local Account Discovery with Net]]

|
[https://attack.mitre.org/techniques/T1087/ T1087], 
[https://attack.mitre.org/techniques/T1087.001/ T1087.001]
|
Account Discovery, 
Local Account
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Nltest_domain_trust_discovery|NLTest Domain Trust Discovery]]

|
[https://attack.mitre.org/techniques/T1482/ T1482]
|
Domain Trust Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Net_localgroup_discovery|Net Localgroup Discovery]]

|
[https://attack.mitre.org/techniques/T1069/ T1069], 
[https://attack.mitre.org/techniques/T1069.001/ T1069.001]
|
Permission Groups Discovery, 
Local Groups
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Network_connection_discovery_with_arp|Network Connection Discovery With Arp]]

|
[https://attack.mitre.org/techniques/T1049/ T1049]
|
System Network Connections Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Network_connection_discovery_with_net|Network Connection Discovery With Net]]

|
[https://attack.mitre.org/techniques/T1049/ T1049]
|
System Network Connections Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Network_connection_discovery_with_netstat|Network Connection Discovery With Netstat]]

|
[https://attack.mitre.org/techniques/T1049/ T1049]
|
System Network Connections Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Password_policy_discovery_with_net|Password Policy Discovery with Net]]

|
[https://attack.mitre.org/techniques/T1201/ T1201]
|
Password Policy Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Powershell_get_localgroup_discovery|PowerShell Get LocalGroup Discovery]]

|
[https://attack.mitre.org/techniques/T1069/ T1069], 
[https://attack.mitre.org/techniques/T1069.001/ T1069.001]
|
Permission Groups Discovery, 
Local Groups
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Powershell_get_localgroup_discovery_with_script_block_logging|Powershell Get LocalGroup Discovery with Script Block Logging]]

|
[https://attack.mitre.org/techniques/T1069/ T1069], 
[https://attack.mitre.org/techniques/T1069.001/ T1069.001]
|
Permission Groups Discovery, 
Local Groups
|
Discovery, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Remote_system_discovery_with_adsisearcher|Remote System Discovery with Adsisearcher]]

|
[https://attack.mitre.org/techniques/T1018/ T1018]
|
Remote System Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Remote_system_discovery_with_dsquery|Remote System Discovery with Dsquery]]

|
[https://attack.mitre.org/techniques/T1018/ T1018]
|
Remote System Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Remote_system_discovery_with_net|Remote System Discovery with Net]]

|
[https://attack.mitre.org/techniques/T1018/ T1018]
|
Remote System Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Remote_system_discovery_with_wmic|Remote System Discovery with Wmic]]

|
[https://attack.mitre.org/techniques/T1018/ T1018]
|
Remote System Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Serviceprincipalnames_discovery_with_powershell|ServicePrincipalNames Discovery with PowerShell]]

|
[https://attack.mitre.org/techniques/T1558.003/ T1558.003]
|
Kerberoasting
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Serviceprincipalnames_discovery_with_setspn|ServicePrincipalNames Discovery with SetSPN]]

|
[https://attack.mitre.org/techniques/T1558.003/ T1558.003]
|
Kerberoasting
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#System_user_discovery_with_query|System User Discovery With Query]]

|
[https://attack.mitre.org/techniques/T1033/ T1033]
|
System Owner/User Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#System_user_discovery_with_whoami|System User Discovery With Whoami]]

|
[https://attack.mitre.org/techniques/T1033/ T1033]
|
System Owner/User Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#User_discovery_with_env_vars_powershell|User Discovery With Env Vars PowerShell]]

|
[https://attack.mitre.org/techniques/T1033/ T1033]
|
System Owner/User Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#User_discovery_with_env_vars_powershell_script_block|User Discovery With Env Vars PowerShell Script Block]]

|
[https://attack.mitre.org/techniques/T1033/ T1033]
|
System Owner/User Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Wmic_group_discovery|Wmic Group Discovery]]

|
[https://attack.mitre.org/techniques/T1069/ T1069], 
[https://attack.mitre.org/techniques/T1069.001/ T1069.001]
|
Permission Groups Discovery, 
Local Groups
|
Discovery, 
Discovery

| Hunting
|}

====Kill Chain Phase====

* Exploitation

* Lateral Movement

* Reconnaissance


====Reference====

* https://attack.mitre.org/tactics/TA0007/

* https://adsecurity.org/?p=2535

* https://attack.mitre.org/techniques/T1087/001/

* https://attack.mitre.org/techniques/T1087/002/

* https://attack.mitre.org/techniques/T1087/003/

* https://attack.mitre.org/techniques/T1482/

* https://attack.mitre.org/techniques/T1201/

* https://attack.mitre.org/techniques/T1069/001/

* https://attack.mitre.org/techniques/T1069/002/

* https://attack.mitre.org/techniques/T1018/

* https://attack.mitre.org/techniques/T1049/

* https://attack.mitre.org/techniques/T1033/


''version'': 1
</div>
</div>

----

===Active directory password spraying===
Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-04-07
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos|Multiple Disabled Users Failing To Authenticate From Host Using Kerberos]]

|
[https://attack.mitre.org/techniques/T1110.003/ T1110.003], 
[https://attack.mitre.org/techniques/T1110/ T1110]
|
Password Spraying, 
Brute Force
|
Credential Access, 
Credential Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos|Multiple Invalid Users Failing To Authenticate From Host Using Kerberos]]

|
[https://attack.mitre.org/techniques/T1110.003/ T1110.003], 
[https://attack.mitre.org/techniques/T1110/ T1110]
|
Password Spraying, 
Brute Force
|
Credential Access, 
Credential Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm|Multiple Invalid Users Failing To Authenticate From Host Using NTLM]]

|
[https://attack.mitre.org/techniques/T1110.003/ T1110.003], 
[https://attack.mitre.org/techniques/T1110/ T1110]
|
Password Spraying, 
Brute Force
|
Credential Access, 
Credential Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Multiple_users_attempting_to_authenticate_using_explicit_credentials|Multiple Users Attempting To Authenticate Using Explicit Credentials]]

|
[https://attack.mitre.org/techniques/T1110.003/ T1110.003], 
[https://attack.mitre.org/techniques/T1110/ T1110]
|
Password Spraying, 
Brute Force
|
Credential Access, 
Credential Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Multiple_users_failing_to_authenticate_from_host_using_kerberos|Multiple Users Failing To Authenticate From Host Using Kerberos]]

|
[https://attack.mitre.org/techniques/T1110.003/ T1110.003], 
[https://attack.mitre.org/techniques/T1110/ T1110]
|
Password Spraying, 
Brute Force
|
Credential Access, 
Credential Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Multiple_users_failing_to_authenticate_from_host_using_ntlm|Multiple Users Failing To Authenticate From Host Using NTLM]]

|
[https://attack.mitre.org/techniques/T1110.003/ T1110.003], 
[https://attack.mitre.org/techniques/T1110/ T1110]
|
Password Spraying, 
Brute Force
|
Credential Access, 
Credential Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Multiple_users_failing_to_authenticate_from_process|Multiple Users Failing To Authenticate From Process]]

|
[https://attack.mitre.org/techniques/T1110.003/ T1110.003], 
[https://attack.mitre.org/techniques/T1110/ T1110]
|
Password Spraying, 
Brute Force
|
Credential Access, 
Credential Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Multiple_users_remotely_failing_to_authenticate_from_host|Multiple Users Remotely Failing To Authenticate From Host]]

|
[https://attack.mitre.org/techniques/T1110.003/ T1110.003], 
[https://attack.mitre.org/techniques/T1110/ T1110]
|
Password Spraying, 
Brute Force
|
Credential Access, 
Credential Access

| Anomaly
|}

====Kill Chain Phase====

* Exploitation


====Reference====

* https://attack.mitre.org/techniques/T1110/003/

* https://www.microsoft.com/security/blog/2020/04/23/protecting-organization-password-spray-attacks/

* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn452415(v=ws.11)


''version'': 1
</div>
</div>

----

===Bits jobs===
Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-03-26
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Bits_job_persistence|BITS Job Persistence]]

|
[https://attack.mitre.org/techniques/T1197/ T1197]
|
BITS Jobs
|
Defense Evasion, Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Bitsadmin_download_file|BITSAdmin Download File]]

|
[https://attack.mitre.org/techniques/T1197/ T1197], 
[https://attack.mitre.org/techniques/T1105/ T1105]
|
BITS Jobs, 
Ingress Tool Transfer
|
Defense Evasion, Persistence, 
Command And Control

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Powershell_start-bitstransfer|PowerShell Start-BitsTransfer]]

|
[https://attack.mitre.org/techniques/T1197/ T1197]
|
BITS Jobs
|
Defense Evasion, Persistence

| TTP
|}

====Kill Chain Phase====

* Exploitation


====Reference====

* https://attack.mitre.org/techniques/T1197/

* https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool


''version'': 1
</div>
</div>

----

===Baron samedit cve-2021-3156===
Uncover activity consistent with CVE-2021-3156. Discovered by the Qualys Research Team, this vulnerability has been found to affect sudo across multiple Linux distributions (Ubuntu 20.04 and prior, Debian 10 and prior, Fedora 33 and prior). As this vulnerability was committed to code in July 2011, there will be many distributions affected. Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2021-01-27
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_baron_samedit_cve-2021-3156|Detect Baron Samedit CVE-2021-3156]]

|
[https://attack.mitre.org/techniques/T1068/ T1068]
|
Exploitation for Privilege Escalation
|
Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_baron_samedit_cve-2021-3156_segfault|Detect Baron Samedit CVE-2021-3156 Segfault]]

|
[https://attack.mitre.org/techniques/T1068/ T1068]
|
Exploitation for Privilege Escalation
|
Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_baron_samedit_cve-2021-3156_via_osquery|Detect Baron Samedit CVE-2021-3156 via OSQuery]]

|
[https://attack.mitre.org/techniques/T1068/ T1068]
|
Exploitation for Privilege Escalation
|
Privilege Escalation

| TTP
|}

====Kill Chain Phase====

* Exploitation


====Reference====

* https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit


''version'': 1
</div>
</div>

----

===Cobalt strike===
Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-02-16
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Anomalous_usage_of_7zip|Anomalous usage of 7zip]]

|
[https://attack.mitre.org/techniques/T1560.001/ T1560.001], 
[https://attack.mitre.org/techniques/T1560/ T1560]
|
Archive via Utility, 
Archive Collected Data
|
Collection, 
Collection

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Cmd_echo_pipe_-_escalation|CMD Echo Pipe - Escalation]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.003/ T1059.003], 
[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
[https://attack.mitre.org/techniques/T1543/ T1543]
|
Command and Scripting Interpreter, 
Windows Command Shell, 
Windows Service, 
Create or Modify System Process
|
Execution, 
Execution, 
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Cobalt_strike_named_pipes|Cobalt Strike Named Pipes]]

|
[https://attack.mitre.org/techniques/T1055/ T1055]
|
Process Injection
|
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Dllhost_with_no_command_line_arguments_with_network|DLLHost with no Command Line Arguments with Network]]

|
[https://attack.mitre.org/techniques/T1055/ T1055]
|
Process Injection
|
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_regsvr32_application_control_bypass|Detect Regsvr32 Application Control Bypass]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.010/ T1218.010]
|
Signed Binary Proxy Execution, 
Regsvr32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Gpupdate_with_no_command_line_arguments_with_network|GPUpdate with no Command Line Arguments with Network]]

|
[https://attack.mitre.org/techniques/T1055/ T1055]
|
Process Injection
|
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Rundll32_with_no_command_line_arguments_with_network|Rundll32 with no Command Line Arguments with Network]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Searchprotocolhost_with_no_command_line_with_network|SearchProtocolHost with no Command Line with Network]]

|
[https://attack.mitre.org/techniques/T1055/ T1055]
|
Process Injection
|
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Services_escalate_exe|Services Escalate Exe]]

|
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Abuse Elevation Control Mechanism
|
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_dllhost_no_command_line_arguments|Suspicious DLLHost no Command Line Arguments]]

|
[https://attack.mitre.org/techniques/T1055/ T1055]
|
Process Injection
|
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_gpupdate_no_command_line_arguments|Suspicious GPUpdate no Command Line Arguments]]

|
[https://attack.mitre.org/techniques/T1055/ T1055]
|
Process Injection
|
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_rename|Suspicious MSBuild Rename]]

|
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1127/ T1127], 
[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
[https://attack.mitre.org/techniques/T1127.001/ T1127.001]
|
Masquerading, 
Trusted Developer Utilities Proxy Execution, 
Rename System Utilities, 
MSBuild
|
Defense Evasion, 
Defense Evasion, 
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_startw|Suspicious Rundll32 StartW]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_no_command_line_arguments|Suspicious Rundll32 no Command Line Arguments]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_searchprotocolhost_no_command_line_arguments|Suspicious SearchProtocolHost no Command Line Arguments]]

|
[https://attack.mitre.org/techniques/T1055/ T1055]
|
Process Injection
|
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_microsoft_workflow_compiler_rename|Suspicious microsoft workflow compiler rename]]

|
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1127/ T1127], 
[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
|
Masquerading, 
Trusted Developer Utilities Proxy Execution, 
Rename System Utilities
|
Defense Evasion, 
Defense Evasion, 
Defense Evasion

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_path|Suspicious msbuild path]]

|
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1127/ T1127], 
[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
[https://attack.mitre.org/techniques/T1127.001/ T1127.001]
|
Masquerading, 
Trusted Developer Utilities Proxy Execution, 
Rename System Utilities, 
MSBuild
|
Defense Evasion, 
Defense Evasion, 
Defense Evasion, 
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Actions on Objective

* Actions on Objectives

* Exploitation

* Privilege Escalation


====Reference====

* https://www.cobaltstrike.com/

* https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/

* https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/

* https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html

* https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html

* https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence

* https://github.com/zer0yu/Awesome-CobaltStrike


''version'': 1
</div>
</div>

----

===Collection and staging===
Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. 

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint], [https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic Network_Traffic]
* '''Last Updated''': 2020-02-03
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_renamed_7-zip|Detect Renamed 7-Zip]]

|
[https://attack.mitre.org/techniques/T1560.001/ T1560.001], 
[https://attack.mitre.org/techniques/T1560/ T1560]
|
Archive via Utility, 
Archive Collected Data
|
Collection, 
Collection

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Detect_renamed_winrar|Detect Renamed WinRAR]]

|
[https://attack.mitre.org/techniques/T1560.001/ T1560.001], 
[https://attack.mitre.org/techniques/T1560/ T1560]
|
Archive via Utility, 
Archive Collected Data
|
Collection, 
Collection

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Email_files_written_outside_of_the_outlook_directory|Email files written outside of the Outlook directory]]

|
[https://attack.mitre.org/techniques/T1114/ T1114], 
[https://attack.mitre.org/techniques/T1114.001/ T1114.001]
|
Email Collection, 
Local Email Collection
|
Collection, 
Collection

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Email_servers_sending_high_volume_traffic_to_hosts|Email servers sending high volume traffic to hosts]]

|
[https://attack.mitre.org/techniques/T1114/ T1114], 
[https://attack.mitre.org/techniques/T1114.002/ T1114.002]
|
Email Collection, 
Remote Email Collection
|
Collection, 
Collection

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Hosts_receiving_high_volume_of_network_traffic_from_email_server|Hosts receiving high volume of network traffic from email server]]

|
[https://attack.mitre.org/techniques/T1114.002/ T1114.002], 
[https://attack.mitre.org/techniques/T1114/ T1114]
|
Remote Email Collection, 
Email Collection
|
Collection, 
Collection

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_writes_to_windows_recycle_bin|Suspicious writes to windows Recycle Bin]]

|
[https://attack.mitre.org/techniques/T1036/ T1036]
|
Masquerading
|
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exfiltration

* Exploitation


====Reference====

* https://attack.mitre.org/wiki/Collection

* https://attack.mitre.org/wiki/Technique/T1074


''version'': 1
</div>
</div>

----

===Command and control===
Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint], [https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution Network_Resolution], [https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic Network_Traffic]
* '''Last Updated''': 2018-06-01
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Dns_exfiltration_using_nslookup_app|DNS Exfiltration Using Nslookup App]]

|
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Alternative Protocol
|
Exfiltration

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Dns_query_length_outliers_-_mltk|DNS Query Length Outliers - MLTK]]

|
[https://attack.mitre.org/techniques/T1071.004/ T1071.004], 
[https://attack.mitre.org/techniques/T1071/ T1071]
|
DNS, 
Application Layer Protocol
|
Command And Control, 
Command And Control

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Dns_query_length_with_high_standard_deviation|DNS Query Length With High Standard Deviation]]

|
[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
Exfiltration Over Alternative Protocol
|
Exfiltration, 
Exfiltration

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Detect_large_outbound_icmp_packets|Detect Large Outbound ICMP Packets]]

|
[https://attack.mitre.org/techniques/T1095/ T1095]
|
Non-Application Layer Protocol
|
Command And Control

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_spike_in_blocked_outbound_traffic_from_your_aws|Detect Spike in blocked Outbound Traffic from your AWS]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Detect_hosts_connecting_to_dynamic_domain_providers|Detect hosts connecting to dynamic domain providers]]

|
[https://attack.mitre.org/techniques/T1189/ T1189]
|
Drive-by Compromise
|
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Excessive_dns_failures|Excessive DNS Failures]]

|
[https://attack.mitre.org/techniques/T1071.004/ T1071.004], 
[https://attack.mitre.org/techniques/T1071/ T1071]
|
DNS, 
Application Layer Protocol
|
Command And Control, 
Command And Control

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_nslookup_app|Excessive Usage of NSLOOKUP App]]

|
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Alternative Protocol
|
Exfiltration

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Multiple_archive_files_http_post_traffic|Multiple Archive Files Http Post Traffic]]

|
[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
Exfiltration Over Alternative Protocol
|
Exfiltration, 
Exfiltration

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Plain_http_post_exfiltrated_data|Plain HTTP POST Exfiltrated Data]]

|
[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
Exfiltration Over Alternative Protocol
|
Exfiltration, 
Exfiltration

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Prohibited_network_traffic_allowed|Prohibited Network Traffic Allowed]]

|
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Alternative Protocol
|
Exfiltration

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Protocol_or_port_mismatch|Protocol or Port Mismatch]]

|
[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
Exfiltration Over Alternative Protocol
|
Exfiltration, 
Exfiltration

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Tor_traffic|TOR Traffic]]

|
[https://attack.mitre.org/techniques/T1071/ T1071], 
[https://attack.mitre.org/techniques/T1071.001/ T1071.001]
|
Application Layer Protocol, 
Web Protocols
|
Command And Control, 
Command And Control

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Command and Control

* Delivery

* Exfiltration

* Exploitation


====Reference====

* https://attack.mitre.org/wiki/Command_and_Control

* https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware


''version'': 1
</div>
</div>

----

===Credential dumping===
Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2020-02-04
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Access_lsass_memory_for_dump_creation|Access LSASS Memory for Dump Creation]]

|
[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
LSASS Memory, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Applying_stolen_credentials_via_mimikatz_modules|Applying Stolen Credentials via Mimikatz modules]]

|
[https://attack.mitre.org/techniques/T1055/ T1055], 
[https://attack.mitre.org/techniques/T1068/ T1068], 
[https://attack.mitre.org/techniques/T1078/ T1078], 
[https://attack.mitre.org/techniques/T1098/ T1098], 
[https://attack.mitre.org/techniques/T1134/ T1134], 
[https://attack.mitre.org/techniques/T1543/ T1543], 
[https://attack.mitre.org/techniques/T1547/ T1547], 
[https://attack.mitre.org/techniques/T1548/ T1548], 
[https://attack.mitre.org/techniques/T1554/ T1554], 
[https://attack.mitre.org/techniques/T1556/ T1556], 
[https://attack.mitre.org/techniques/T1558/ T1558]
|
Process Injection, 
Exploitation for Privilege Escalation, 
Valid Accounts, 
Account Manipulation, 
Access Token Manipulation, 
Create or Modify System Process, 
Boot or Logon Autostart Execution, 
Abuse Elevation Control Mechanism, 
Compromise Client Software Binary, 
Modify Authentication Process, 
Steal or Forge Kerberos Tickets
|
Defense Evasion, Privilege Escalation, 
Privilege Escalation, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Persistence, 
Defense Evasion, Privilege Escalation, 
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation, 
Privilege Escalation, Defense Evasion, 
Persistence, 
Credential Access, Defense Evasion, Persistence, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Applying_stolen_credentials_via_powersploit_modules|Applying Stolen Credentials via PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1055/ T1055], 
[https://attack.mitre.org/techniques/T1068/ T1068], 
[https://attack.mitre.org/techniques/T1078/ T1078], 
[https://attack.mitre.org/techniques/T1098/ T1098], 
[https://attack.mitre.org/techniques/T1134/ T1134], 
[https://attack.mitre.org/techniques/T1543/ T1543], 
[https://attack.mitre.org/techniques/T1547/ T1547], 
[https://attack.mitre.org/techniques/T1548/ T1548], 
[https://attack.mitre.org/techniques/T1554/ T1554], 
[https://attack.mitre.org/techniques/T1555/ T1555], 
[https://attack.mitre.org/techniques/T1558/ T1558]
|
Process Injection, 
Exploitation for Privilege Escalation, 
Valid Accounts, 
Account Manipulation, 
Access Token Manipulation, 
Create or Modify System Process, 
Boot or Logon Autostart Execution, 
Abuse Elevation Control Mechanism, 
Compromise Client Software Binary, 
Credentials from Password Stores, 
Steal or Forge Kerberos Tickets
|
Defense Evasion, Privilege Escalation, 
Privilege Escalation, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Persistence, 
Defense Evasion, Privilege Escalation, 
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation, 
Privilege Escalation, Defense Evasion, 
Persistence, 
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Assessment_of_credential_strength_via_dsinternals_modules|Assessment of Credential Strength via DSInternals modules]]

|
[https://attack.mitre.org/techniques/T1078/ T1078], 
[https://attack.mitre.org/techniques/T1098/ T1098], 
[https://attack.mitre.org/techniques/T1087/ T1087], 
[https://attack.mitre.org/techniques/T1201/ T1201], 
[https://attack.mitre.org/techniques/T1552/ T1552], 
[https://attack.mitre.org/techniques/T1555/ T1555]
|
Valid Accounts, 
Account Manipulation, 
Account Discovery, 
Password Policy Discovery, 
Unsecured Credentials, 
Credentials from Password Stores
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Persistence, 
Discovery, 
Discovery, 
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Attempted_credential_dump_from_registry_via_reg_exe|Attempted Credential Dump From Registry via Reg exe]]

|
[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
Security Account Manager, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Attempted_credential_dump_from_registry_via_reg_exe|Attempted Credential Dump From Registry via Reg exe]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Create_remote_thread_into_lsass|Create Remote Thread into LSASS]]

|
[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
LSASS Memory, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Creation_of_shadow_copy|Creation of Shadow Copy]]

|
[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
NTDS, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Creation_of_shadow_copy_with_wmic_and_powershell|Creation of Shadow Copy with wmic and powershell]]

|
[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
NTDS, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Creation_of_lsass_dump_with_taskmgr|Creation of lsass Dump with Taskmgr]]

|
[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
LSASS Memory, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_dumping_via_copy_command_from_shadow_copy|Credential Dumping via Copy Command from Shadow Copy]]

|
[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
NTDS, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_dumping_via_symlink_to_shadow_copy|Credential Dumping via Symlink to Shadow Copy]]

|
[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
NTDS, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option|Credential Extraction indicative of FGDump and CacheDump with s option]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option|Credential Extraction indicative of FGDump and CacheDump with v option]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_lazagne_command_line_options|Credential Extraction indicative of Lazagne command line options]]

|
[https://attack.mitre.org/techniques/T1003/ T1003], 
[https://attack.mitre.org/techniques/T1555/ T1555]
|
OS Credential Dumping, 
Credentials from Password Stores
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules|Credential Extraction indicative of use of DSInternals credential conversion modules]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_use_of_dsinternals_modules|Credential Extraction indicative of use of DSInternals modules]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_use_of_mimikatz_modules|Credential Extraction indicative of use of Mimikatz modules]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_use_of_powersploit_modules|Credential Extraction indicative of use of PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_extraction_native_microsoft_debuggers_peek_into_the_kernel|Credential Extraction native Microsoft debuggers peek into the kernel]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_extraction_native_microsoft_debuggers_via_z_command_line_option|Credential Extraction native Microsoft debuggers via z command line option]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals|Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_copy_of_shadowcopy_with_script_block_logging|Detect Copy of ShadowCopy with Script Block Logging]]

|
[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
Security Account Manager, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_credential_dumping_through_lsass_access|Detect Credential Dumping through LSASS access]]

|
[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
LSASS Memory, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_dump_lsass_memory_using_comsvcs|Detect Dump LSASS Memory using comsvcs]]

|
[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
NTDS, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_kerberoasting|Detect Kerberoasting]]

|
[https://attack.mitre.org/techniques/T1558.003/ T1558.003], 
[https://attack.mitre.org/techniques/T1558/ T1558]
|
Kerberoasting, 
Steal or Forge Kerberos Tickets
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_mimikatz_using_loaded_images|Detect Mimikatz Using Loaded Images]]

|
[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
LSASS Memory, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_comsvcs_dll|Dump LSASS via comsvcs DLL]]

|
[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
LSASS Memory, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_procdump|Dump LSASS via procdump]]

|
[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
LSASS Memory, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Enable_wdigest_uselogoncredential_registry|Enable WDigest UseLogonCredential Registry]]

|
[https://attack.mitre.org/techniques/T1112/ T1112], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
Modify Registry, 
OS Credential Dumping
|
Defense Evasion, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Esentutl_sam_copy|Esentutl SAM Copy]]

|
[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
Security Account Manager, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Extraction_of_registry_hives|Extraction of Registry Hives]]

|
[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
Security Account Manager, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Ntdsutil_export_ntds|Ntdsutil Export NTDS]]

|
[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
NTDS, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Sam_database_file_access_attempt|SAM Database File Access Attempt]]

|
[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
Security Account Manager, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Secretdumps_offline_ntds_dumping_tool|SecretDumps Offline NTDS Dumping Tool]]

|
[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
NTDS, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Set_default_powershell_execution_policy_to_unrestricted_or_bypass|Set Default PowerShell Execution Policy To Unrestricted or Bypass]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
PowerShell
|
Execution, 
Execution

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation

* Installation

* Lateral Movement

* Privilege Escalation


====Reference====

* https://attack.mitre.org/wiki/Technique/T1003

* https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html


''version'': 3
</div>
</div>

----

===Dns hijacking===
Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution Network_Resolution]
* '''Last Updated''': 2020-02-04
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_hosts_connecting_to_dynamic_domain_providers|Detect hosts connecting to dynamic domain providers]]

|
[https://attack.mitre.org/techniques/T1189/ T1189]
|
Drive-by Compromise
|
Initial Access

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Command and Control


====Reference====

* https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html

* https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/

* http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/

* https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html


''version'': 1
</div>
</div>

----

===Data exfiltration===
The stealing of data by an adversary.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint], [https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic Network_Traffic]
* '''Last Updated''': 2020-10-21
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Dns_exfiltration_using_nslookup_app|DNS Exfiltration Using Nslookup App]]

|
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Alternative Protocol
|
Exfiltration

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_snicat_sni_exfiltration|Detect SNICat SNI Exfiltration]]

|
[https://attack.mitre.org/techniques/T1041/ T1041]
|
Exfiltration Over C2 Channel
|
Exfiltration

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_shared_ec2_snapshot|Detect shared ec2 snapshot]]

|
[https://attack.mitre.org/techniques/T1537/ T1537]
|
Transfer Data to Cloud Account
|
Exfiltration

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_nslookup_app|Excessive Usage of NSLOOKUP App]]

|
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Alternative Protocol
|
Exfiltration

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Mailsniper_invoke_functions|Mailsniper Invoke functions]]

|
[https://attack.mitre.org/techniques/T1114/ T1114], 
[https://attack.mitre.org/techniques/T1114.001/ T1114.001]
|
Email Collection, 
Local Email Collection
|
Collection, 
Collection

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Multiple_archive_files_http_post_traffic|Multiple Archive Files Http Post Traffic]]

|
[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
Exfiltration Over Alternative Protocol
|
Exfiltration, 
Exfiltration

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#O365_pst_export_alert|O365 PST export alert]]

|
[https://attack.mitre.org/techniques/T1114/ T1114]
|
Email Collection
|
Collection

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#O365_suspicious_admin_email_forwarding|O365 Suspicious Admin Email Forwarding]]

|
[https://attack.mitre.org/techniques/T1114.003/ T1114.003], 
[https://attack.mitre.org/techniques/T1114/ T1114]
|
Email Forwarding Rule, 
Email Collection
|
Collection, 
Collection

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#O365_suspicious_user_email_forwarding|O365 Suspicious User Email Forwarding]]

|
[https://attack.mitre.org/techniques/T1114.003/ T1114.003], 
[https://attack.mitre.org/techniques/T1114/ T1114]
|
Email Forwarding Rule, 
Email Collection
|
Collection, 
Collection

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Plain_http_post_exfiltrated_data|Plain HTTP POST Exfiltrated Data]]

|
[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
Exfiltration Over Alternative Protocol
|
Exfiltration, 
Exfiltration

| TTP
|}

====Kill Chain Phase====

* Actions on Objective

* Actions on Objectives

* Exfiltration

* Exploitation


====Reference====

* https://attack.mitre.org/tactics/TA0010/


''version'': 1
</div>
</div>

----

===Deobfuscate-decode files or information===
Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-03-24
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Certutil_with_decode_argument|CertUtil With Decode Argument]]

|
[https://attack.mitre.org/techniques/T1140/ T1140]
|
Deobfuscate/Decode Files or Information
|
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Exploitation


====Reference====

* https://attack.mitre.org/techniques/T1140/


''version'': 1
</div>
</div>

----

===Detect zerologon attack===
Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack is attackers can now provide themselves high privileges and take over Domain Controller. The included searches in this Analytic Story are designed to identify attempts to reset Domain Controller Computer Account via exploit code remotely or via the use of tool Mimikatz as payload carrier.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2020-09-18
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_computer_changed_with_anonymous_account|Detect Computer Changed with Anonymous Account]]

|
[https://attack.mitre.org/techniques/T1210/ T1210]
|
Exploitation of Remote Services
|
Lateral Movement

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Detect_credential_dumping_through_lsass_access|Detect Credential Dumping through LSASS access]]

|
[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
LSASS Memory, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_mimikatz_using_loaded_images|Detect Mimikatz Using Loaded Images]]

|
[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
LSASS Memory, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_zerologon_via_zeek|Detect Zerologon via Zeek]]

|
[https://attack.mitre.org/techniques/T1190/ T1190]
|
Exploit Public-Facing Application
|
Initial Access

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation


====Reference====

* https://attack.mitre.org/wiki/Technique/T1003

* https://github.com/SecuraBV/CVE-2020-1472

* https://www.secura.com/blog/zero-logon

* https://nvd.nist.gov/vuln/detail/CVE-2020-1472


''version'': 1
</div>
</div>

----

===Disabling security tools===
Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2020-02-04
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Attempt_to_add_certificate_to_untrusted_store|Attempt To Add Certificate To Untrusted Store]]

|
[https://attack.mitre.org/techniques/T1553.004/ T1553.004], 
[https://attack.mitre.org/techniques/T1553/ T1553]
|
Install Root Certificate, 
Subvert Trust Controls
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Attempt_to_stop_security_service|Attempt To Stop Security Service]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Processes_launching_netsh|Processes launching netsh]]

|
[https://attack.mitre.org/techniques/T1562.004/ T1562.004], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify System Firewall, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]

|
[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
[https://attack.mitre.org/techniques/T1543/ T1543]
|
Windows Service, 
Create or Modify System Process
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_reg_exe_process|Suspicious Reg exe Process]]

|
[https://attack.mitre.org/techniques/T1112/ T1112]
|
Modify Registry
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Unload_sysmon_filter_driver|Unload Sysmon Filter Driver]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Installation


====Reference====

* https://attack.mitre.org/wiki/Technique/T1089

* https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/

* https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf


''version'': 2
</div>
</div>

----

===Domain trust discovery===
Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-03-25
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Dsquery_domain_discovery|DSQuery Domain Discovery]]

|
[https://attack.mitre.org/techniques/T1482/ T1482]
|
Domain Trust Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Nltest_domain_trust_discovery|NLTest Domain Trust Discovery]]

|
[https://attack.mitre.org/techniques/T1482/ T1482]
|
Domain Trust Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Windows_adfind_exe|Windows AdFind Exe]]

|
[https://attack.mitre.org/techniques/T1018/ T1018]
|
Remote System Discovery
|
Discovery

| TTP
|}

====Kill Chain Phase====

* Exploitation


====Reference====

* https://attack.mitre.org/techniques/T1482/


''version'': 1
</div>
</div>

----

===F5 tmui rce cve-2020-5902===
Uncover activity consistent with CVE-2020-5902. Discovered by Positive Technologies researchers, this vulnerability affects F5 BIG-IP, BIG-IQ. and Traffix SDC devices (vulnerable versions in F5 support link below). This vulnerability allows unauthenticated users, along with authenticated users, who have access to the configuration utility to execute system commands, create/delete files, disable services, and/or execute Java code.  This vulnerability can result in full system compromise.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2020-08-02
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_f5_tmui_rce_cve-2020-5902|Detect F5 TMUI RCE CVE-2020-5902]]

|
[https://attack.mitre.org/techniques/T1190/ T1190]
|
Exploit Public-Facing Application
|
Initial Access

| TTP
|}

====Kill Chain Phase====

* Exploitation


====Reference====

* https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/

* https://support.f5.com/csp/article/K52145254

* https://blog.cloudflare.com/cve-2020-5902-helping-to-protect-against-the-f5-tmui-rce-vulnerability/


''version'': 1
</div>
</div>

----

===Hafnium group===
HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVEs in the wild - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint], [https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic Network_Traffic]
* '''Last Updated''': 2021-03-03
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadstring|Any Powershell DownloadString]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
PowerShell
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_exchange_web_shell|Detect Exchange Web Shell]]

|
[https://attack.mitre.org/techniques/T1505/ T1505], 
[https://attack.mitre.org/techniques/T1505.003/ T1505.003]
|
Server Software Component, 
Web Shell
|
Persistence, 
Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_new_local_admin_account|Detect New Local Admin account]]

|
[https://attack.mitre.org/techniques/T1136.001/ T1136.001], 
[https://attack.mitre.org/techniques/T1136/ T1136]
|
Local Account, 
Create Account
|
Persistence, 
Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]

|
[https://attack.mitre.org/techniques/T1021/ T1021], 
[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
|
Remote Services, 
SMB/Windows Admin Shares
|
Lateral Movement, 
Lateral Movement

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]

|
[https://attack.mitre.org/techniques/T1569/ T1569], 
[https://attack.mitre.org/techniques/T1569.002/ T1569.002]
|
System Services, 
Service Execution
|
Execution, 
Execution

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_comsvcs_dll|Dump LSASS via comsvcs DLL]]

|
[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
LSASS Memory, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_procdump|Dump LSASS via procdump]]

|
[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
LSASS Memory, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Email_servers_sending_high_volume_traffic_to_hosts|Email servers sending high volume traffic to hosts]]

|
[https://attack.mitre.org/techniques/T1114/ T1114], 
[https://attack.mitre.org/techniques/T1114.002/ T1114.002]
|
Email Collection, 
Remote Email Collection
|
Collection, 
Collection

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_connect_to_internet_with_hidden_window|Malicious PowerShell Process - Connect To Internet With Hidden Window]]

|
[https://attack.mitre.org/techniques/T1059.001/ T1059.001], 
[https://attack.mitre.org/techniques/T1059/ T1059]
|
PowerShell, 
Command and Scripting Interpreter
|
Execution, 
Execution

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_execution_policy_bypass|Malicious PowerShell Process - Execution Policy Bypass]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
PowerShell
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Nishang_powershelltcponeline|Nishang PowershellTCPOneLine]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
PowerShell
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Ntdsutil_export_ntds|Ntdsutil Export NTDS]]

|
[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
NTDS, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Set_default_powershell_execution_policy_to_unrestricted_or_bypass|Set Default PowerShell Execution Policy To Unrestricted or Bypass]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
PowerShell
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Unified_messaging_service_spawning_a_process|Unified Messaging Service Spawning a Process]]

|
[https://attack.mitre.org/techniques/T1190/ T1190]
|
Exploit Public-Facing Application
|
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#W3wp_spawning_shell|W3WP Spawning Shell]]

|
[https://attack.mitre.org/techniques/T1505/ T1505], 
[https://attack.mitre.org/techniques/T1505.003/ T1505.003]
|
Server Software Component, 
Web Shell
|
Persistence, 
Persistence

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Command and Control

* Execution

* Exploitation

* Installation

* Lateral Movement


====Reference====

* https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html

* https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/

* https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

* https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/


''version'': 1
</div>
</div>

----

===Ingress tool transfer===
Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-03-24
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadfile|Any Powershell DownloadFile]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
PowerShell
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadstring|Any Powershell DownloadString]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
PowerShell
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Bitsadmin_download_file|BITSAdmin Download File]]

|
[https://attack.mitre.org/techniques/T1197/ T1197], 
[https://attack.mitre.org/techniques/T1105/ T1105]
|
BITS Jobs, 
Ingress Tool Transfer
|
Defense Evasion, Persistence, 
Command And Control

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Certutil_download_with_urlcache_and_split_arguments|CertUtil Download With URLCache and Split Arguments]]

|
[https://attack.mitre.org/techniques/T1105/ T1105]
|
Ingress Tool Transfer
|
Command And Control

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Certutil_download_with_verifyctl_and_split_arguments|CertUtil Download With VerifyCtl and Split Arguments]]

|
[https://attack.mitre.org/techniques/T1105/ T1105]
|
Ingress Tool Transfer
|
Command And Control

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_curl_network_connection|Suspicious Curl Network Connection]]

|
[https://attack.mitre.org/techniques/T1105/ T1105]
|
Ingress Tool Transfer
|
Command And Control

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation


====Reference====

* https://attack.mitre.org/techniques/T1105/


''version'': 1
</div>
</div>

----

===Lateral movement===
Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint], [https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic Network_Traffic]
* '''Last Updated''': 2020-02-04
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_activity_related_to_pass_the_hash_attacks|Detect Activity Related to Pass the Hash Attacks]]

|
[https://attack.mitre.org/techniques/T1550/ T1550], 
[https://attack.mitre.org/techniques/T1550.002/ T1550.002]
|
Use Alternate Authentication Material, 
Pass the Hash
|
Defense Evasion, Lateral Movement, 
Defense Evasion, Lateral Movement

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_pass_the_hash|Detect Pass the Hash]]

|
[https://attack.mitre.org/techniques/T1550/ T1550], 
[https://attack.mitre.org/techniques/T1550.002/ T1550.002]
|
Use Alternate Authentication Material, 
Pass the Hash
|
Defense Evasion, Lateral Movement, 
Defense Evasion, Lateral Movement

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]

|
[https://attack.mitre.org/techniques/T1021/ T1021], 
[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
|
Remote Services, 
SMB/Windows Admin Shares
|
Lateral Movement, 
Lateral Movement

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]

|
[https://attack.mitre.org/techniques/T1569/ T1569], 
[https://attack.mitre.org/techniques/T1569.002/ T1569.002]
|
System Services, 
Service Execution
|
Execution, 
Execution

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Kerberoasting_spn_request_with_rc4_encryption|Kerberoasting spn request with RC4 encryption]]

|
[https://attack.mitre.org/techniques/T1558.003/ T1558.003], 
[https://attack.mitre.org/techniques/T1558/ T1558]
|
Kerberoasting, 
Steal or Forge Kerberos Tickets
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Potential_pass_the_token_or_hash_observed_at_the_destination_device|Potential Pass the Token or Hash Observed at the Destination Device]]

|
[https://attack.mitre.org/techniques/T1550/ T1550], 
[https://attack.mitre.org/techniques/T1550.002/ T1550.002]
|
Use Alternate Authentication Material, 
Pass the Hash
|
Defense Evasion, Lateral Movement, 
Defense Evasion, Lateral Movement

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Potential_pass_the_token_or_hash_observed_by_an_event_collecting_device|Potential Pass the Token or Hash Observed by an Event Collecting Device]]

|
[https://attack.mitre.org/techniques/T1550/ T1550], 
[https://attack.mitre.org/techniques/T1550.002/ T1550.002]
|
Use Alternate Authentication Material, 
Pass the Hash
|
Defense Evasion, Lateral Movement, 
Defense Evasion, Lateral Movement

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_traffic|Remote Desktop Network Traffic]]

|
[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
[https://attack.mitre.org/techniques/T1021/ T1021]
|
Remote Desktop Protocol, 
Remote Services
|
Lateral Movement, 
Lateral Movement

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Remote_desktop_process_running_on_system|Remote Desktop Process Running On System]]

|
[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
[https://attack.mitre.org/techniques/T1021/ T1021]
|
Remote Desktop Protocol, 
Remote Services
|
Lateral Movement, 
Lateral Movement

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Schtasks_scheduling_job_on_remote_system|Schtasks scheduling job on remote system]]

|
[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task, 
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation, 
Execution, Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Serviceprincipalnames_discovery_with_powershell|ServicePrincipalNames Discovery with PowerShell]]

|
[https://attack.mitre.org/techniques/T1558.003/ T1558.003]
|
Kerberoasting
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Serviceprincipalnames_discovery_with_setspn|ServicePrincipalNames Discovery with SetSPN]]

|
[https://attack.mitre.org/techniques/T1558.003/ T1558.003]
|
Kerberoasting
|
Credential Access

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Execution

* Exploitation

* Lateral Movement


====Reference====

* https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html


''version'': 2
</div>
</div>

----

===Malicious powershell===
Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2017-08-23
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadfile|Any Powershell DownloadFile]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
PowerShell
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadstring|Any Powershell DownloadString]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
PowerShell
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules|Credential Extraction indicative of use of DSInternals credential conversion modules]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_use_of_dsinternals_modules|Credential Extraction indicative of use of DSInternals modules]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_use_of_powersploit_modules|Credential Extraction indicative of use of PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals|Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_empire_with_powershell_script_block_logging|Detect Empire with PowerShell Script Block Logging]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
PowerShell
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_mimikatz_with_powershell_script_block_logging|Detect Mimikatz With PowerShell Script Block Logging]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Illegal_access_to_user_content_via_powersploit_modules|Illegal Access To User Content via PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1021/ T1021], 
[https://attack.mitre.org/techniques/T1113/ T1113], 
[https://attack.mitre.org/techniques/T1123/ T1123], 
[https://attack.mitre.org/techniques/T1563/ T1563]
|
Remote Services, 
Screen Capture, 
Audio Capture, 
Remote Service Session Hijacking
|
Lateral Movement, 
Collection, 
Collection, 
Lateral Movement

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Illegal_privilege_elevation_and_persistence_via_powersploit_modules|Illegal Privilege Elevation and Persistence via PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1053/ T1053], 
[https://attack.mitre.org/techniques/T1134/ T1134], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Scheduled Task/Job, 
Access Token Manipulation, 
Abuse Elevation Control Mechanism
|
Execution, Persistence, Privilege Escalation, 
Defense Evasion, Privilege Escalation, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Illegal_service_and_process_control_via_powersploit_modules|Illegal Service and Process Control via PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1055/ T1055], 
[https://attack.mitre.org/techniques/T1106/ T1106], 
[https://attack.mitre.org/techniques/T1569/ T1569]
|
Process Injection, 
Native API, 
System Services
|
Defense Evasion, Privilege Escalation, 
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_connect_to_internet_with_hidden_window|Malicious PowerShell Process - Connect To Internet With Hidden Window]]

|
[https://attack.mitre.org/techniques/T1059.001/ T1059.001], 
[https://attack.mitre.org/techniques/T1059/ T1059]
|
PowerShell, 
Command and Scripting Interpreter
|
Execution, 
Execution

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_encoded_command|Malicious PowerShell Process - Encoded Command]]

|
[https://attack.mitre.org/techniques/T1027/ T1027]
|
Obfuscated Files or Information
|
Defense Evasion

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_with_obfuscation_techniques|Malicious PowerShell Process With Obfuscation Techniques]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
PowerShell
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Powershell_4104_hunting|PowerShell 4104 Hunting]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
PowerShell
|
Execution, 
Execution

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Powershell_domain_enumeration|PowerShell Domain Enumeration]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
PowerShell
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Powershell_loading_dotnet_into_memory_via_system_reflection_assembly|PowerShell Loading DotNET into Memory via System Reflection Assembly]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
PowerShell
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Powershell_creating_thread_mutex|Powershell Creating Thread Mutex]]

|
[https://attack.mitre.org/techniques/T1027/ T1027], 
[https://attack.mitre.org/techniques/T1027.005/ T1027.005]
|
Obfuscated Files or Information, 
Indicator Removal from Tools
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Powershell_enable_smb1protocol_feature|Powershell Enable SMB1Protocol Feature]]

|
[https://attack.mitre.org/techniques/T1027/ T1027], 
[https://attack.mitre.org/techniques/T1027.005/ T1027.005]
|
Obfuscated Files or Information, 
Indicator Removal from Tools
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Powershell_execute_com_object|Powershell Execute COM Object]]

|
[https://attack.mitre.org/techniques/T1546.015/ T1546.015], 
[https://attack.mitre.org/techniques/T1546/ T1546]
|
Component Object Model Hijacking, 
Event Triggered Execution
|
Privilege Escalation, Persistence, 
Privilege Escalation, Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Powershell_fileless_process_injection_via_getprocaddress|Powershell Fileless Process Injection via GetProcAddress]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1055/ T1055], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
Process Injection, 
PowerShell
|
Execution, 
Defense Evasion, Privilege Escalation, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Powershell_fileless_script_contains_base64_encoded_content|Powershell Fileless Script Contains Base64 Encoded Content]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1027/ T1027], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
Obfuscated Files or Information, 
PowerShell
|
Execution, 
Defense Evasion, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Powershell_processing_stream_of_data|Powershell Processing Stream Of Data]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
PowerShell
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Powershell_using_memory_as_backing_store|Powershell Using memory As Backing Store]]

|
[https://attack.mitre.org/techniques/T1140/ T1140]
|
Deobfuscate/Decode Files or Information
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Recon_avproduct_through_pwh_or_wmi|Recon AVProduct Through Pwh or WMI]]

|
[https://attack.mitre.org/techniques/T1592/ T1592]
|
Gather Victim Host Information
|
Reconnaissance

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Recon_using_wmi_class|Recon Using WMI Class]]

|
[https://attack.mitre.org/techniques/T1592/ T1592]
|
Gather Victim Host Information
|
Reconnaissance

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Set_default_powershell_execution_policy_to_unrestricted_or_bypass|Set Default PowerShell Execution Policy To Unrestricted or Bypass]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
PowerShell
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Unloading_amsi_via_reflection|Unloading AMSI via Reflection]]

|
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Impair Defenses
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Wmi_recon_running_process_or_services|WMI Recon Running Process Or Services]]

|
[https://attack.mitre.org/techniques/T1592/ T1592]
|
Gather Victim Host Information
|
Reconnaissance

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Command and Control

* Exploitation

* Installation

* Privilege Escalation

* Reconnaissance


====Reference====

* https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/

* https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/


''version'': 5
</div>
</div>

----

===Masquerading - rename system utilities===
Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-04-26
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Execution_of_file_with_multiple_extensions|Execution of File with Multiple Extensions]]

|
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
|
Masquerading, 
Rename System Utilities
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Sdelete_application_execution|Sdelete Application Execution]]

|
[https://attack.mitre.org/techniques/T1485/ T1485], 
[https://attack.mitre.org/techniques/T1070.004/ T1070.004], 
[https://attack.mitre.org/techniques/T1070/ T1070]
|
Data Destruction, 
File Deletion, 
Indicator Removal on Host
|
Impact, 
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_rename|Suspicious MSBuild Rename]]

|
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1127/ T1127], 
[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
[https://attack.mitre.org/techniques/T1127.001/ T1127.001]
|
Masquerading, 
Trusted Developer Utilities Proxy Execution, 
Rename System Utilities, 
MSBuild
|
Defense Evasion, 
Defense Evasion, 
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_rename|Suspicious Rundll32 Rename]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011], 
[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
|
Signed Binary Proxy Execution, 
Masquerading, 
Rundll32, 
Rename System Utilities
|
Defense Evasion, 
Defense Evasion, 
Defense Evasion, 
Defense Evasion

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_microsoft_workflow_compiler_rename|Suspicious microsoft workflow compiler rename]]

|
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1127/ T1127], 
[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
|
Masquerading, 
Trusted Developer Utilities Proxy Execution, 
Rename System Utilities
|
Defense Evasion, 
Defense Evasion, 
Defense Evasion

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_path|Suspicious msbuild path]]

|
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1127/ T1127], 
[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
[https://attack.mitre.org/techniques/T1127.001/ T1127.001]
|
Masquerading, 
Trusted Developer Utilities Proxy Execution, 
Rename System Utilities, 
MSBuild
|
Defense Evasion, 
Defense Evasion, 
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#System_process_running_from_unexpected_location|System Process Running from Unexpected Location]]

|
[https://attack.mitre.org/techniques/T1036/ T1036]
|
Masquerading
|
Defense Evasion

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#System_processes_run_from_unexpected_locations|System Processes Run From Unexpected Locations]]

|
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
|
Masquerading, 
Rename System Utilities
|
Defense Evasion, 
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation


====Reference====

* https://attack.mitre.org/techniques/T1036/003/


''version'': 1
</div>
</div>

----

===Meterpreter===
Meterpreter provides red teams, pen testers and threat actors interactive access to a compromised host to run commands, upload payloads, download files, and other actions.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-06-08
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Excessive_number_of_distinct_processes_created_in_windows_temp_folder|Excessive number of distinct processes created in Windows Temp folder]]

|
[https://attack.mitre.org/techniques/T1059/ T1059]
|
Command and Scripting Interpreter
|
Execution

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Excessive_number_of_taskhost_processes|Excessive number of taskhost processes]]

|
[https://attack.mitre.org/techniques/T1033/ T1033]
|
System Owner/User Discovery
|
Discovery

| Anomaly
|}

====Kill Chain Phase====

* Exploitation


====Reference====

* https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/

* https://doubleoctopus.com/security-wiki/threats-and-tools/meterpreter/

* https://www.rapid7.com/products/metasploit/


''version'': 1
</div>
</div>

----

===Microsoft mshtml remote code execution cve-2021-40444===
CVE-2021-40444 is a remote code execution vulnerability in MSHTML, recently used to delivery targeted spearphishing documents.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-09-08
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Control_loading_from_world_writable_directory|Control Loading from World Writable Directory]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.002/ T1218.002]
|
Signed Binary Proxy Execution, 
Control Panel
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Mshtml_module_load_in_office_product|MSHTML Module Load in Office Product]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_product_writing_cab_or_inf|Office Product Writing cab or inf]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_spawning_control|Office Spawning Control]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Rundll32_control_rundll_hunt|Rundll32 Control RunDLL Hunt]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Rundll32_control_rundll_world_writable_directory|Rundll32 Control RunDLL World Writable Directory]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Exploitation


====Reference====

* https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/09/windows-mshtml-zero-day-actively-exploited-mitigations-required/

* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444

* https://www.echotrail.io/insights/search/control.exe


''version'': 1
</div>
</div>

----

===Nobelium group===
Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint], [https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic Network_Traffic], [https://docs.splunk.com/Documentation/CIM/latest/User/Web Web]
* '''Last Updated''': 2020-12-14
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Anomalous_usage_of_7zip|Anomalous usage of 7zip]]

|
[https://attack.mitre.org/techniques/T1560.001/ T1560.001], 
[https://attack.mitre.org/techniques/T1560/ T1560]
|
Archive via Utility, 
Archive Collected Data
|
Collection, 
Collection

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Detect_outbound_smb_traffic|Detect Outbound SMB Traffic]]

|
[https://attack.mitre.org/techniques/T1071.002/ T1071.002], 
[https://attack.mitre.org/techniques/T1071/ T1071]
|
File Transfer Protocols, 
Application Layer Protocol
|
Command And Control, 
Command And Control

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.003/ T1059.003]
|
Command and Scripting Interpreter, 
Windows Command Shell
|
Execution, 
Execution

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Detect_rundll32_inline_hta_execution|Detect Rundll32 Inline HTA Execution]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.005/ T1218.005]
|
Signed Binary Proxy Execution, 
Mshta
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#First_time_seen_running_windows_service|First Time Seen Running Windows Service]]

|
[https://attack.mitre.org/techniques/T1569/ T1569], 
[https://attack.mitre.org/techniques/T1569.002/ T1569.002]
|
System Services, 
Service Execution
|
Execution, 
Execution

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_encoded_command|Malicious PowerShell Process - Encoded Command]]

|
[https://attack.mitre.org/techniques/T1027/ T1027]
|
Obfuscated Files or Information
|
Defense Evasion

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]

|
[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
[https://attack.mitre.org/techniques/T1543/ T1543]
|
Windows Service, 
Create or Modify System Process
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Scheduled_task_deleted_or_created_via_cmd|Scheduled Task Deleted Or Created via CMD]]

|
[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task, 
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation, 
Execution, Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Schtasks_scheduling_job_on_remote_system|Schtasks scheduling job on remote system]]

|
[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task, 
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation, 
Execution, Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Sunburst_correlation_dll_and_network_event|Sunburst Correlation DLL and Network Event]]

|
[https://attack.mitre.org/techniques/T1203/ T1203]
|
Exploitation for Client Execution
|
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Supernova_webshell|Supernova Webshell]]

|
[https://attack.mitre.org/techniques/T1505.003/ T1505.003]
|
Web Shell
|
Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Tor_traffic|TOR Traffic]]

|
[https://attack.mitre.org/techniques/T1071/ T1071], 
[https://attack.mitre.org/techniques/T1071.001/ T1071.001]
|
Application Layer Protocol, 
Web Protocols
|
Command And Control, 
Command And Control

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Windows_adfind_exe|Windows AdFind Exe]]

|
[https://attack.mitre.org/techniques/T1018/ T1018]
|
Remote System Discovery
|
Discovery

| TTP
|}

====Kill Chain Phase====

* Actions on Objective

* Actions on Objectives

* Command and Control

* Exfiltration

* Exploitation

* Installation


====Reference====

* https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/

* https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

* https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/


''version'': 2
</div>
</div>

----

===Petitpotam ntlm relay on active directory certificate services===
PetitPotam (CVE-2021-36942,) is a vulnerablity identified in Microsofts EFSRPC Protocol that can allow an unauthenticated account to escalate privileges to domain administrator given the right circumstances.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2021-08-31
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Petitpotam_network_share_access_request|PetitPotam Network Share Access Request]]

|
[https://attack.mitre.org/techniques/T1187/ T1187]
|
Forced Authentication
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Petitpotam_suspicious_kerberos_tgt_request|PetitPotam Suspicious Kerberos TGT Request]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|}

====Kill Chain Phase====

* Exploitation

* Lateral Movement


====Reference====

* https://us-cert.cisa.gov/ncas/current-activity/2021/07/27/microsoft-releases-guidance-mitigating-petitpotam-ntlm-relay

* https://support.microsoft.com/en-us/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429

* https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf

* https://github.com/topotam/PetitPotam/

* https://github.com/gentilkiwi/mimikatz/releases/tag/2.2.0-20210723

* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942

* https://attack.mitre.org/techniques/T1187/


''version'': 1
</div>
</div>

----

===Possible backdoor activity associated with mudcarp espionage campaigns===
Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2020-01-22
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_connect_to_internet_with_hidden_window|Malicious PowerShell Process - Connect To Internet With Hidden Window]]

|
[https://attack.mitre.org/techniques/T1059.001/ T1059.001], 
[https://attack.mitre.org/techniques/T1059/ T1059]
|
PowerShell, 
Command and Scripting Interpreter
|
Execution, 
Execution

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]

|
[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Registry Run Keys / Startup Folder, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Unusually_long_command_line|Unusually Long Command Line]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Unusually_long_command_line_-_mltk|Unusually Long Command Line - MLTK]]

|
|
|

| Anomaly
|}

====Kill Chain Phase====

* Actions on Objectives

* Command and Control


====Reference====

* https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/

* http://blog.amossys.fr/badflick-is-not-so-bad.html


''version'': 1
</div>
</div>

----

===Proxyshell===
ProxyShell is a chain of exploits targeting on-premise Microsoft Exchange Server - CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-08-24
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_exchange_web_shell|Detect Exchange Web Shell]]

|
[https://attack.mitre.org/techniques/T1505/ T1505], 
[https://attack.mitre.org/techniques/T1505.003/ T1505.003]
|
Server Software Component, 
Web Shell
|
Persistence, 
Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Exchange_powershell_abuse_via_ssrf|Exchange PowerShell Abuse via SSRF]]

|
[https://attack.mitre.org/techniques/T1190/ T1190]
|
Exploit Public-Facing Application
|
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Exchange_powershell_module_usage|Exchange PowerShell Module Usage]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
PowerShell
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#W3wp_spawning_shell|W3WP Spawning Shell]]

|
[https://attack.mitre.org/techniques/T1505/ T1505], 
[https://attack.mitre.org/techniques/T1505.003/ T1505.003]
|
Server Software Component, 
Web Shell
|
Persistence, 
Persistence

| TTP
|}

====Kill Chain Phase====

* Exploitation

* Reconnaissance


====Reference====

* https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/

* https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell

* https://www.youtube.com/watch?v=FC6iHw258RI

* https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do

* https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-ProxyLogon-Is-Just-The-Tip-Of-The-Iceberg-A-New-Attack-Surface-On-Microsoft-Exchange-Server.pdf


''version'': 1
</div>
</div>

----

===Sql injection===
Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Web Web]
* '''Last Updated''': 2017-09-19
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Sql_injection_with_long_urls|SQL Injection with Long URLs]]

|
[https://attack.mitre.org/techniques/T1190/ T1190]
|
Exploit Public-Facing Application
|
Initial Access

| TTP
|}

====Kill Chain Phase====

* Delivery


====Reference====

* https://capec.mitre.org/data/definitions/66.html

* https://www.incapsula.com/web-application-security/sql-injection.html


''version'': 1
</div>
</div>

----

===Silver sparrow===
Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking MacOS (Intel and M1) malicious software downloader utilizing JavaScript for execution and a launchAgent to establish persistence.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-02-24
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_curl_network_connection|Suspicious Curl Network Connection]]

|
[https://attack.mitre.org/techniques/T1105/ T1105]
|
Ingress Tool Transfer
|
Command And Control

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_plistbuddy_usage|Suspicious PlistBuddy Usage]]

|
[https://attack.mitre.org/techniques/T1543.001/ T1543.001], 
[https://attack.mitre.org/techniques/T1543/ T1543]
|
Launch Agent, 
Create or Modify System Process
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_plistbuddy_usage_via_osquery|Suspicious PlistBuddy Usage via OSquery]]

|
[https://attack.mitre.org/techniques/T1543.001/ T1543.001], 
[https://attack.mitre.org/techniques/T1543/ T1543]
|
Launch Agent, 
Create or Modify System Process
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_sqlite3_lsquarantine_behavior|Suspicious SQLite3 LSQuarantine Behavior]]

|
[https://attack.mitre.org/techniques/T1074/ T1074]
|
Data Staged
|
Collection

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives


====Reference====

* https://redcanary.com/blog/clipping-silver-sparrows-wings/

* https://www.sentinelone.com/blog/5-things-you-need-to-know-about-silver-sparrow/


''version'': 1
</div>
</div>

----

===Spearphishing attachments===
Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2019-04-29
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_outlook_exe_writing_a_zip_file|Detect Outlook exe writing a zip file]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Excel_spawning_powershell|Excel Spawning PowerShell]]

|
[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
Security Account Manager, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Excel_spawning_windows_script_host|Excel Spawning Windows Script Host]]

|
[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
Security Account Manager, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Mshtml_module_load_in_office_product|MSHTML Module Load in Office Product]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_application_spawn_rundll32_process|Office Application Spawn rundll32 process]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_document_creating_schedule_task|Office Document Creating Schedule Task]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_document_executing_macro_code|Office Document Executing Macro Code]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_document_spawned_child_process_to_download|Office Document Spawned Child Process To Download]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_product_spawning_bitsadmin|Office Product Spawning BITSAdmin]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_product_spawning_certutil|Office Product Spawning CertUtil]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_product_spawning_mshta|Office Product Spawning MSHTA]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_product_spawning_rundll32_with_no_dll|Office Product Spawning Rundll32 with no DLL]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_product_spawning_wmic|Office Product Spawning Wmic]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_product_writing_cab_or_inf|Office Product Writing cab or inf]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_spawning_control|Office Spawning Control]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Process_creating_lnk_file_in_suspicious_location|Process Creating LNK file in Suspicious Location]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.002/ T1566.002]
|
Phishing, 
Spearphishing Link
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Winword_spawning_cmd|Winword Spawning Cmd]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Winword_spawning_powershell|Winword Spawning PowerShell]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation

* Installation


====Reference====

* https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html


''version'': 1
</div>
</div>

----

===Suspicious command-line executions===
Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2020-02-03
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]

|
[https://attack.mitre.org/techniques/T1059/ T1059]
|
Command and Scripting Interpreter
|
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.003/ T1059.003]
|
Command and Scripting Interpreter, 
Windows Command Shell
|
Execution, 
Execution

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Detect_use_of_cmd_exe_to_launch_script_interpreters|Detect Use of cmd exe to Launch Script Interpreters]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.003/ T1059.003]
|
Command and Scripting Interpreter, 
Windows Command Shell
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#System_processes_run_from_unexpected_locations|System Processes Run From Unexpected Locations]]

|
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
|
Masquerading, 
Rename System Utilities
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Unusually_long_command_line|Unusually Long Command Line]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Unusually_long_command_line_-_mltk|Unusually Long Command Line - MLTK]]

|
|
|

| Anomaly
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation


====Reference====

* https://attack.mitre.org/wiki/Technique/T1059

* https://www.microsoft.com/en-us/wdsi/threats/macro-malware

* https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf


''version'': 2
</div>
</div>

----

===Suspicious compiled html activity===
Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-02-11
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_html_help_renamed|Detect HTML Help Renamed]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.001/ T1218.001]
|
Signed Binary Proxy Execution, 
Compiled HTML File
|
Defense Evasion, 
Defense Evasion

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Detect_html_help_spawn_child_process|Detect HTML Help Spawn Child Process]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.001/ T1218.001]
|
Signed Binary Proxy Execution, 
Compiled HTML File
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_html_help_url_in_command_line|Detect HTML Help URL in Command Line]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.001/ T1218.001]
|
Signed Binary Proxy Execution, 
Compiled HTML File
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_html_help_using_infotech_storage_handlers|Detect HTML Help Using InfoTech Storage Handlers]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.001/ T1218.001]
|
Signed Binary Proxy Execution, 
Compiled HTML File
|
Defense Evasion, 
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives


====Reference====

* https://redcanary.com/blog/introducing-atomictestharnesses/

* https://attack.mitre.org/techniques/T1218/001/

* https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa


''version'': 1
</div>
</div>

----

===Suspicious dns traffic===
Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint], [https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution Network_Resolution]
* '''Last Updated''': 2017-09-18
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Dns_exfiltration_using_nslookup_app|DNS Exfiltration Using Nslookup App]]

|
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Alternative Protocol
|
Exfiltration

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Dns_query_length_outliers_-_mltk|DNS Query Length Outliers - MLTK]]

|
[https://attack.mitre.org/techniques/T1071.004/ T1071.004], 
[https://attack.mitre.org/techniques/T1071/ T1071]
|
DNS, 
Application Layer Protocol
|
Command And Control, 
Command And Control

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Dns_query_length_with_high_standard_deviation|DNS Query Length With High Standard Deviation]]

|
[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
Exfiltration Over Alternative Protocol
|
Exfiltration, 
Exfiltration

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Detect_hosts_connecting_to_dynamic_domain_providers|Detect hosts connecting to dynamic domain providers]]

|
[https://attack.mitre.org/techniques/T1189/ T1189]
|
Drive-by Compromise
|
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Excessive_dns_failures|Excessive DNS Failures]]

|
[https://attack.mitre.org/techniques/T1071.004/ T1071.004], 
[https://attack.mitre.org/techniques/T1071/ T1071]
|
DNS, 
Application Layer Protocol
|
Command And Control, 
Command And Control

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_nslookup_app|Excessive Usage of NSLOOKUP App]]

|
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Alternative Protocol
|
Exfiltration

| Anomaly
|}

====Kill Chain Phase====

* Actions on Objectives

* Command and Control

* Exploitation


====Reference====

* http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/

* http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680

* https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454


''version'': 1
</div>
</div>

----

===Suspicious emails===
Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Email Email]
* '''Last Updated''': 2020-01-27
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Email_attachments_with_lots_of_spaces|Email Attachments With Lots Of Spaces]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Monitor_email_for_brand_abuse|Monitor Email For Brand Abuse]]

|
|
|

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_email_attachment_extensions|Suspicious Email Attachment Extensions]]

|
[https://attack.mitre.org/techniques/T1566.001/ T1566.001], 
[https://attack.mitre.org/techniques/T1566/ T1566]
|
Spearphishing Attachment, 
Phishing
|
Initial Access, 
Initial Access

| Anomaly
|}

====Kill Chain Phase====

* Delivery


====Reference====

* https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/


''version'': 1
</div>
</div>

----

===Suspicious mshta activity===
Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-01-20
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_mshta_url_in_command_line|Detect MSHTA Url in Command Line]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.005/ T1218.005]
|
Signed Binary Proxy Execution, 
Mshta
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]

|
[https://attack.mitre.org/techniques/T1059/ T1059]
|
Command and Scripting Interpreter
|
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.003/ T1059.003]
|
Command and Scripting Interpreter, 
Windows Command Shell
|
Execution, 
Execution

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Detect_rundll32_inline_hta_execution|Detect Rundll32 Inline HTA Execution]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.005/ T1218.005]
|
Signed Binary Proxy Execution, 
Mshta
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_mshta_inline_hta_execution|Detect mshta inline hta execution]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.005/ T1218.005]
|
Signed Binary Proxy Execution, 
Mshta
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_mshta_renamed|Detect mshta renamed]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.005/ T1218.005]
|
Signed Binary Proxy Execution, 
Mshta
|
Defense Evasion, 
Defense Evasion

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]

|
[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Registry Run Keys / Startup Folder, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_mshta_child_process|Suspicious mshta child process]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.005/ T1218.005]
|
Signed Binary Proxy Execution, 
Mshta
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_mshta_spawn|Suspicious mshta spawn]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.005/ T1218.005]
|
Signed Binary Proxy Execution, 
Mshta
|
Defense Evasion, 
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation


====Reference====

* https://redcanary.com/blog/introducing-atomictestharnesses/

* https://redcanary.com/blog/windows-registry-attacks-threat-detection/

* https://attack.mitre.org/techniques/T1218/005/

* https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5


''version'': 2
</div>
</div>

----

===Suspicious okta activity===
Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2020-04-02
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Multiple_okta_users_with_invalid_credentials_from_the_same_ip|Multiple Okta Users With Invalid Credentials From The Same IP]]

|
[https://attack.mitre.org/techniques/T1078/ T1078], 
[https://attack.mitre.org/techniques/T1078.001/ T1078.001]
|
Valid Accounts, 
Default Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Okta_account_lockout_events|Okta Account Lockout Events]]

|
[https://attack.mitre.org/techniques/T1078/ T1078], 
[https://attack.mitre.org/techniques/T1078.001/ T1078.001]
|
Valid Accounts, 
Default Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Okta_failed_sso_attempts|Okta Failed SSO Attempts]]

|
[https://attack.mitre.org/techniques/T1078/ T1078], 
[https://attack.mitre.org/techniques/T1078.001/ T1078.001]
|
Valid Accounts, 
Default Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Okta_user_logins_from_multiple_cities|Okta User Logins From Multiple Cities]]

|
[https://attack.mitre.org/techniques/T1078/ T1078], 
[https://attack.mitre.org/techniques/T1078.001/ T1078.001]
|
Valid Accounts, 
Default Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Anomaly
|}

====Kill Chain Phase====


====Reference====

* https://attack.mitre.org/wiki/Technique/T1078

* https://owasp.org/www-community/attacks/Credential_stuffing

* https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work


''version'': 1
</div>
</div>

----

===Suspicious regsvcs regasm activity===
Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-02-11
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_regasm_spawning_a_process|Detect Regasm Spawning a Process]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.009/ T1218.009]
|
Signed Binary Proxy Execution, 
Regsvcs/Regasm
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_regasm_with_network_connection|Detect Regasm with Network Connection]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.009/ T1218.009]
|
Signed Binary Proxy Execution, 
Regsvcs/Regasm
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_regasm_with_no_command_line_arguments|Detect Regasm with no Command Line Arguments]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.009/ T1218.009]
|
Signed Binary Proxy Execution, 
Regsvcs/Regasm
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_regsvcs_spawning_a_process|Detect Regsvcs Spawning a Process]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.009/ T1218.009]
|
Signed Binary Proxy Execution, 
Regsvcs/Regasm
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_regsvcs_with_network_connection|Detect Regsvcs with Network Connection]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.009/ T1218.009]
|
Signed Binary Proxy Execution, 
Regsvcs/Regasm
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_regsvcs_with_no_command_line_arguments|Detect Regsvcs with No Command Line Arguments]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.009/ T1218.009]
|
Signed Binary Proxy Execution, 
Regsvcs/Regasm
|
Defense Evasion, 
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives


====Reference====

* https://attack.mitre.org/techniques/T1218/009/

* https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/evasion/windows/applocker_evasion_regasm_regsvcs.md

* https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/


''version'': 1
</div>
</div>

----

===Suspicious regsvr32 activity===
Monitor and detect techniques used by attackers who leverage the regsvr32.exe process to execute malicious code.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-01-29
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_regsvr32_application_control_bypass|Detect Regsvr32 Application Control Bypass]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.010/ T1218.010]
|
Signed Binary Proxy Execution, 
Regsvr32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Malicious_inprocserver32_modification|Malicious InProcServer32 Modification]]

|
[https://attack.mitre.org/techniques/T1218.010/ T1218.010], 
[https://attack.mitre.org/techniques/T1112/ T1112]
|
Regsvr32, 
Modify Registry
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Regsvr32_silent_param_dll_loading|Regsvr32 Silent Param Dll Loading]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.010/ T1218.010]
|
Signed Binary Proxy Execution, 
Regsvr32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_regsvr32_register_suspicious_path|Suspicious Regsvr32 Register Suspicious Path]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.010/ T1218.010]
|
Signed Binary Proxy Execution, 
Regsvr32
|
Defense Evasion, 
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation


====Reference====

* https://attack.mitre.org/techniques/T1218/010/

* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md

* https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/


''version'': 1
</div>
</div>

----

===Suspicious rundll32 activity===
Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-02-03
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_rundll32_application_control_bypass_-_advpack|Detect Rundll32 Application Control Bypass - advpack]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_rundll32_application_control_bypass_-_setupapi|Detect Rundll32 Application Control Bypass - setupapi]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_rundll32_application_control_bypass_-_syssetup|Detect Rundll32 Application Control Bypass - syssetup]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_comsvcs_dll|Dump LSASS via comsvcs DLL]]

|
[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
LSASS Memory, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Rundll32_control_rundll_hunt|Rundll32 Control RunDLL Hunt]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Rundll32_control_rundll_world_writable_directory|Rundll32 Control RunDLL World Writable Directory]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Rundll32_with_no_command_line_arguments_with_network|Rundll32 with no Command Line Arguments with Network]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_rename|Suspicious Rundll32 Rename]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011], 
[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
|
Signed Binary Proxy Execution, 
Masquerading, 
Rundll32, 
Rename System Utilities
|
Defense Evasion, 
Defense Evasion, 
Defense Evasion, 
Defense Evasion

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_startw|Suspicious Rundll32 StartW]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_dllregisterserver|Suspicious Rundll32 dllregisterserver]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_no_command_line_arguments|Suspicious Rundll32 no Command Line Arguments]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation


====Reference====

* https://attack.mitre.org/techniques/T1218/011/

* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md

* https://lolbas-project.github.io/lolbas/Binaries/Rundll32


''version'': 1
</div>
</div>

----

===Suspicious wmi use===
Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2018-10-23
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_wmi_event_subscription_persistence|Detect WMI Event Subscription Persistence]]

|
[https://attack.mitre.org/techniques/T1546.003/ T1546.003], 
[https://attack.mitre.org/techniques/T1546/ T1546]
|
Windows Management Instrumentation Event Subscription, 
Event Triggered Execution
|
Privilege Escalation, Persistence, 
Privilege Escalation, Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Process_execution_via_wmi|Process Execution via WMI]]

|
[https://attack.mitre.org/techniques/T1047/ T1047]
|
Windows Management Instrumentation
|
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Remote_process_instantiation_via_wmi|Remote Process Instantiation via WMI]]

|
[https://attack.mitre.org/techniques/T1047/ T1047]
|
Windows Management Instrumentation
|
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Remote_wmi_command_attempt|Remote WMI Command Attempt]]

|
[https://attack.mitre.org/techniques/T1047/ T1047]
|
Windows Management Instrumentation
|
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Script_execution_via_wmi|Script Execution via WMI]]

|
[https://attack.mitre.org/techniques/T1047/ T1047]
|
Windows Management Instrumentation
|
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Wmi_permanent_event_subscription|WMI Permanent Event Subscription]]

|
[https://attack.mitre.org/techniques/T1047/ T1047]
|
Windows Management Instrumentation
|
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Wmi_permanent_event_subscription_-_sysmon|WMI Permanent Event Subscription - Sysmon]]

|
[https://attack.mitre.org/techniques/T1546.003/ T1546.003], 
[https://attack.mitre.org/techniques/T1546/ T1546]
|
Windows Management Instrumentation Event Subscription, 
Event Triggered Execution
|
Privilege Escalation, Persistence, 
Privilege Escalation, Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Wmi_temporary_event_subscription|WMI Temporary Event Subscription]]

|
[https://attack.mitre.org/techniques/T1047/ T1047]
|
Windows Management Instrumentation
|
Execution

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation


====Reference====

* https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf

* https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html


''version'': 2
</div>
</div>

----

===Suspicious windows registry activities===
Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2018-05-31
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Disable_uac_remote_restriction|Disable UAC Remote Restriction]]

|
[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Bypass User Account Control, 
Abuse Elevation Control Mechanism
|
Privilege Escalation, Defense Evasion, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disabling_remote_user_account_control|Disabling Remote User Account Control]]

|
[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Bypass User Account Control, 
Abuse Elevation Control Mechanism
|
Privilege Escalation, Defense Evasion, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Monitor_registry_keys_for_print_monitors|Monitor Registry Keys for Print Monitors]]

|
[https://attack.mitre.org/techniques/T1547.010/ T1547.010], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Port Monitors, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]

|
[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Registry Run Keys / Startup Folder, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_privilege_escalation|Registry Keys Used For Privilege Escalation]]

|
[https://attack.mitre.org/techniques/T1546.012/ T1546.012], 
[https://attack.mitre.org/techniques/T1546/ T1546]
|
Image File Execution Options Injection, 
Event Triggered Execution
|
Privilege Escalation, Persistence, 
Privilege Escalation, Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Registry_keys_for_creating_shim_databases|Registry Keys for Creating SHIM Databases]]

|
[https://attack.mitre.org/techniques/T1546.011/ T1546.011], 
[https://attack.mitre.org/techniques/T1546/ T1546]
|
Application Shimming, 
Event Triggered Execution
|
Privilege Escalation, Persistence, 
Privilege Escalation, Persistence

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation


====Reference====

* https://redcanary.com/blog/windows-registry-attacks-threat-detection/

* https://attack.mitre.org/wiki/Technique/T1112


''version'': 1
</div>
</div>

----

===Suspicious zoom child processes===
Attackers are using Zoom as an vector to increase privileges on a sytems. This story detects new child processes of zoom and provides investigative actions for this detection.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2020-04-13
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]

|
[https://attack.mitre.org/techniques/T1059/ T1059]
|
Command and Scripting Interpreter
|
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.003/ T1059.003]
|
Command and Scripting Interpreter, 
Windows Command Shell
|
Execution, 
Execution

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#First_time_seen_child_process_of_zoom|First Time Seen Child Process of Zoom]]

|
[https://attack.mitre.org/techniques/T1068/ T1068]
|
Exploitation for Privilege Escalation
|
Privilege Escalation

| Anomaly
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation


====Reference====

* https://blog.rapid7.com/2020/04/02/dispelling-zoom-bugbears-what-you-need-to-know-about-the-latest-zoom-vulnerabilities/

* https://threatpost.com/two-zoom-zero-day-flaws-uncovered/154337/


''version'': 1
</div>
</div>

----

===Trusted developer utilities proxy execution===
Monitor and detect behaviors used by attackers who leverage trusted developer utilities to execute malicious code.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-01-12
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_microsoft_workflow_compiler_rename|Suspicious microsoft workflow compiler rename]]

|
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1127/ T1127], 
[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
|
Masquerading, 
Trusted Developer Utilities Proxy Execution, 
Rename System Utilities
|
Defense Evasion, 
Defense Evasion, 
Defense Evasion

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_microsoft_workflow_compiler_usage|Suspicious microsoft workflow compiler usage]]

|
[https://attack.mitre.org/techniques/T1127/ T1127]
|
Trusted Developer Utilities Proxy Execution
|
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Exploitation


====Reference====

* https://attack.mitre.org/techniques/T1127/

* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md

* https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/


''version'': 1
</div>
</div>

----

===Trusted developer utilities proxy execution msbuild===
Monitor and detect techniques used by attackers who leverage the msbuild.exe process to execute malicious code.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-01-21
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Msbuild_suspicious_spawned_by_script_process|MSBuild Suspicious Spawned By Script Process]]

|
[https://attack.mitre.org/techniques/T1127.001/ T1127.001], 
[https://attack.mitre.org/techniques/T1127/ T1127]
|
MSBuild, 
Trusted Developer Utilities Proxy Execution
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_rename|Suspicious MSBuild Rename]]

|
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1127/ T1127], 
[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
[https://attack.mitre.org/techniques/T1127.001/ T1127.001]
|
Masquerading, 
Trusted Developer Utilities Proxy Execution, 
Rename System Utilities, 
MSBuild
|
Defense Evasion, 
Defense Evasion, 
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_spawn|Suspicious MSBuild Spawn]]

|
[https://attack.mitre.org/techniques/T1127/ T1127], 
[https://attack.mitre.org/techniques/T1127.001/ T1127.001]
|
Trusted Developer Utilities Proxy Execution, 
MSBuild
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_path|Suspicious msbuild path]]

|
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1127/ T1127], 
[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
[https://attack.mitre.org/techniques/T1127.001/ T1127.001]
|
Masquerading, 
Trusted Developer Utilities Proxy Execution, 
Rename System Utilities, 
MSBuild
|
Defense Evasion, 
Defense Evasion, 
Defense Evasion, 
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Exploitation


====Reference====

* https://attack.mitre.org/techniques/T1127/001/

* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md

* https://github.com/infosecn1nja/MaliciousMacroMSBuild

* https://github.com/xorrior/RandomPS-Scripts/blob/master/Invoke-ExecuteMSBuild.ps1

* https://lolbas-project.github.io/lolbas/Binaries/Msbuild/

* https://github.com/MHaggis/CBR-Queries/blob/master/msbuild.md


''version'': 1
</div>
</div>

----

===Windows dns sigred cve-2020-1350===
Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). An attacker can use the malicious payload to cause a buffer overflow on the vulnerable system, leading to compromise.  The included searches in this Analytic Story are designed to identify the large response payload for SIG and KEY DNS records which can be used for the exploit.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution Network_Resolution]
* '''Last Updated''': 2020-07-28
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_windows_dns_sigred_via_splunk_stream|Detect Windows DNS SIGRed via Splunk Stream]]

|
[https://attack.mitre.org/techniques/T1203/ T1203]
|
Exploitation for Client Execution
|
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_windows_dns_sigred_via_zeek|Detect Windows DNS SIGRed via Zeek]]

|
[https://attack.mitre.org/techniques/T1203/ T1203]
|
Exploitation for Client Execution
|
Execution

| TTP
|}

====Kill Chain Phase====

* Exploitation


====Reference====

* https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/

* https://support.microsoft.com/en-au/help/4569509/windows-dns-server-remote-code-execution-vulnerability


''version'': 1
</div>
</div>

----

===Windows defense evasion tactics===
Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others 

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2018-05-31
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Disable_registry_tool|Disable Registry Tool]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disable_security_logs_using_minint_registry|Disable Security Logs Using MiniNt Registry]]

|
[https://attack.mitre.org/techniques/T1112/ T1112]
|
Modify Registry
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disable_show_hidden_files|Disable Show Hidden Files]]

|
[https://attack.mitre.org/techniques/T1564.001/ T1564.001], 
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1564/ T1564], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Hidden Files and Directories, 
Disable or Modify Tools, 
Hide Artifacts, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion, 
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disable_uac_remote_restriction|Disable UAC Remote Restriction]]

|
[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Bypass User Account Control, 
Abuse Elevation Control Mechanism
|
Privilege Escalation, Defense Evasion, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disable_windows_behavior_monitoring|Disable Windows Behavior Monitoring]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disable_windows_smartscreen_protection|Disable Windows SmartScreen Protection]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disabling_cmd_application|Disabling CMD Application]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disabling_controlpanel|Disabling ControlPanel]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disabling_firewall_with_netsh|Disabling Firewall with Netsh]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disabling_folderoptions_windows_feature|Disabling FolderOptions Windows Feature]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disabling_norun_windows_app|Disabling NoRun Windows App]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disabling_remote_user_account_control|Disabling Remote User Account Control]]

|
[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Bypass User Account Control, 
Abuse Elevation Control Mechanism
|
Privilege Escalation, Defense Evasion, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disabling_systemrestore_in_registry|Disabling SystemRestore In Registry]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disabling_task_manager|Disabling Task Manager]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Eventvwr_uac_bypass|Eventvwr UAC Bypass]]

|
[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Bypass User Account Control, 
Abuse Elevation Control Mechanism
|
Privilege Escalation, Defense Evasion, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Excessive_number_of_service_control_start_as_disabled|Excessive number of service control start as disabled]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Fodhelper_uac_bypass|FodHelper UAC Bypass]]

|
[https://attack.mitre.org/techniques/T1112/ T1112], 
[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Modify Registry, 
Bypass User Account Control, 
Abuse Elevation Control Mechanism
|
Defense Evasion, 
Privilege Escalation, Defense Evasion, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Hiding_files_and_directories_with_attrib_exe|Hiding Files And Directories With Attrib exe]]

|
[https://attack.mitre.org/techniques/T1222/ T1222], 
[https://attack.mitre.org/techniques/T1222.001/ T1222.001]
|
File and Directory Permissions Modification, 
Windows File and Directory Permissions Modification
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Net_profiler_uac_bypass|NET Profiler UAC bypass]]

|
[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Bypass User Account Control, 
Abuse Elevation Control Mechanism
|
Privilege Escalation, Defense Evasion, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Slui_runas_elevated|SLUI RunAs Elevated]]

|
[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Bypass User Account Control, 
Abuse Elevation Control Mechanism
|
Privilege Escalation, Defense Evasion, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Slui_spawning_a_process|SLUI Spawning a Process]]

|
[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Bypass User Account Control, 
Abuse Elevation Control Mechanism
|
Privilege Escalation, Defense Evasion, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Sdclt_uac_bypass|Sdclt UAC Bypass]]

|
[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Bypass User Account Control, 
Abuse Elevation Control Mechanism
|
Privilege Escalation, Defense Evasion, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Silentcleanup_uac_bypass|SilentCleanup UAC Bypass]]

|
[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Bypass User Account Control, 
Abuse Elevation Control Mechanism
|
Privilege Escalation, Defense Evasion, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_reg_exe_process|Suspicious Reg exe Process]]

|
[https://attack.mitre.org/techniques/T1112/ T1112]
|
Modify Registry
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#System_process_running_from_unexpected_location|System Process Running from Unexpected Location]]

|
[https://attack.mitre.org/techniques/T1036/ T1036]
|
Masquerading
|
Defense Evasion

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Uac_bypass_mmc_load_unsigned_dll|UAC Bypass MMC Load Unsigned Dll]]

|
[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Bypass User Account Control, 
Abuse Elevation Control Mechanism
|
Privilege Escalation, Defense Evasion, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Wsreset_uac_bypass|WSReset UAC Bypass]]

|
[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Bypass User Account Control, 
Abuse Elevation Control Mechanism
|
Privilege Escalation, Defense Evasion, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Windows_disableantispyware_registry|Windows DisableAntiSpyware Registry]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Delivery

* Exploitation

* Privilege Escalation


====Reference====

* https://attack.mitre.org/wiki/Defense_Evasion


''version'': 1
</div>
</div>

----

===Windows discovery techniques===
Monitors for behaviors associated with adversaries discovering objects in the environment that can be leveraged in the progression of the attack.

* '''Product''': Splunk Behavioral Analytics, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2021-03-04
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules|Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1078/ T1078], 
[https://attack.mitre.org/techniques/T1087/ T1087], 
[https://attack.mitre.org/techniques/T1484/ T1484]
|
Valid Accounts, 
Account Discovery, 
Domain Policy Modification
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Discovery, 
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules|Reconnaissance and Access to Accounts and Groups via Mimikatz modules]]

|
[https://attack.mitre.org/techniques/T1078/ T1078], 
[https://attack.mitre.org/techniques/T1087/ T1087], 
[https://attack.mitre.org/techniques/T1484/ T1484]
|
Valid Accounts, 
Account Discovery, 
Domain Policy Modification
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Discovery, 
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules|Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1199/ T1199], 
[https://attack.mitre.org/techniques/T1482/ T1482], 
[https://attack.mitre.org/techniques/T1590/ T1590], 
[https://attack.mitre.org/techniques/T1591/ T1591], 
[https://attack.mitre.org/techniques/T1595/ T1595]
|
Trusted Relationship, 
Domain Trust Discovery, 
Gather Victim Network Information, 
Gather Victim Org Information, 
Active Scanning
|
Initial Access, 
Discovery, 
Reconnaissance, 
Reconnaissance, 
Reconnaissance

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules|Reconnaissance and Access to Computers and Domains via PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1592/ T1592], 
[https://attack.mitre.org/techniques/T1590/ T1590], 
[https://attack.mitre.org/techniques/T1087/ T1087]
|
Gather Victim Host Information, 
Gather Victim Network Information, 
Account Discovery
|
Reconnaissance, 
Reconnaissance, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_computers_via_mimikatz_modules|Reconnaissance and Access to Computers via Mimikatz modules]]

|
[https://attack.mitre.org/techniques/T1592/ T1592]
|
Gather Victim Host Information
|
Reconnaissance

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules|Reconnaissance and Access to Operating System Elements via PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1057/ T1057], 
[https://attack.mitre.org/techniques/T1083/ T1083], 
[https://attack.mitre.org/techniques/T1592.002/ T1592.002], 
[https://attack.mitre.org/techniques/T1046/ T1046], 
[https://attack.mitre.org/techniques/T1012/ T1012], 
[https://attack.mitre.org/techniques/T1007/ T1007], 
[https://attack.mitre.org/techniques/T1047/ T1047], 
[https://attack.mitre.org/techniques/T1592/ T1592], 
[https://attack.mitre.org/techniques/T1518/ T1518]
|
Process Discovery, 
File and Directory Discovery, 
Software, 
Network Service Scanning, 
Query Registry, 
System Service Discovery, 
Windows Management Instrumentation, 
Gather Victim Host Information, 
Software Discovery
|
Discovery, 
Discovery, 
Reconnaissance, 
Discovery, 
Discovery, 
Discovery, 
Execution, 
Reconnaissance, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules|Reconnaissance and Access to Processes and Services via Mimikatz modules]]

|
[https://attack.mitre.org/techniques/T1007/ T1007], 
[https://attack.mitre.org/techniques/T1046/ T1046], 
[https://attack.mitre.org/techniques/T1057/ T1057]
|
System Service Discovery, 
Network Service Scanning, 
Process Discovery
|
Discovery, 
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_shared_resources_via_mimikatz_modules|Reconnaissance and Access to Shared Resources via Mimikatz modules]]

|
[https://attack.mitre.org/techniques/T1021/ T1021], 
[https://attack.mitre.org/techniques/T1039/ T1039], 
[https://attack.mitre.org/techniques/T1135/ T1135], 
[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
|
Remote Services, 
Data from Network Shared Drive, 
Network Share Discovery, 
SMB/Windows Admin Shares
|
Lateral Movement, 
Collection, 
Discovery, 
Lateral Movement

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_shared_resources_via_powersploit_modules|Reconnaissance and Access to Shared Resources via PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1021/ T1021], 
[https://attack.mitre.org/techniques/T1039/ T1039], 
[https://attack.mitre.org/techniques/T1135/ T1135], 
[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
|
Remote Services, 
Data from Network Shared Drive, 
Network Share Discovery, 
SMB/Windows Admin Shares
|
Lateral Movement, 
Collection, 
Discovery, 
Lateral Movement

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules|Reconnaissance of Access and Persistence Opportunities via PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1053/ T1053], 
[https://attack.mitre.org/techniques/T1068/ T1068], 
[https://attack.mitre.org/techniques/T1078/ T1078], 
[https://attack.mitre.org/techniques/T1543/ T1543], 
[https://attack.mitre.org/techniques/T1547/ T1547], 
[https://attack.mitre.org/techniques/T1574/ T1574]
|
Scheduled Task/Job, 
Exploitation for Privilege Escalation, 
Valid Accounts, 
Create or Modify System Process, 
Boot or Logon Autostart Execution, 
Hijack Execution Flow
|
Execution, Persistence, Privilege Escalation, 
Privilege Escalation, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Reconnaissance_of_connectivity_via_powersploit_modules|Reconnaissance of Connectivity via PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1021/ T1021], 
[https://attack.mitre.org/techniques/T1039/ T1039], 
[https://attack.mitre.org/techniques/T1135/ T1135], 
[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
|
Remote Services, 
Data from Network Shared Drive, 
Network Share Discovery, 
SMB/Windows Admin Shares
|
Lateral Movement, 
Collection, 
Discovery, 
Lateral Movement

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Reconnaissance_of_credential_stores_and_services_via_mimikatz_modules|Reconnaissance of Credential Stores and Services via Mimikatz modules]]

|
[https://attack.mitre.org/techniques/T1098/ T1098], 
[https://attack.mitre.org/techniques/T1590.001/ T1590.001], 
[https://attack.mitre.org/techniques/T1078/ T1078], 
[https://attack.mitre.org/techniques/T1589.001/ T1589.001], 
[https://attack.mitre.org/techniques/T1590/ T1590], 
[https://attack.mitre.org/techniques/T1068/ T1068], 
[https://attack.mitre.org/techniques/T1589/ T1589], 
[https://attack.mitre.org/techniques/T1590.003/ T1590.003]
|
Account Manipulation, 
Domain Properties, 
Valid Accounts, 
Credentials, 
Gather Victim Network Information, 
Exploitation for Privilege Escalation, 
Gather Victim Identity Information, 
Network Trust Dependencies
|
Persistence, 
Reconnaissance, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Reconnaissance, 
Reconnaissance, 
Privilege Escalation, 
Reconnaissance, 
Reconnaissance

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Reconnaissance_of_defensive_tools_via_powersploit_modules|Reconnaissance of Defensive Tools via PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1592.002/ T1592.002], 
[https://attack.mitre.org/techniques/T1595.002/ T1595.002], 
[https://attack.mitre.org/techniques/T1592/ T1592], 
[https://attack.mitre.org/techniques/T1595/ T1595]
|
Software, 
Vulnerability Scanning, 
Gather Victim Host Information, 
Active Scanning
|
Reconnaissance, 
Reconnaissance, 
Reconnaissance, 
Reconnaissance

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules|Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1068/ T1068], 
[https://attack.mitre.org/techniques/T1078/ T1078], 
[https://attack.mitre.org/techniques/T1098/ T1098]
|
Exploitation for Privilege Escalation, 
Valid Accounts, 
Account Manipulation
|
Privilege Escalation, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules|Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules]]

|
[https://attack.mitre.org/techniques/T1543/ T1543], 
[https://attack.mitre.org/techniques/T1055/ T1055], 
[https://attack.mitre.org/techniques/T1574/ T1574]
|
Create or Modify System Process, 
Process Injection, 
Hijack Execution Flow
|
Persistence, Privilege Escalation, 
Defense Evasion, Privilege Escalation, 
Persistence, Privilege Escalation, Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives


====Reference====

* https://attack.mitre.org/tactics/TA0007/

* https://cyberd.us/penetration-testing

* https://attack.mitre.org/software/S0521/


''version'': 1
</div>
</div>

----

===Windows log manipulation===
Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2017-09-12
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Deleting_shadow_copies|Deleting Shadow Copies]]

|
[https://attack.mitre.org/techniques/T1490/ T1490]
|
Inhibit System Recovery
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Illegal_deletion_of_logs_via_mimikatz_modules|Illegal Deletion of Logs via Mimikatz modules]]

|
[https://attack.mitre.org/techniques/T1070/ T1070]
|
Indicator Removal on Host
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_event_log_service_behavior|Suspicious Event Log Service Behavior]]

|
[https://attack.mitre.org/techniques/T1070/ T1070], 
[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
|
Indicator Removal on Host, 
Clear Windows Event Logs
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_wevtutil_usage|Suspicious wevtutil Usage]]

|
[https://attack.mitre.org/techniques/T1070.001/ T1070.001], 
[https://attack.mitre.org/techniques/T1070/ T1070]
|
Clear Windows Event Logs, 
Indicator Removal on Host
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Usn_journal_deletion|USN Journal Deletion]]

|
[https://attack.mitre.org/techniques/T1070/ T1070]
|
Indicator Removal on Host
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_clear_logs|WevtUtil Usage To Clear Logs]]

|
[https://attack.mitre.org/techniques/T1070/ T1070], 
[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
|
Indicator Removal on Host, 
Clear Windows Event Logs
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_disable_logs|Wevtutil Usage To Disable Logs]]

|
[https://attack.mitre.org/techniques/T1070/ T1070], 
[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
|
Indicator Removal on Host, 
Clear Windows Event Logs
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Windows_event_log_cleared|Windows Event Log Cleared]]

|
[https://attack.mitre.org/techniques/T1070/ T1070], 
[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
|
Indicator Removal on Host, 
Clear Windows Event Logs
|
Defense Evasion, 
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation


====Reference====

* https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/

* https://zeltser.com/security-incident-log-review-checklist/

* http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html


''version'': 2
</div>
</div>

----

===Windows persistence techniques===
Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2018-05-31
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Active_setup_registry_autostart|Active Setup Registry Autostart]]

|
[https://attack.mitre.org/techniques/T1547.014/ T1547.014], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Active Setup, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Certutil_exe_certificate_extraction|Certutil exe certificate extraction]]

|
|
|

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Change_default_file_association|Change Default File Association]]

|
[https://attack.mitre.org/techniques/T1546.001/ T1546.001], 
[https://attack.mitre.org/techniques/T1546/ T1546]
|
Change Default File Association, 
Event Triggered Execution
|
Privilege Escalation, Persistence, 
Privilege Escalation, Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_path_interception_by_creation_of_program_exe|Detect Path Interception By Creation Of program exe]]

|
[https://attack.mitre.org/techniques/T1574.009/ T1574.009], 
[https://attack.mitre.org/techniques/T1574/ T1574]
|
Path Interception by Unquoted Path, 
Hijack Execution Flow
|
Persistence, Privilege Escalation, Defense Evasion, 
Persistence, Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Etw_registry_disabled|ETW Registry Disabled]]

|
[https://attack.mitre.org/techniques/T1562.006/ T1562.006], 
[https://attack.mitre.org/techniques/T1127/ T1127], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Indicator Blocking, 
Trusted Developer Utilities Proxy Execution, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Hiding_files_and_directories_with_attrib_exe|Hiding Files And Directories With Attrib exe]]

|
[https://attack.mitre.org/techniques/T1222/ T1222], 
[https://attack.mitre.org/techniques/T1222.001/ T1222.001]
|
File and Directory Permissions Modification, 
Windows File and Directory Permissions Modification
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Illegal_account_creation_via_powersploit_modules|Illegal Account Creation via PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1585/ T1585]
|
Establish Accounts
|
Resource Development

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules|Illegal Enabling or Disabling of Accounts via DSInternals modules]]

|
[https://attack.mitre.org/techniques/T1078/ T1078], 
[https://attack.mitre.org/techniques/T1098/ T1098]
|
Valid Accounts, 
Account Manipulation
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules|Illegal Management of Active Directory Elements and Policies via DSInternals modules]]

|
[https://attack.mitre.org/techniques/T1098/ T1098], 
[https://attack.mitre.org/techniques/T1207/ T1207], 
[https://attack.mitre.org/techniques/T1484/ T1484]
|
Account Manipulation, 
Rogue Domain Controller, 
Domain Policy Modification
|
Persistence, 
Defense Evasion, 
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules|Illegal Management of Computers and Active Directory Elements via PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1098/ T1098], 
[https://attack.mitre.org/techniques/T1207/ T1207], 
[https://attack.mitre.org/techniques/T1484/ T1484]
|
Account Manipulation, 
Rogue Domain Controller, 
Domain Policy Modification
|
Persistence, 
Defense Evasion, 
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Illegal_privilege_elevation_and_persistence_via_powersploit_modules|Illegal Privilege Elevation and Persistence via PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1053/ T1053], 
[https://attack.mitre.org/techniques/T1134/ T1134], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Scheduled Task/Job, 
Access Token Manipulation, 
Abuse Elevation Control Mechanism
|
Execution, Persistence, Privilege Escalation, 
Defense Evasion, Privilege Escalation, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Logon_script_event_trigger_execution|Logon Script Event Trigger Execution]]

|
[https://attack.mitre.org/techniques/T1037/ T1037], 
[https://attack.mitre.org/techniques/T1037.001/ T1037.001]
|
Boot or Logon Initialization Scripts, 
Logon Script (Windows)
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Monitor_registry_keys_for_print_monitors|Monitor Registry Keys for Print Monitors]]

|
[https://attack.mitre.org/techniques/T1547.010/ T1547.010], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Port Monitors, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Print_processor_registry_autostart|Print Processor Registry Autostart]]

|
[https://attack.mitre.org/techniques/T1547.012/ T1547.012], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Print Processors, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Reg_exe_manipulating_windows_services_registry_keys|Reg exe Manipulating Windows Services Registry Keys]]

|
[https://attack.mitre.org/techniques/T1574.011/ T1574.011], 
[https://attack.mitre.org/techniques/T1574/ T1574]
|
Services Registry Permissions Weakness, 
Hijack Execution Flow
|
Persistence, Privilege Escalation, Defense Evasion, 
Persistence, Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]

|
[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Registry Run Keys / Startup Folder, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Registry_keys_for_creating_shim_databases|Registry Keys for Creating SHIM Databases]]

|
[https://attack.mitre.org/techniques/T1546.011/ T1546.011], 
[https://attack.mitre.org/techniques/T1546/ T1546]
|
Application Shimming, 
Event Triggered Execution
|
Privilege Escalation, Persistence, 
Privilege Escalation, Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]

|
[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
[https://attack.mitre.org/techniques/T1543/ T1543]
|
Windows Service, 
Create or Modify System Process
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Schedule_task_with_http_command_arguments|Schedule Task with HTTP Command Arguments]]

|
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Schedule_task_with_rundll32_command_trigger|Schedule Task with Rundll32 Command Trigger]]

|
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Schtasks_used_for_forcing_a_reboot|Schtasks used for forcing a reboot]]

|
[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task, 
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation, 
Execution, Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Screensaver_event_trigger_execution|Screensaver Event Trigger Execution]]

|
[https://attack.mitre.org/techniques/T1546/ T1546], 
[https://attack.mitre.org/techniques/T1546.002/ T1546.002]
|
Event Triggered Execution, 
Screensaver
|
Privilege Escalation, Persistence, 
Privilege Escalation, Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Setting_credentials_via_dsinternals_modules|Setting Credentials via DSInternals modules]]

|
[https://attack.mitre.org/techniques/T1068/ T1068], 
[https://attack.mitre.org/techniques/T1078/ T1078], 
[https://attack.mitre.org/techniques/T1098/ T1098]
|
Exploitation for Privilege Escalation, 
Valid Accounts, 
Account Manipulation
|
Privilege Escalation, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Setting_credentials_via_mimikatz_modules|Setting Credentials via Mimikatz modules]]

|
[https://attack.mitre.org/techniques/T1068/ T1068], 
[https://attack.mitre.org/techniques/T1078/ T1078], 
[https://attack.mitre.org/techniques/T1098/ T1098]
|
Exploitation for Privilege Escalation, 
Valid Accounts, 
Account Manipulation
|
Privilege Escalation, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Setting_credentials_via_powersploit_modules|Setting Credentials via PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1068/ T1068], 
[https://attack.mitre.org/techniques/T1078/ T1078], 
[https://attack.mitre.org/techniques/T1098/ T1098]
|
Exploitation for Privilege Escalation, 
Valid Accounts, 
Account Manipulation
|
Privilege Escalation, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Shim_database_file_creation|Shim Database File Creation]]

|
[https://attack.mitre.org/techniques/T1546.011/ T1546.011], 
[https://attack.mitre.org/techniques/T1546/ T1546]
|
Application Shimming, 
Event Triggered Execution
|
Privilege Escalation, Persistence, 
Privilege Escalation, Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Shim_database_installation_with_suspicious_parameters|Shim Database Installation With Suspicious Parameters]]

|
[https://attack.mitre.org/techniques/T1546.011/ T1546.011], 
[https://attack.mitre.org/techniques/T1546/ T1546]
|
Application Shimming, 
Event Triggered Execution
|
Privilege Escalation, Persistence, 
Privilege Escalation, Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_scheduled_task_from_public_directory|Suspicious Scheduled Task from Public Directory]]

|
[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task, 
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation, 
Execution, Persistence, Privilege Escalation

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Time_provider_persistence_registry|Time Provider Persistence Registry]]

|
[https://attack.mitre.org/techniques/T1547.003/ T1547.003], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Time Providers, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_within_public_path|WinEvent Scheduled Task Created Within Public Path]]

|
[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task, 
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation, 
Execution, Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_to_spawn_shell|WinEvent Scheduled Task Created to Spawn Shell]]

|
[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task, 
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation, 
Execution, Persistence, Privilege Escalation

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation

* Installation

* Privilege Escalation


====Reference====

* http://www.fuzzysecurity.com/tutorials/19.html

* https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html

* http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/

* https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html

* https://www.youtube.com/watch?v=dq2Hv7J9fvk


''version'': 2
</div>
</div>

----

===Windows privilege escalation===
Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2020-02-04
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Active_setup_registry_autostart|Active Setup Registry Autostart]]

|
[https://attack.mitre.org/techniques/T1547.014/ T1547.014], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Active Setup, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Change_default_file_association|Change Default File Association]]

|
[https://attack.mitre.org/techniques/T1546.001/ T1546.001], 
[https://attack.mitre.org/techniques/T1546/ T1546]
|
Change Default File Association, 
Event Triggered Execution
|
Privilege Escalation, Persistence, 
Privilege Escalation, Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Child_processes_of_spoolsv_exe|Child Processes of Spoolsv exe]]

|
[https://attack.mitre.org/techniques/T1068/ T1068]
|
Exploitation for Privilege Escalation
|
Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Etw_registry_disabled|ETW Registry Disabled]]

|
[https://attack.mitre.org/techniques/T1562.006/ T1562.006], 
[https://attack.mitre.org/techniques/T1127/ T1127], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Indicator Blocking, 
Trusted Developer Utilities Proxy Execution, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Illegal_privilege_elevation_via_mimikatz_modules|Illegal Privilege Elevation via Mimikatz modules]]

|
[https://attack.mitre.org/techniques/T1134/ T1134], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Access Token Manipulation, 
Abuse Elevation Control Mechanism
|
Defense Evasion, Privilege Escalation, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Logon_script_event_trigger_execution|Logon Script Event Trigger Execution]]

|
[https://attack.mitre.org/techniques/T1037/ T1037], 
[https://attack.mitre.org/techniques/T1037.001/ T1037.001]
|
Boot or Logon Initialization Scripts, 
Logon Script (Windows)
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Overwriting_accessibility_binaries|Overwriting Accessibility Binaries]]

|
[https://attack.mitre.org/techniques/T1546/ T1546], 
[https://attack.mitre.org/techniques/T1546.008/ T1546.008]
|
Event Triggered Execution, 
Accessibility Features
|
Privilege Escalation, Persistence, 
Privilege Escalation, Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Print_processor_registry_autostart|Print Processor Registry Autostart]]

|
[https://attack.mitre.org/techniques/T1547.012/ T1547.012], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Print Processors, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Probing_access_with_stolen_credentials_via_powersploit_modules|Probing Access with Stolen Credentials via PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1078/ T1078], 
[https://attack.mitre.org/techniques/T1098/ T1098]
|
Valid Accounts, 
Account Manipulation
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_privilege_escalation|Registry Keys Used For Privilege Escalation]]

|
[https://attack.mitre.org/techniques/T1546.012/ T1546.012], 
[https://attack.mitre.org/techniques/T1546/ T1546]
|
Image File Execution Options Injection, 
Event Triggered Execution
|
Privilege Escalation, Persistence, 
Privilege Escalation, Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Screensaver_event_trigger_execution|Screensaver Event Trigger Execution]]

|
[https://attack.mitre.org/techniques/T1546/ T1546], 
[https://attack.mitre.org/techniques/T1546.002/ T1546.002]
|
Event Triggered Execution, 
Screensaver
|
Privilege Escalation, Persistence, 
Privilege Escalation, Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Time_provider_persistence_registry|Time Provider Persistence Registry]]

|
[https://attack.mitre.org/techniques/T1547.003/ T1547.003], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Time Providers, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation


====Reference====

* https://attack.mitre.org/tactics/TA0004/


''version'': 2
</div>
</div>

----



==Best Practices==


===Asset tracking===
Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/NetworkSessions Network_Sessions]
* '''Last Updated''': 2017-09-13
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_unauthorized_assets_by_mac_address|Detect Unauthorized Assets by MAC address]]

|
|
|

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Delivery

* Reconnaissance


====Reference====

* https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/


''version'': 1
</div>
</div>

----

===Monitor for updates===
Monitor your enterprise to ensure that your endpoints are being patched and updated. Adversaries notoriously exploit known vulnerabilities that could be mitigated by applying routine security patches.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Updates Updates]
* '''Last Updated''': 2017-09-15
* '''Use Case''': Compliance

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#No_windows_updates_in_a_time_frame|No Windows Updates in a time frame]]

|
|
|

| Hunting
|}

====Kill Chain Phase====


====Reference====

* https://learn.cisecurity.org/20-controls-download


''version'': 1
</div>
</div>

----

===Prohibited traffic allowed or protocol mismatch===
Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint], [https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution Network_Resolution], [https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic Network_Traffic]
* '''Last Updated''': 2017-09-11
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Allow_inbound_traffic_by_firewall_rule_registry|Allow Inbound Traffic By Firewall Rule Registry]]

|
[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
[https://attack.mitre.org/techniques/T1021/ T1021]
|
Remote Desktop Protocol, 
Remote Services
|
Lateral Movement, 
Lateral Movement

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Allow_inbound_traffic_in_firewall_rule|Allow Inbound Traffic In Firewall Rule]]

|
[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
[https://attack.mitre.org/techniques/T1021/ T1021]
|
Remote Desktop Protocol, 
Remote Services
|
Lateral Movement, 
Lateral Movement

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_hosts_connecting_to_dynamic_domain_providers|Detect hosts connecting to dynamic domain providers]]

|
[https://attack.mitre.org/techniques/T1189/ T1189]
|
Drive-by Compromise
|
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Enable_rdp_in_other_port_number|Enable RDP In Other Port Number]]

|
[https://attack.mitre.org/techniques/T1021/ T1021]
|
Remote Services
|
Lateral Movement

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Prohibited_network_traffic_allowed|Prohibited Network Traffic Allowed]]

|
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Alternative Protocol
|
Exfiltration

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Protocol_or_port_mismatch|Protocol or Port Mismatch]]

|
[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
Exfiltration Over Alternative Protocol
|
Exfiltration, 
Exfiltration

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Tor_traffic|TOR Traffic]]

|
[https://attack.mitre.org/techniques/T1071/ T1071], 
[https://attack.mitre.org/techniques/T1071.001/ T1071.001]
|
Application Layer Protocol, 
Web Protocols
|
Command And Control, 
Command And Control

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Command and Control

* Delivery

* Exploitation


====Reference====

* http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/


''version'': 1
</div>
</div>

----

===Router and infrastructure security===
Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Authentication Authentication], [https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic Network_Traffic]
* '''Last Updated''': 2017-09-12
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_arp_poisoning|Detect ARP Poisoning]]

|
[https://attack.mitre.org/techniques/T1200/ T1200], 
[https://attack.mitre.org/techniques/T1498/ T1498], 
[https://attack.mitre.org/techniques/T1557/ T1557], 
[https://attack.mitre.org/techniques/T1557.002/ T1557.002]
|
Hardware Additions, 
Network Denial of Service, 
Adversary-in-the-Middle, 
ARP Cache Poisoning
|
Initial Access, 
Impact, 
Credential Access, Collection, 
Credential Access, Collection

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_ipv6_network_infrastructure_threats|Detect IPv6 Network Infrastructure Threats]]

|
[https://attack.mitre.org/techniques/T1200/ T1200], 
[https://attack.mitre.org/techniques/T1498/ T1498], 
[https://attack.mitre.org/techniques/T1557/ T1557], 
[https://attack.mitre.org/techniques/T1557.002/ T1557.002]
|
Hardware Additions, 
Network Denial of Service, 
Adversary-in-the-Middle, 
ARP Cache Poisoning
|
Initial Access, 
Impact, 
Credential Access, Collection, 
Credential Access, Collection

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_new_login_attempts_to_routers|Detect New Login Attempts to Routers]]

|
|
|

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_port_security_violation|Detect Port Security Violation]]

|
[https://attack.mitre.org/techniques/T1200/ T1200], 
[https://attack.mitre.org/techniques/T1498/ T1498], 
[https://attack.mitre.org/techniques/T1557/ T1557], 
[https://attack.mitre.org/techniques/T1557.002/ T1557.002]
|
Hardware Additions, 
Network Denial of Service, 
Adversary-in-the-Middle, 
ARP Cache Poisoning
|
Initial Access, 
Impact, 
Credential Access, Collection, 
Credential Access, Collection

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_rogue_dhcp_server|Detect Rogue DHCP Server]]

|
[https://attack.mitre.org/techniques/T1200/ T1200], 
[https://attack.mitre.org/techniques/T1498/ T1498], 
[https://attack.mitre.org/techniques/T1557/ T1557]
|
Hardware Additions, 
Network Denial of Service, 
Adversary-in-the-Middle
|
Initial Access, 
Impact, 
Credential Access, Collection

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_software_download_to_network_device|Detect Software Download To Network Device]]

|
[https://attack.mitre.org/techniques/T1542.005/ T1542.005], 
[https://attack.mitre.org/techniques/T1542/ T1542]
|
TFTP Boot, 
Pre-OS Boot
|
Defense Evasion, Persistence, 
Defense Evasion, Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_traffic_mirroring|Detect Traffic Mirroring]]

|
[https://attack.mitre.org/techniques/T1200/ T1200], 
[https://attack.mitre.org/techniques/T1020/ T1020], 
[https://attack.mitre.org/techniques/T1498/ T1498], 
[https://attack.mitre.org/techniques/T1020.001/ T1020.001]
|
Hardware Additions, 
Automated Exfiltration, 
Network Denial of Service, 
Traffic Duplication
|
Initial Access, 
Exfiltration, 
Impact, 
Exfiltration

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Delivery

* Exploitation

* Reconnaissance


====Reference====

* https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html

* https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html


''version'': 1
</div>
</div>

----

===Use of cleartext protocols===
Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic Network_Traffic]
* '''Last Updated''': 2017-09-15
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Protocols_passing_authentication_in_cleartext|Protocols passing authentication in cleartext]]

|
|
|

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Reconnaissance


====Reference====

* https://www.monkey.org/~dugsong/dsniff/


''version'': 1
</div>
</div>

----



==Cloud Security==


===Aws cross account activity===
Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2018-06-04
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Aws_detect_attach_to_role_policy|aws detect attach to role policy]]

|
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Aws_detect_permanent_key_creation|aws detect permanent key creation]]

|
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Aws_detect_role_creation|aws detect role creation]]

|
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Aws_detect_sts_assume_role_abuse|aws detect sts assume role abuse]]

|
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Aws_detect_sts_get_session_token_abuse|aws detect sts get session token abuse]]

|
[https://attack.mitre.org/techniques/T1550/ T1550]
|
Use Alternate Authentication Material
|
Defense Evasion, Lateral Movement

| Hunting
|}

====Kill Chain Phase====

* Lateral Movement


====Reference====

* https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/


''version'': 1
</div>
</div>

----

===Aws iam privilege escalation===
This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation.

* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2021-03-08
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Aws_create_policy_version_to_allow_all_resources|AWS Create Policy Version to allow all resources]]

|
[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Cloud Accounts, 
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Aws_createaccesskey|AWS CreateAccessKey]]

|
[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
[https://attack.mitre.org/techniques/T1136/ T1136]
|
Cloud Account, 
Create Account
|
Persistence, 
Persistence

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Aws_createloginprofile|AWS CreateLoginProfile]]

|
[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
[https://attack.mitre.org/techniques/T1136/ T1136]
|
Cloud Account, 
Create Account
|
Persistence, 
Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Aws_iam_assume_role_policy_brute_force|AWS IAM Assume Role Policy Brute Force]]

|
[https://attack.mitre.org/techniques/T1580/ T1580], 
[https://attack.mitre.org/techniques/T1110/ T1110]
|
Cloud Infrastructure Discovery, 
Brute Force
|
Discovery, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Aws_iam_delete_policy|AWS IAM Delete Policy]]

|
[https://attack.mitre.org/techniques/T1098/ T1098]
|
Account Manipulation
|
Persistence

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Aws_iam_failure_group_deletion|AWS IAM Failure Group Deletion]]

|
[https://attack.mitre.org/techniques/T1098/ T1098]
|
Account Manipulation
|
Persistence

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Aws_iam_successful_group_deletion|AWS IAM Successful Group Deletion]]

|
[https://attack.mitre.org/techniques/T1069.003/ T1069.003], 
[https://attack.mitre.org/techniques/T1098/ T1098], 
[https://attack.mitre.org/techniques/T1069/ T1069]
|
Cloud Groups, 
Account Manipulation, 
Permission Groups Discovery
|
Discovery, 
Persistence, 
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Aws_setdefaultpolicyversion|AWS SetDefaultPolicyVersion]]

|
[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Cloud Accounts, 
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Aws_updateloginprofile|AWS UpdateLoginProfile]]

|
[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
[https://attack.mitre.org/techniques/T1136/ T1136]
|
Cloud Account, 
Create Account
|
Persistence, 
Persistence

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Reconnaissance


====Reference====

* https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/

* https://www.cyberark.com/resources/threat-research-blog/the-cloud-shadow-admin-threat-10-permissions-to-protect

* https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws


''version'': 1
</div>
</div>

----

===Aws network acl activity===
Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.

* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2018-05-21
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Aws_network_access_control_list_created_with_all_open_ports|AWS Network Access Control List Created with All Open Ports]]

|
[https://attack.mitre.org/techniques/T1562.007/ T1562.007], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Cloud Firewall, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Aws_network_access_control_list_deleted|AWS Network Access Control List Deleted]]

|
[https://attack.mitre.org/techniques/T1562.007/ T1562.007], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Cloud Firewall, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Detect_spike_in_blocked_outbound_traffic_from_your_aws|Detect Spike in blocked Outbound Traffic from your AWS]]

|
|
|

| Anomaly
|}

====Kill Chain Phase====

* Actions on Objectives

* Command and Control


====Reference====

* https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html

* https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/


''version'': 2
</div>
</div>

----

===Aws security hub alerts===
This story is focused around detecting Security Hub alerts generated from AWS

* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2020-08-04
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_spike_in_aws_security_hub_alerts_for_ec2_instance|Detect Spike in AWS Security Hub Alerts for EC2 Instance]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Detect_spike_in_aws_security_hub_alerts_for_user|Detect Spike in AWS Security Hub Alerts for User]]

|
|
|

| Anomaly
|}

====Kill Chain Phase====


====Reference====

* https://aws.amazon.com/security-hub/features/


''version'': 1
</div>
</div>

----

===Aws user monitoring===
Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2018-03-12
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Aws_excessive_security_scanning|AWS Excessive Security Scanning]]

|
[https://attack.mitre.org/techniques/T1526/ T1526]
|
Cloud Service Discovery
|
Discovery

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives


====Reference====

* https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf

* https://redlock.io/blog/cryptojacking-tesla


''version'': 1
</div>
</div>

----

===Cloud cryptomining===
Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.

* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Change Change]
* '''Last Updated''': 2019-10-02
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_instances_launched|Abnormally High Number Of Cloud Instances Launched]]

|
[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Cloud Accounts, 
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Cloud_compute_instance_created_by_previously_unseen_user|Cloud Compute Instance Created By Previously Unseen User]]

|
[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Cloud Accounts, 
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Cloud_compute_instance_created_in_previously_unused_region|Cloud Compute Instance Created In Previously Unused Region]]

|
[https://attack.mitre.org/techniques/T1535/ T1535]
|
Unused/Unsupported Cloud Regions
|
Defense Evasion

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Cloud_compute_instance_created_with_previously_unseen_image|Cloud Compute Instance Created With Previously Unseen Image]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Cloud_compute_instance_created_with_previously_unseen_instance_type|Cloud Compute Instance Created With Previously Unseen Instance Type]]

|
|
|

| Anomaly
|}

====Kill Chain Phase====

* Actions on Objectives


====Reference====

* https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf


''version'': 1
</div>
</div>

----

===Cloud federated credential abuse===
This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements.

* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-01-26
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Aws_saml_access_by_provider_user_and_principal|AWS SAML Access by Provider User and Principal]]

|
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Aws_saml_update_identity_provider|AWS SAML Update identity provider]]

|
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Certutil_exe_certificate_extraction|Certutil exe certificate extraction]]

|
|
|

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_mimikatz_using_loaded_images|Detect Mimikatz Using Loaded Images]]

|
[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
LSASS Memory, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_rare_executables|Detect Rare Executables]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#O365_add_app_role_assignment_grant_user|O365 Add App Role Assignment Grant User]]

|
[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
[https://attack.mitre.org/techniques/T1136/ T1136]
|
Cloud Account, 
Create Account
|
Persistence, 
Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#O365_added_service_principal|O365 Added Service Principal]]

|
[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
[https://attack.mitre.org/techniques/T1136/ T1136]
|
Cloud Account, 
Create Account
|
Persistence, 
Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#O365_excessive_sso_logon_errors|O365 Excessive SSO logon errors]]

|
[https://attack.mitre.org/techniques/T1556/ T1556]
|
Modify Authentication Process
|
Credential Access, Defense Evasion, Persistence

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#O365_new_federated_domain_added|O365 New Federated Domain Added]]

|
[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
[https://attack.mitre.org/techniques/T1136/ T1136]
|
Cloud Account, 
Create Account
|
Persistence, 
Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_privilege_escalation|Registry Keys Used For Privilege Escalation]]

|
[https://attack.mitre.org/techniques/T1546.012/ T1546.012], 
[https://attack.mitre.org/techniques/T1546/ T1546]
|
Image File Execution Options Injection, 
Event Triggered Execution
|
Privilege Escalation, Persistence, 
Privilege Escalation, Persistence

| TTP
|}

====Kill Chain Phase====

* Actions on Objective

* Actions on Objectives

* Command and Control

* Installation


====Reference====

* https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

* https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf

* https://us-cert.cisa.gov/ncas/alerts/aa21-008a


''version'': 1
</div>
</div>

----

===Container implantation monitoring and investigation===
Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company's repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2020-02-20
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#New_container_uploaded_to_aws_ecr|New container uploaded to AWS ECR]]

|
[https://attack.mitre.org/techniques/T1525/ T1525]
|
Implant Internal Image
|
Persistence

| Hunting
|}

====Kill Chain Phase====


====Reference====

* https://github.com/splunk/cloud-datamodel-security-research


''version'': 1
</div>
</div>

----

===Dev sec ops===
This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Dev Sec Ops Analytics
* '''Datamodel''':
* '''Last Updated''': 2021-08-18
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_scanning_findings_high|AWS ECR Container Scanning Findings High]]

|
[https://attack.mitre.org/techniques/T1204.003/ T1204.003], 
[https://attack.mitre.org/techniques/T1204/ T1204]
|
Malicious Image, 
User Execution
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_scanning_findings_low_informational_unknown|AWS ECR Container Scanning Findings Low Informational Unknown]]

|
[https://attack.mitre.org/techniques/T1204.003/ T1204.003], 
[https://attack.mitre.org/techniques/T1204/ T1204]
|
Malicious Image, 
User Execution
|
Execution, 
Execution

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_scanning_findings_medium|AWS ECR Container Scanning Findings Medium]]

|
[https://attack.mitre.org/techniques/T1204.003/ T1204.003], 
[https://attack.mitre.org/techniques/T1204/ T1204]
|
Malicious Image, 
User Execution
|
Execution, 
Execution

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_upload_outside_business_hours|AWS ECR Container Upload Outside Business Hours]]

|
[https://attack.mitre.org/techniques/T1204.003/ T1204.003], 
[https://attack.mitre.org/techniques/T1204/ T1204]
|
Malicious Image, 
User Execution
|
Execution, 
Execution

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_upload_unknown_user|AWS ECR Container Upload Unknown User]]

|
[https://attack.mitre.org/techniques/T1204.003/ T1204.003], 
[https://attack.mitre.org/techniques/T1204/ T1204]
|
Malicious Image, 
User Execution
|
Execution, 
Execution

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Circle_ci_disable_security_job|Circle CI Disable Security Job]]

|
[https://attack.mitre.org/techniques/T1554/ T1554]
|
Compromise Client Software Binary
|
Persistence

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Circle_ci_disable_security_step|Circle CI Disable Security Step]]

|
[https://attack.mitre.org/techniques/T1554/ T1554]
|
Compromise Client Software Binary
|
Persistence

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Correlation_by_repository_and_risk|Correlation by Repository and Risk]]

|
[https://attack.mitre.org/techniques/T1204.003/ T1204.003], 
[https://attack.mitre.org/techniques/T1204/ T1204]
|
Malicious Image, 
User Execution
|
Execution, 
Execution

| Correlation
|-
| [[Documentation:ESSOC:detections:Detections#Correlation_by_user_and_risk|Correlation by User and Risk]]

|
[https://attack.mitre.org/techniques/T1204.003/ T1204.003], 
[https://attack.mitre.org/techniques/T1204/ T1204]
|
Malicious Image, 
User Execution
|
Execution, 
Execution

| Correlation
|-
| [[Documentation:ESSOC:detections:Detections#Gsuite_email_suspicious_attachment|GSuite Email Suspicious Attachment]]

|
[https://attack.mitre.org/techniques/T1566.001/ T1566.001], 
[https://attack.mitre.org/techniques/T1566/ T1566]
|
Spearphishing Attachment, 
Phishing
|
Initial Access, 
Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Github_dependabot_alert|GitHub Dependabot Alert]]

|
[https://attack.mitre.org/techniques/T1195.001/ T1195.001], 
[https://attack.mitre.org/techniques/T1195/ T1195]
|
Compromise Software Dependencies and Development Tools, 
Supply Chain Compromise
|
Initial Access, 
Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Github_pull_request_from_unknown_user|GitHub Pull Request from Unknown User]]

|
[https://attack.mitre.org/techniques/T1195.001/ T1195.001], 
[https://attack.mitre.org/techniques/T1195/ T1195]
|
Compromise Software Dependencies and Development Tools, 
Supply Chain Compromise
|
Initial Access, 
Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Github_commit_changes_in_master|Github Commit Changes In Master]]

|
[https://attack.mitre.org/techniques/T1199/ T1199]
|
Trusted Relationship
|
Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Github_commit_in_develop|Github Commit In Develop]]

|
[https://attack.mitre.org/techniques/T1199/ T1199]
|
Trusted Relationship
|
Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Gsuite_drive_share_in_external_email|Gsuite Drive Share In External Email]]

|
[https://attack.mitre.org/techniques/T1567.002/ T1567.002], 
[https://attack.mitre.org/techniques/T1567/ T1567]
|
Exfiltration to Cloud Storage, 
Exfiltration Over Web Service
|
Exfiltration, 
Exfiltration

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Gsuite_email_suspicious_subject_with_attachment|Gsuite Email Suspicious Subject With Attachment]]

|
[https://attack.mitre.org/techniques/T1566.001/ T1566.001], 
[https://attack.mitre.org/techniques/T1566/ T1566]
|
Spearphishing Attachment, 
Phishing
|
Initial Access, 
Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Gsuite_email_with_known_abuse_web_service_link|Gsuite Email With Known Abuse Web Service Link]]

|
[https://attack.mitre.org/techniques/T1566.001/ T1566.001], 
[https://attack.mitre.org/techniques/T1566/ T1566]
|
Spearphishing Attachment, 
Phishing
|
Initial Access, 
Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Gsuite_outbound_email_with_attachment_to_external_domain|Gsuite Outbound Email With Attachment To External Domain]]

|
[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
Exfiltration Over Alternative Protocol
|
Exfiltration, 
Exfiltration

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Gsuite_suspicious_shared_file_name|Gsuite Suspicious Shared File Name]]

|
[https://attack.mitre.org/techniques/T1566.001/ T1566.001], 
[https://attack.mitre.org/techniques/T1566/ T1566]
|
Spearphishing Attachment, 
Phishing
|
Initial Access, 
Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Kubernetes_nginx_ingress_lfi|Kubernetes Nginx Ingress LFI]]

|
[https://attack.mitre.org/techniques/T1212/ T1212]
|
Exploitation for Credential Access
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Kubernetes_nginx_ingress_rfi|Kubernetes Nginx Ingress RFI]]

|
[https://attack.mitre.org/techniques/T1212/ T1212]
|
Exploitation for Credential Access
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Kubernetes_scanner_image_pulling|Kubernetes Scanner Image Pulling]]

|
[https://attack.mitre.org/techniques/T1526/ T1526]
|
Cloud Service Discovery
|
Discovery

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exfiltration

* Exploitation


====Reference====

* https://www.redhat.com/en/topics/devops/what-is-devsecops


''version'': 1
</div>
</div>

----

===Gcp cross account activity===
Track when a user assumes an IAM role in another GCP account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2020-09-01
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Gcp_detect_gcploit_framework|GCP Detect gcploit framework]]

|
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| TTP
|}

====Kill Chain Phase====

* Lateral Movement


====Reference====

* https://cloud.google.com/iam/docs/understanding-service-accounts


''version'': 1
</div>
</div>

----

===Kubernetes scanning activity===
This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2020-04-15
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Amazon_eks_kubernetes_pod_scan_detection|Amazon EKS Kubernetes Pod scan detection]]

|
[https://attack.mitre.org/techniques/T1526/ T1526]
|
Cloud Service Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Amazon_eks_kubernetes_cluster_scan_detection|Amazon EKS Kubernetes cluster scan detection]]

|
[https://attack.mitre.org/techniques/T1526/ T1526]
|
Cloud Service Discovery
|
Discovery

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Gcp_kubernetes_cluster_pod_scan_detection|GCP Kubernetes cluster pod scan detection]]

|
[https://attack.mitre.org/techniques/T1526/ T1526]
|
Cloud Service Discovery
|
Discovery

| Hunting
|}

====Kill Chain Phase====

* Reconnaissance


====Reference====

* https://github.com/splunk/cloud-datamodel-security-research


''version'': 1
</div>
</div>

----

===Kubernetes sensitive object access activity===
This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2020-05-20
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Kubernetes_aws_detect_suspicious_kubectl_calls|Kubernetes AWS detect suspicious kubectl calls]]

|
|
|

| Hunting
|}

====Kill Chain Phase====

* Lateral Movement


====Reference====

* https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html


''version'': 1
</div>
</div>

----

===Office 365 detections===
This story is focused around detecting Office 365 Attacks.

* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2020-12-16
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#High_number_of_login_failures_from_a_single_source|High Number of Login Failures from a single source]]

|
[https://attack.mitre.org/techniques/T1110.001/ T1110.001], 
[https://attack.mitre.org/techniques/T1110/ T1110]
|
Password Guessing, 
Brute Force
|
Credential Access, 
Credential Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#O365_add_app_role_assignment_grant_user|O365 Add App Role Assignment Grant User]]

|
[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
[https://attack.mitre.org/techniques/T1136/ T1136]
|
Cloud Account, 
Create Account
|
Persistence, 
Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#O365_added_service_principal|O365 Added Service Principal]]

|
[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
[https://attack.mitre.org/techniques/T1136/ T1136]
|
Cloud Account, 
Create Account
|
Persistence, 
Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#O365_bypass_mfa_via_trusted_ip|O365 Bypass MFA via Trusted IP]]

|
[https://attack.mitre.org/techniques/T1562.007/ T1562.007], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Cloud Firewall, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#O365_disable_mfa|O365 Disable MFA]]

|
[https://attack.mitre.org/techniques/T1556/ T1556]
|
Modify Authentication Process
|
Credential Access, Defense Evasion, Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#O365_excessive_authentication_failures_alert|O365 Excessive Authentication Failures Alert]]

|
[https://attack.mitre.org/techniques/T1110/ T1110]
|
Brute Force
|
Credential Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#O365_excessive_sso_logon_errors|O365 Excessive SSO logon errors]]

|
[https://attack.mitre.org/techniques/T1556/ T1556]
|
Modify Authentication Process
|
Credential Access, Defense Evasion, Persistence

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#O365_new_federated_domain_added|O365 New Federated Domain Added]]

|
[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
[https://attack.mitre.org/techniques/T1136/ T1136]
|
Cloud Account, 
Create Account
|
Persistence, 
Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#O365_pst_export_alert|O365 PST export alert]]

|
[https://attack.mitre.org/techniques/T1114/ T1114]
|
Email Collection
|
Collection

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#O365_suspicious_admin_email_forwarding|O365 Suspicious Admin Email Forwarding]]

|
[https://attack.mitre.org/techniques/T1114.003/ T1114.003], 
[https://attack.mitre.org/techniques/T1114/ T1114]
|
Email Forwarding Rule, 
Email Collection
|
Collection, 
Collection

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#O365_suspicious_rights_delegation|O365 Suspicious Rights Delegation]]

|
[https://attack.mitre.org/techniques/T1114.002/ T1114.002], 
[https://attack.mitre.org/techniques/T1114/ T1114]
|
Remote Email Collection, 
Email Collection
|
Collection, 
Collection

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#O365_suspicious_user_email_forwarding|O365 Suspicious User Email Forwarding]]

|
[https://attack.mitre.org/techniques/T1114.003/ T1114.003], 
[https://attack.mitre.org/techniques/T1114/ T1114]
|
Email Forwarding Rule, 
Email Collection
|
Collection, 
Collection

| Anomaly
|}

====Kill Chain Phase====

* Actions on Objective

* Actions on Objectives

* Not Applicable


====Reference====

* https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf


''version'': 1
</div>
</div>

----

===Suspicious aws login activities===
Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. 

* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Authentication Authentication]
* '''Last Updated''': 2019-05-01
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_aws_console_login_by_user_from_new_city|Detect AWS Console Login by User from New City]]

|
[https://attack.mitre.org/techniques/T1535/ T1535]
|
Unused/Unsupported Cloud Regions
|
Defense Evasion

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Detect_aws_console_login_by_user_from_new_country|Detect AWS Console Login by User from New Country]]

|
[https://attack.mitre.org/techniques/T1535/ T1535]
|
Unused/Unsupported Cloud Regions
|
Defense Evasion

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Detect_aws_console_login_by_user_from_new_region|Detect AWS Console Login by User from New Region]]

|
[https://attack.mitre.org/techniques/T1535/ T1535]
|
Unused/Unsupported Cloud Regions
|
Defense Evasion

| Hunting
|}

====Kill Chain Phase====

* Actions on Objectives


====Reference====

* https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html


''version'': 1
</div>
</div>

----

===Suspicious aws s3 activities===
Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.

* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2018-07-24
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_new_open_s3_buckets_over_aws_cli|Detect New Open S3 Buckets over AWS CLI]]

|
[https://attack.mitre.org/techniques/T1530/ T1530]
|
Data from Cloud Storage Object
|
Collection

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_new_open_s3_buckets|Detect New Open S3 buckets]]

|
[https://attack.mitre.org/techniques/T1530/ T1530]
|
Data from Cloud Storage Object
|
Collection

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_s3_access_from_a_new_ip|Detect S3 access from a new IP]]

|
[https://attack.mitre.org/techniques/T1530/ T1530]
|
Data from Cloud Storage Object
|
Collection

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Detect_spike_in_s3_bucket_deletion|Detect Spike in S3 Bucket deletion]]

|
[https://attack.mitre.org/techniques/T1530/ T1530]
|
Data from Cloud Storage Object
|
Collection

| Anomaly
|}

====Kill Chain Phase====

* Actions on Objectives


====Reference====

* https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf

* https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/


''version'': 2
</div>
</div>

----

===Suspicious aws traffic===
Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC).

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2018-05-07
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_spike_in_blocked_outbound_traffic_from_your_aws|Detect Spike in blocked Outbound Traffic from your AWS]]

|
|
|

| Anomaly
|}

====Kill Chain Phase====

* Actions on Objectives

* Command and Control


====Reference====

* https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/


''version'': 1
</div>
</div>

----

===Suspicious cloud authentication activities===
Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. 

* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Authentication Authentication]
* '''Last Updated''': 2020-06-04
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Aws_cross_account_activity_from_previously_unseen_account|AWS Cross Account Activity From Previously Unseen Account]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Detect_aws_console_login_by_new_user|Detect AWS Console Login by New User]]

|
|
|

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Detect_aws_console_login_by_user_from_new_city|Detect AWS Console Login by User from New City]]

|
[https://attack.mitre.org/techniques/T1535/ T1535]
|
Unused/Unsupported Cloud Regions
|
Defense Evasion

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Detect_aws_console_login_by_user_from_new_country|Detect AWS Console Login by User from New Country]]

|
[https://attack.mitre.org/techniques/T1535/ T1535]
|
Unused/Unsupported Cloud Regions
|
Defense Evasion

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Detect_aws_console_login_by_user_from_new_region|Detect AWS Console Login by User from New Region]]

|
[https://attack.mitre.org/techniques/T1535/ T1535]
|
Unused/Unsupported Cloud Regions
|
Defense Evasion

| Hunting
|}

====Kill Chain Phase====

* Actions on Objectives


====Reference====

* https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/

* https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html


''version'': 1
</div>
</div>

----

===Suspicious cloud instance activities===
Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.

* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Change Change]
* '''Last Updated''': 2020-08-25
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_instances_destroyed|Abnormally High Number Of Cloud Instances Destroyed]]

|
[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Cloud Accounts, 
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_instances_launched|Abnormally High Number Of Cloud Instances Launched]]

|
[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Cloud Accounts, 
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Cloud_instance_modified_by_previously_unseen_user|Cloud Instance Modified By Previously Unseen User]]

|
[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Cloud Accounts, 
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Detect_shared_ec2_snapshot|Detect shared ec2 snapshot]]

|
[https://attack.mitre.org/techniques/T1537/ T1537]
|
Transfer Data to Cloud Account
|
Exfiltration

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives


====Reference====

* https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf


''version'': 1
</div>
</div>

----

===Suspicious cloud provisioning activities===
Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.

* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Change Change]
* '''Last Updated''': 2018-08-20
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Cloud_provisioning_activity_from_previously_unseen_city|Cloud Provisioning Activity From Previously Unseen City]]

|
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Cloud_provisioning_activity_from_previously_unseen_country|Cloud Provisioning Activity From Previously Unseen Country]]

|
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Cloud_provisioning_activity_from_previously_unseen_ip_address|Cloud Provisioning Activity From Previously Unseen IP Address]]

|
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Cloud_provisioning_activity_from_previously_unseen_region|Cloud Provisioning Activity From Previously Unseen Region]]

|
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Anomaly
|}

====Kill Chain Phase====


====Reference====

* https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf


''version'': 1
</div>
</div>

----

===Suspicious cloud user activities===
Detect and investigate suspicious activities by users and roles in your cloud environments.

* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Change Change]
* '''Last Updated''': 2020-09-04
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Aws_iam_accessdenied_discovery_events|AWS IAM AccessDenied Discovery Events]]

|
[https://attack.mitre.org/techniques/T1580/ T1580]
|
Cloud Infrastructure Discovery
|
Discovery

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_infrastructure_api_calls|Abnormally High Number Of Cloud Infrastructure API Calls]]

|
[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Cloud Accounts, 
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_security_group_api_calls|Abnormally High Number Of Cloud Security Group API Calls]]

|
[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Cloud Accounts, 
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Cloud_api_calls_from_previously_unseen_user_roles|Cloud API Calls From Previously Unseen User Roles]]

|
[https://attack.mitre.org/techniques/T1078/ T1078]
|
Valid Accounts
|
Defense Evasion, Persistence, Privilege Escalation, Initial Access

| Anomaly
|}

====Kill Chain Phase====

* Actions on Objectives

* Reconnaissance


====Reference====

* https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf

* https://redlock.io/blog/cryptojacking-tesla


''version'': 1
</div>
</div>

----

===Suspicious gcp storage activities===
Use the searches in this Analytic Story to monitor your GCP Storage buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open storage buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2020-08-05
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_gcp_storage_access_from_a_new_ip|Detect GCP Storage access from a new IP]]

|
[https://attack.mitre.org/techniques/T1530/ T1530]
|
Data from Cloud Storage Object
|
Collection

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Detect_new_open_gcp_storage_buckets|Detect New Open GCP Storage Buckets]]

|
[https://attack.mitre.org/techniques/T1530/ T1530]
|
Data from Cloud Storage Object
|
Collection

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives


====Reference====

* https://cloud.google.com/blog/product/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security

* https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/


''version'': 1
</div>
</div>

----



==Lateral Movement==


===Printnightmare cve-2021-34527===
The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-34527 previously known as (CVE-2021-1675), to gain privilege escalation on the vulnerable machine.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-07-01
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Print_spooler_adding_a_printer_driver|Print Spooler Adding A Printer Driver]]

|
[https://attack.mitre.org/techniques/T1547.012/ T1547.012], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Print Processors, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Print_spooler_failed_to_load_a_plug-in|Print Spooler Failed to Load a Plug-in]]

|
[https://attack.mitre.org/techniques/T1547.012/ T1547.012], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Print Processors, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Rundll32_with_no_command_line_arguments_with_network|Rundll32 with no Command Line Arguments with Network]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Spoolsv_spawning_rundll32|Spoolsv Spawning Rundll32]]

|
[https://attack.mitre.org/techniques/T1547.012/ T1547.012], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Print Processors, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Spoolsv_suspicious_loaded_modules|Spoolsv Suspicious Loaded Modules]]

|
[https://attack.mitre.org/techniques/T1547.012/ T1547.012], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Print Processors, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Spoolsv_suspicious_process_access|Spoolsv Suspicious Process Access]]

|
[https://attack.mitre.org/techniques/T1068/ T1068]
|
Exploitation for Privilege Escalation
|
Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Spoolsv_writing_a_dll|Spoolsv Writing a DLL]]

|
[https://attack.mitre.org/techniques/T1547.012/ T1547.012], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Print Processors, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Spoolsv_writing_a_dll_-_sysmon|Spoolsv Writing a DLL - Sysmon]]

|
[https://attack.mitre.org/techniques/T1547.012/ T1547.012], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Print Processors, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_no_command_line_arguments|Suspicious Rundll32 no Command Line Arguments]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation


====Reference====

* https://github.com/cube0x0/CVE-2021-1675/

* https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/

* https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/

* https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes


''version'': 1
</div>
</div>

----



==Malware==


===Blackmatter ransomware===
Leverage searches that allow you to detect and investigate unusual activities that might relate to the BlackMatter ransomware, including looking for file writes associated with BlackMatter, force safe mode boot, autadminlogon account registry modification and more.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-09-06
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Add_defaultuser_and_password_in_registry|Add DefaultUser And Password In Registry]]

|
[https://attack.mitre.org/techniques/T1552.002/ T1552.002], 
[https://attack.mitre.org/techniques/T1552/ T1552]
|
Credentials in Registry, 
Unsecured Credentials
|
Credential Access, 
Credential Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Auto_admin_logon_registry_entry|Auto Admin Logon Registry Entry]]

|
[https://attack.mitre.org/techniques/T1552.002/ T1552.002], 
[https://attack.mitre.org/techniques/T1552/ T1552]
|
Credentials in Registry, 
Unsecured Credentials
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Bcdedit_command_back_to_normal_mode_boot|Bcdedit Command Back To Normal Mode Boot]]

|
[https://attack.mitre.org/techniques/T1490/ T1490]
|
Inhibit System Recovery
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Change_to_safe_mode_with_network_config|Change To Safe Mode With Network Config]]

|
[https://attack.mitre.org/techniques/T1490/ T1490]
|
Inhibit System Recovery
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Known_services_killed_by_ransomware|Known Services Killed by Ransomware]]

|
[https://attack.mitre.org/techniques/T1490/ T1490]
|
Inhibit System Recovery
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Modification_of_wallpaper|Modification Of Wallpaper]]

|
[https://attack.mitre.org/techniques/T1491/ T1491]
|
Defacement
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Ransomware_notes_bulk_creation|Ransomware Notes bulk creation]]

|
[https://attack.mitre.org/techniques/T1486/ T1486]
|
Data Encrypted for Impact
|
Impact

| Anomaly
|}

====Kill Chain Phase====

* Exploitation

* Obfuscation


====Reference====

* https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/

* https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-gang-rises-from-the-ashes-of-darkside-revil/

* https://blog.malwarebytes.com/ransomware/2021/07/blackmatter-a-new-ransomware-group-claims-link-to-darkside-revil/


''version'': 1
</div>
</div>

----

===Clop ransomware===
Leverage searches that allow you to detect and investigate unusual activities that might relate to the Clop ransomware, including looking for file writes associated with Clope, encrypting network shares, deleting and resizing shadow volume storage, registry key modification, deleting of security logs, and more.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-03-17
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Clop_common_exec_parameter|Clop Common Exec Parameter]]

|
[https://attack.mitre.org/techniques/T1204/ T1204]
|
User Execution
|
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Clop_ransomware_known_service_name|Clop Ransomware Known Service Name]]

|
[https://attack.mitre.org/techniques/T1543/ T1543]
|
Create or Modify System Process
|
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Common_ransomware_extensions|Common Ransomware Extensions]]

|
[https://attack.mitre.org/techniques/T1485/ T1485]
|
Data Destruction
|
Impact

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Common_ransomware_notes|Common Ransomware Notes]]

|
[https://attack.mitre.org/techniques/T1485/ T1485]
|
Data Destruction
|
Impact

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Create_service_in_suspicious_file_path|Create Service In Suspicious File Path]]

|
[https://attack.mitre.org/techniques/T1569/ T1569], 
[https://attack.mitre.org/techniques/T1569.002/ T1569.002]
|
System Services, 
Service Execution
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Deleting_shadow_copies|Deleting Shadow Copies]]

|
[https://attack.mitre.org/techniques/T1490/ T1490]
|
Inhibit System Recovery
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#High_file_deletion_frequency|High File Deletion Frequency]]

|
[https://attack.mitre.org/techniques/T1485/ T1485]
|
Data Destruction
|
Impact

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#High_process_termination_frequency|High Process Termination Frequency]]

|
[https://attack.mitre.org/techniques/T1486/ T1486]
|
Data Encrypted for Impact
|
Impact

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Process_deleting_its_process_file_path|Process Deleting Its Process File Path]]

|
[https://attack.mitre.org/techniques/T1070/ T1070]
|
Indicator Removal on Host
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Ransomware_notes_bulk_creation|Ransomware Notes bulk creation]]

|
[https://attack.mitre.org/techniques/T1486/ T1486]
|
Data Encrypted for Impact
|
Impact

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Resize_shadowstorage_volume|Resize ShadowStorage volume]]

|
[https://attack.mitre.org/techniques/T1490/ T1490]
|
Inhibit System Recovery
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Resize_shadowstorage_volume|Resize Shadowstorage Volume]]

|
[https://attack.mitre.org/techniques/T1489/ T1489]
|
Service Stop
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_event_log_service_behavior|Suspicious Event Log Service Behavior]]

|
[https://attack.mitre.org/techniques/T1070/ T1070], 
[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
|
Indicator Removal on Host, 
Clear Windows Event Logs
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_wevtutil_usage|Suspicious wevtutil Usage]]

|
[https://attack.mitre.org/techniques/T1070.001/ T1070.001], 
[https://attack.mitre.org/techniques/T1070/ T1070]
|
Clear Windows Event Logs, 
Indicator Removal on Host
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_clear_logs|WevtUtil Usage To Clear Logs]]

|
[https://attack.mitre.org/techniques/T1070/ T1070], 
[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
|
Indicator Removal on Host, 
Clear Windows Event Logs
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Windows_event_log_cleared|Windows Event Log Cleared]]

|
[https://attack.mitre.org/techniques/T1070/ T1070], 
[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
|
Indicator Removal on Host, 
Clear Windows Event Logs
|
Defense Evasion, 
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation

* Obfuscation

* Privilege Escalation


====Reference====

* https://www.hhs.gov/sites/default/files/analyst-note-cl0p-tlp-white.pdf

* https://securityaffairs.co/wordpress/115250/data-breach/qualys-clop-ransomware.html

* https://www.darkreading.com/attacks-breaches/qualys-is-the-latest-victim-of-accellion-data-breach/d/d-id/1340323


''version'': 1
</div>
</div>

----

===Coldroot macos rat===
Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2019-01-09
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Processes_tapping_keyboard_events|Processes Tapping Keyboard Events]]

|
|
|

| TTP
|}

====Kill Chain Phase====

* Command and Control


====Reference====

* https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/

* https://objective-see.com/blog/blog_0x2A.html

* https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/


''version'': 1
</div>
</div>

----

===Dhs report ta18-074a===
Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint], [https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic Network_Traffic]
* '''Last Updated''': 2020-01-22
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Create_local_admin_accounts_using_net_exe|Create local admin accounts using net exe]]

|
[https://attack.mitre.org/techniques/T1136.001/ T1136.001], 
[https://attack.mitre.org/techniques/T1136/ T1136]
|
Local Account, 
Create Account
|
Persistence, 
Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_new_local_admin_account|Detect New Local Admin account]]

|
[https://attack.mitre.org/techniques/T1136.001/ T1136.001], 
[https://attack.mitre.org/techniques/T1136/ T1136]
|
Local Account, 
Create Account
|
Persistence, 
Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_outbound_smb_traffic|Detect Outbound SMB Traffic]]

|
[https://attack.mitre.org/techniques/T1071.002/ T1071.002], 
[https://attack.mitre.org/techniques/T1071/ T1071]
|
File Transfer Protocols, 
Application Layer Protocol
|
Command And Control, 
Command And Control

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]

|
[https://attack.mitre.org/techniques/T1021/ T1021], 
[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
|
Remote Services, 
SMB/Windows Admin Shares
|
Lateral Movement, 
Lateral Movement

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]

|
[https://attack.mitre.org/techniques/T1569/ T1569], 
[https://attack.mitre.org/techniques/T1569.002/ T1569.002]
|
System Services, 
Service Execution
|
Execution, 
Execution

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_execution_policy_bypass|Malicious PowerShell Process - Execution Policy Bypass]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
|
Command and Scripting Interpreter, 
PowerShell
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Processes_launching_netsh|Processes launching netsh]]

|
[https://attack.mitre.org/techniques/T1562.004/ T1562.004], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify System Firewall, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]

|
[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Registry Run Keys / Startup Folder, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike|SMB Traffic Spike]]

|
[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
[https://attack.mitre.org/techniques/T1021/ T1021]
|
SMB/Windows Admin Shares, 
Remote Services
|
Lateral Movement, 
Lateral Movement

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike_-_mltk|SMB Traffic Spike - MLTK]]

|
[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
[https://attack.mitre.org/techniques/T1021/ T1021]
|
SMB/Windows Admin Shares, 
Remote Services
|
Lateral Movement, 
Lateral Movement

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]

|
[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
[https://attack.mitre.org/techniques/T1543/ T1543]
|
Windows Service, 
Create or Modify System Process
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Scheduled_task_deleted_or_created_via_cmd|Scheduled Task Deleted Or Created via CMD]]

|
[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task, 
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation, 
Execution, Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Single_letter_process_on_endpoint|Single Letter Process On Endpoint]]

|
[https://attack.mitre.org/techniques/T1204/ T1204], 
[https://attack.mitre.org/techniques/T1204.002/ T1204.002]
|
User Execution, 
Malicious File
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_reg_exe_process|Suspicious Reg exe Process]]

|
[https://attack.mitre.org/techniques/T1112/ T1112]
|
Modify Registry
|
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Command and Control

* Execution

* Exploitation

* Installation

* Lateral Movement


====Reference====

* https://www.us-cert.gov/ncas/alerts/TA18-074A


''version'': 2
</div>
</div>

----

===Darkside ransomware===
Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-05-12
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Attempted_credential_dump_from_registry_via_reg_exe|Attempted Credential Dump From Registry via Reg exe]]

|
[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
Security Account Manager, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Bitsadmin_download_file|BITSAdmin Download File]]

|
[https://attack.mitre.org/techniques/T1197/ T1197], 
[https://attack.mitre.org/techniques/T1105/ T1105]
|
BITS Jobs, 
Ingress Tool Transfer
|
Defense Evasion, Persistence, 
Command And Control

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Cmlua_or_cmstplua_uac_bypass|CMLUA Or CMSTPLUA UAC Bypass]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.003/ T1218.003]
|
Signed Binary Proxy Execution, 
CMSTP
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Certutil_download_with_urlcache_and_split_arguments|CertUtil Download With URLCache and Split Arguments]]

|
[https://attack.mitre.org/techniques/T1105/ T1105]
|
Ingress Tool Transfer
|
Command And Control

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Certutil_download_with_verifyctl_and_split_arguments|CertUtil Download With VerifyCtl and Split Arguments]]

|
[https://attack.mitre.org/techniques/T1105/ T1105]
|
Ingress Tool Transfer
|
Command And Control

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Cobalt_strike_named_pipes|Cobalt Strike Named Pipes]]

|
[https://attack.mitre.org/techniques/T1055/ T1055]
|
Process Injection
|
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Delete_shadowcopy_with_powershell|Delete ShadowCopy With PowerShell]]

|
[https://attack.mitre.org/techniques/T1490/ T1490]
|
Inhibit System Recovery
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_mimikatz_using_loaded_images|Detect Mimikatz Using Loaded Images]]

|
[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
LSASS Memory, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]

|
[https://attack.mitre.org/techniques/T1021/ T1021], 
[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
|
Remote Services, 
SMB/Windows Admin Shares
|
Lateral Movement, 
Lateral Movement

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_rclone_command-line_usage|Detect RClone Command-Line Usage]]

|
[https://attack.mitre.org/techniques/T1020/ T1020]
|
Automated Exfiltration
|
Exfiltration

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]

|
[https://attack.mitre.org/techniques/T1569/ T1569], 
[https://attack.mitre.org/techniques/T1569.002/ T1569.002]
|
System Services, 
Service Execution
|
Execution, 
Execution

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Detect_renamed_rclone|Detect Renamed RClone]]

|
[https://attack.mitre.org/techniques/T1020/ T1020]
|
Automated Exfiltration
|
Exfiltration

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Extraction_of_registry_hives|Extraction of Registry Hives]]

|
[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
[https://attack.mitre.org/techniques/T1003/ T1003]
|
Security Account Manager, 
OS Credential Dumping
|
Credential Access, 
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Ransomware_notes_bulk_creation|Ransomware Notes bulk creation]]

|
[https://attack.mitre.org/techniques/T1486/ T1486]
|
Data Encrypted for Impact
|
Impact

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Slui_runas_elevated|SLUI RunAs Elevated]]

|
[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Bypass User Account Control, 
Abuse Elevation Control Mechanism
|
Privilege Escalation, Defense Evasion, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Slui_spawning_a_process|SLUI Spawning a Process]]

|
[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Bypass User Account Control, 
Abuse Elevation Control Mechanism
|
Privilege Escalation, Defense Evasion, 
Privilege Escalation, Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Execution

* Exfiltration

* Exploitation

* Lateral Movement

* Obfuscation


====Reference====

* https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/

* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html


''version'': 1
</div>
</div>

----

===Dynamic dns===
Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint], [https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution Network_Resolution]
* '''Last Updated''': 2018-09-06
* '''Use Case''': Security Monitoring

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Dns_exfiltration_using_nslookup_app|DNS Exfiltration Using Nslookup App]]

|
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Alternative Protocol
|
Exfiltration

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_hosts_connecting_to_dynamic_domain_providers|Detect hosts connecting to dynamic domain providers]]

|
[https://attack.mitre.org/techniques/T1189/ T1189]
|
Drive-by Compromise
|
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_nslookup_app|Excessive Usage of NSLOOKUP App]]

|
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Alternative Protocol
|
Exfiltration

| Anomaly
|}

====Kill Chain Phase====

* Actions on Objectives

* Command and Control

* Exploitation


====Reference====

* https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html

* https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/

* http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/

* https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html


''version'': 2
</div>
</div>

----

===Emotet malware  dhs report ta18-201a ===
Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Email Email], [https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint], [https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic Network_Traffic]
* '''Last Updated''': 2020-01-27
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_rare_executables|Detect Rare Executables]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Detect_use_of_cmd_exe_to_launch_script_interpreters|Detect Use of cmd exe to Launch Script Interpreters]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.003/ T1059.003]
|
Command and Scripting Interpreter, 
Windows Command Shell
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detection_of_tools_built_by_nirsoft|Detection of tools built by NirSoft]]

|
[https://attack.mitre.org/techniques/T1072/ T1072]
|
Software Deployment Tools
|
Execution, Lateral Movement

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Email_attachments_with_lots_of_spaces|Email Attachments With Lots Of Spaces]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]

|
[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Registry Run Keys / Startup Folder, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike|SMB Traffic Spike]]

|
[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
[https://attack.mitre.org/techniques/T1021/ T1021]
|
SMB/Windows Admin Shares, 
Remote Services
|
Lateral Movement, 
Lateral Movement

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike_-_mltk|SMB Traffic Spike - MLTK]]

|
[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
[https://attack.mitre.org/techniques/T1021/ T1021]
|
SMB/Windows Admin Shares, 
Remote Services
|
Lateral Movement, 
Lateral Movement

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_email_attachment_extensions|Suspicious Email Attachment Extensions]]

|
[https://attack.mitre.org/techniques/T1566.001/ T1566.001], 
[https://attack.mitre.org/techniques/T1566/ T1566]
|
Spearphishing Attachment, 
Phishing
|
Initial Access, 
Initial Access

| Anomaly
|}

====Kill Chain Phase====

* Actions on Objectives

* Command and Control

* Delivery

* Exploitation

* Installation


====Reference====

* https://www.us-cert.gov/ncas/alerts/TA18-201A

* https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf

* https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html


''version'': 1
</div>
</div>

----

===Fin7===
Leverage searches that allow you to detect and investigate unusual activities that might relate to the FIN7 JS Implant and JSSLoader, including looking for Image Loading of ldap and wmi modules, associated with its payload, data collection and script execution.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-09-14
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Check_elevated_cmd_using_whoami|Check Elevated CMD using whoami]]

|
[https://attack.mitre.org/techniques/T1033/ T1033]
|
System Owner/User Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Cmdline_tool_not_executed_in_cmd_shell|Cmdline Tool Not Executed In CMD Shell]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.007/ T1059.007]
|
Command and Scripting Interpreter, 
JavaScript
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Jscript_execution_using_cscript_app|Jscript Execution Using Cscript App]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.007/ T1059.007]
|
Command and Scripting Interpreter, 
JavaScript
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Ms_scripting_process_loading_ldap_module|MS Scripting Process Loading Ldap Module]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.007/ T1059.007]
|
Command and Scripting Interpreter, 
JavaScript
|
Execution, 
Execution

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Ms_scripting_process_loading_wmi_module|MS Scripting Process Loading WMI Module]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.007/ T1059.007]
|
Command and Scripting Interpreter, 
JavaScript
|
Execution, 
Execution

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Non_chrome_process_accessing_chrome_default_dir|Non Chrome Process Accessing Chrome Default Dir]]

|
[https://attack.mitre.org/techniques/T1555/ T1555], 
[https://attack.mitre.org/techniques/T1555.003/ T1555.003]
|
Credentials from Password Stores, 
Credentials from Web Browsers
|
Credential Access, 
Credential Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Non_firefox_process_access_firefox_profile_dir|Non Firefox Process Access Firefox Profile Dir]]

|
[https://attack.mitre.org/techniques/T1555/ T1555], 
[https://attack.mitre.org/techniques/T1555.003/ T1555.003]
|
Credentials from Password Stores, 
Credentials from Web Browsers
|
Credential Access, 
Credential Access

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Office_application_drop_executable|Office Application Drop Executable]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_product_spawning_wmic|Office Product Spawning Wmic]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Vbscript_execution_using_wscript_app|Vbscript Execution Using Wscript App]]

|
[https://attack.mitre.org/techniques/T1059.005/ T1059.005], 
[https://attack.mitre.org/techniques/T1059/ T1059]
|
Visual Basic, 
Command and Scripting Interpreter
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Wscript_or_cscript_suspicious_child_process|Wscript Or Cscript Suspicious Child Process]]

|
[https://attack.mitre.org/techniques/T1055/ T1055], 
[https://attack.mitre.org/techniques/T1543/ T1543], 
[https://attack.mitre.org/techniques/T1134.004/ T1134.004], 
[https://attack.mitre.org/techniques/T1134/ T1134]
|
Process Injection, 
Create or Modify System Process, 
Parent PID Spoofing, 
Access Token Manipulation
|
Defense Evasion, Privilege Escalation, 
Persistence, Privilege Escalation, 
Defense Evasion, Privilege Escalation, 
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Xsl_script_execution_with_wmic|XSL Script Execution With WMIC]]

|
[https://attack.mitre.org/techniques/T1220/ T1220]
|
XSL Script Processing
|
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Exploitation


====Reference====

* https://en.wikipedia.org/wiki/FIN7

* https://threatpost.com/fin7-windows-11-release/169206/

* https://www.proofpoint.com/us/blog/threat-insight/jssloader-recoded-and-reloaded


''version'': 1
</div>
</div>

----

===Hidden cobra malware===
Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint], [https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution Network_Resolution], [https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic Network_Traffic]
* '''Last Updated''': 2020-01-22
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Create_or_delete_windows_shares_using_net_exe|Create or delete windows shares using net exe]]

|
[https://attack.mitre.org/techniques/T1070/ T1070], 
[https://attack.mitre.org/techniques/T1070.005/ T1070.005]
|
Indicator Removal on Host, 
Network Share Connection Removal
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Dns_query_length_outliers_-_mltk|DNS Query Length Outliers - MLTK]]

|
[https://attack.mitre.org/techniques/T1071.004/ T1071.004], 
[https://attack.mitre.org/techniques/T1071/ T1071]
|
DNS, 
Application Layer Protocol
|
Command And Control, 
Command And Control

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Dns_query_length_with_high_standard_deviation|DNS Query Length With High Standard Deviation]]

|
[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
Exfiltration Over Alternative Protocol
|
Exfiltration, 
Exfiltration

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Detect_outbound_smb_traffic|Detect Outbound SMB Traffic]]

|
[https://attack.mitre.org/techniques/T1071.002/ T1071.002], 
[https://attack.mitre.org/techniques/T1071/ T1071]
|
File Transfer Protocols, 
Application Layer Protocol
|
Command And Control, 
Command And Control

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_traffic|Remote Desktop Network Traffic]]

|
[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
[https://attack.mitre.org/techniques/T1021/ T1021]
|
Remote Desktop Protocol, 
Remote Services
|
Lateral Movement, 
Lateral Movement

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Remote_desktop_process_running_on_system|Remote Desktop Process Running On System]]

|
[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
[https://attack.mitre.org/techniques/T1021/ T1021]
|
Remote Desktop Protocol, 
Remote Services
|
Lateral Movement, 
Lateral Movement

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike|SMB Traffic Spike]]

|
[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
[https://attack.mitre.org/techniques/T1021/ T1021]
|
SMB/Windows Admin Shares, 
Remote Services
|
Lateral Movement, 
Lateral Movement

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike_-_mltk|SMB Traffic Spike - MLTK]]

|
[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
[https://attack.mitre.org/techniques/T1021/ T1021]
|
SMB/Windows Admin Shares, 
Remote Services
|
Lateral Movement, 
Lateral Movement

| Anomaly
|}

====Kill Chain Phase====

* Actions on Objectives

* Command and Control


====Reference====

* https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity

* https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf


''version'': 2
</div>
</div>

----

===Icedid===
Leverage searches that allow you to detect and investigate unusual activities that might relate to the IcedID banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-07-29
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Account_discovery_with_net_app|Account Discovery With Net App]]

|
[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
[https://attack.mitre.org/techniques/T1087/ T1087]
|
Domain Account, 
Account Discovery
|
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Chcp_command_execution|CHCP Command Execution]]

|
[https://attack.mitre.org/techniques/T1059/ T1059]
|
Command and Scripting Interpreter
|
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Create_remote_thread_in_shell_application|Create Remote Thread In Shell Application]]

|
[https://attack.mitre.org/techniques/T1055/ T1055]
|
Process Injection
|
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Drop_icedid_license_dat|Drop IcedID License dat]]

|
[https://attack.mitre.org/techniques/T1204/ T1204], 
[https://attack.mitre.org/techniques/T1204.002/ T1204.002]
|
User Execution, 
Malicious File
|
Execution, 
Execution

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Eventvwr_uac_bypass|Eventvwr UAC Bypass]]

|
[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Bypass User Account Control, 
Abuse Elevation Control Mechanism
|
Privilege Escalation, Defense Evasion, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Fodhelper_uac_bypass|FodHelper UAC Bypass]]

|
[https://attack.mitre.org/techniques/T1112/ T1112], 
[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Modify Registry, 
Bypass User Account Control, 
Abuse Elevation Control Mechanism
|
Defense Evasion, 
Privilege Escalation, Defense Evasion, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Icedid_exfiltrated_archived_file_creation|IcedID Exfiltrated Archived File Creation]]

|
[https://attack.mitre.org/techniques/T1560.001/ T1560.001], 
[https://attack.mitre.org/techniques/T1560/ T1560]
|
Archive via Utility, 
Archive Collected Data
|
Collection, 
Collection

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Mshta_spawning_rundll32_or_regsvr32_process|Mshta spawning Rundll32 OR Regsvr32 Process]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.005/ T1218.005]
|
Signed Binary Proxy Execution, 
Mshta
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Nltest_domain_trust_discovery|NLTest Domain Trust Discovery]]

|
[https://attack.mitre.org/techniques/T1482/ T1482]
|
Domain Trust Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_application_spawn_regsvr32_process|Office Application Spawn Regsvr32 process]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_application_spawn_rundll32_process|Office Application Spawn rundll32 process]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_document_executing_macro_code|Office Document Executing Macro Code]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_product_spawning_mshta|Office Product Spawning MSHTA]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]

|
[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Registry Run Keys / Startup Folder, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Rundll32_create_remote_thread_to_a_process|Rundll32 Create Remote Thread To A Process]]

|
[https://attack.mitre.org/techniques/T1055/ T1055]
|
Process Injection
|
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Rundll32_createremotethread_in_browser|Rundll32 CreateRemoteThread In Browser]]

|
[https://attack.mitre.org/techniques/T1055/ T1055]
|
Process Injection
|
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Rundll32_dnsquery|Rundll32 DNSQuery]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Rundll32_process_creating_exe_dll_files|Rundll32 Process Creating Exe Dll Files]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Schedule_task_with_rundll32_command_trigger|Schedule Task with Rundll32 Command Trigger]]

|
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Sqlite_module_in_temp_folder|Sqlite Module In Temp Folder]]

|
[https://attack.mitre.org/techniques/T1005/ T1005]
|
Data from Local System
|
Collection

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_icedid_regsvr32_cmdline|Suspicious IcedID Regsvr32 Cmdline]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.010/ T1218.010]
|
Signed Binary Proxy Execution, 
Regsvr32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_icedid_rundll32_cmdline|Suspicious IcedID Rundll32 Cmdline]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_plugininit|Suspicious Rundll32 PluginInit]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_within_public_path|WinEvent Scheduled Task Created Within Public Path]]

|
[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task, 
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation, 
Execution, Persistence, Privilege Escalation

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation

* Privilege Escalation

* Reconnaissance


====Reference====

* https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/

* https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/


''version'': 1
</div>
</div>

----

===Orangeworm attack group===
Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2020-01-22
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#First_time_seen_running_windows_service|First Time Seen Running Windows Service]]

|
[https://attack.mitre.org/techniques/T1569/ T1569], 
[https://attack.mitre.org/techniques/T1569.002/ T1569.002]
|
System Services, 
Service Execution
|
Execution, 
Execution

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]

|
[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
[https://attack.mitre.org/techniques/T1543/ T1543]
|
Windows Service, 
Create or Modify System Process
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Installation


====Reference====

* https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia

* https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/


''version'': 2
</div>
</div>

----

===Ransomware===
Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint], [https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic Network_Traffic]
* '''Last Updated''': 2020-02-04
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#7zip_commandline_to_smb_share_path|7zip CommandLine To SMB Share Path]]

|
[https://attack.mitre.org/techniques/T1560.001/ T1560.001], 
[https://attack.mitre.org/techniques/T1560/ T1560]
|
Archive via Utility, 
Archive Collected Data
|
Collection, 
Collection

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Allow_file_and_printing_sharing_in_firewall|Allow File And Printing Sharing In Firewall]]

|
[https://attack.mitre.org/techniques/T1562.007/ T1562.007], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Cloud Firewall, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Allow_network_discovery_in_firewall|Allow Network Discovery In Firewall]]

|
[https://attack.mitre.org/techniques/T1562.007/ T1562.007], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Cloud Firewall, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Allow_operation_with_consent_admin|Allow Operation with Consent Admin]]

|
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Abuse Elevation Control Mechanism
|
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Attempt_to_disable_services|Attempt To Disable Services]]

|
[https://attack.mitre.org/techniques/T1489/ T1489]
|
Service Stop
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Attempt_to_delete_services|Attempt To delete Services]]

|
[https://attack.mitre.org/techniques/T1489/ T1489]
|
Service Stop
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Bcdedit_failure_recovery_modification|BCDEdit Failure Recovery Modification]]

|
[https://attack.mitre.org/techniques/T1490/ T1490]
|
Inhibit System Recovery
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Cmlua_or_cmstplua_uac_bypass|CMLUA Or CMSTPLUA UAC Bypass]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.003/ T1218.003]
|
Signed Binary Proxy Execution, 
CMSTP
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Clear_unallocated_sector_using_cipher_app|Clear Unallocated Sector Using Cipher App]]

|
[https://attack.mitre.org/techniques/T1070.004/ T1070.004], 
[https://attack.mitre.org/techniques/T1070/ T1070]
|
File Deletion, 
Indicator Removal on Host
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Common_ransomware_extensions|Common Ransomware Extensions]]

|
[https://attack.mitre.org/techniques/T1485/ T1485]
|
Data Destruction
|
Impact

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Common_ransomware_notes|Common Ransomware Notes]]

|
[https://attack.mitre.org/techniques/T1485/ T1485]
|
Data Destruction
|
Impact

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Conti_common_exec_parameter|Conti Common Exec parameter]]

|
[https://attack.mitre.org/techniques/T1204/ T1204]
|
User Execution
|
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Delete_a_net_user|Delete A Net User]]

|
[https://attack.mitre.org/techniques/T1489/ T1489]
|
Service Stop
|
Impact

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Delete_shadowcopy_with_powershell|Delete ShadowCopy With PowerShell]]

|
[https://attack.mitre.org/techniques/T1490/ T1490]
|
Inhibit System Recovery
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Deleting_shadow_copies|Deleting Shadow Copies]]

|
[https://attack.mitre.org/techniques/T1490/ T1490]
|
Inhibit System Recovery
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_rclone_command-line_usage|Detect RClone Command-Line Usage]]

|
[https://attack.mitre.org/techniques/T1020/ T1020]
|
Automated Exfiltration
|
Exfiltration

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_renamed_rclone|Detect Renamed RClone]]

|
[https://attack.mitre.org/techniques/T1020/ T1020]
|
Automated Exfiltration
|
Exfiltration

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Detect_sharphound_command-line_arguments|Detect SharpHound Command-Line Arguments]]

|
[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
[https://attack.mitre.org/techniques/T1069.001/ T1069.001], 
[https://attack.mitre.org/techniques/T1482/ T1482], 
[https://attack.mitre.org/techniques/T1087.001/ T1087.001], 
[https://attack.mitre.org/techniques/T1087/ T1087], 
[https://attack.mitre.org/techniques/T1069.002/ T1069.002], 
[https://attack.mitre.org/techniques/T1069/ T1069]
|
Domain Account, 
Local Groups, 
Domain Trust Discovery, 
Local Account, 
Account Discovery, 
Domain Groups, 
Permission Groups Discovery
|
Discovery, 
Discovery, 
Discovery, 
Discovery, 
Discovery, 
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_sharphound_file_modifications|Detect SharpHound File Modifications]]

|
[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
[https://attack.mitre.org/techniques/T1069.001/ T1069.001], 
[https://attack.mitre.org/techniques/T1482/ T1482], 
[https://attack.mitre.org/techniques/T1087.001/ T1087.001], 
[https://attack.mitre.org/techniques/T1087/ T1087], 
[https://attack.mitre.org/techniques/T1069.002/ T1069.002], 
[https://attack.mitre.org/techniques/T1069/ T1069]
|
Domain Account, 
Local Groups, 
Domain Trust Discovery, 
Local Account, 
Account Discovery, 
Domain Groups, 
Permission Groups Discovery
|
Discovery, 
Discovery, 
Discovery, 
Discovery, 
Discovery, 
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_sharphound_usage|Detect SharpHound Usage]]

|
[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
[https://attack.mitre.org/techniques/T1069.001/ T1069.001], 
[https://attack.mitre.org/techniques/T1482/ T1482], 
[https://attack.mitre.org/techniques/T1087.001/ T1087.001], 
[https://attack.mitre.org/techniques/T1087/ T1087], 
[https://attack.mitre.org/techniques/T1069.002/ T1069.002], 
[https://attack.mitre.org/techniques/T1069/ T1069]
|
Domain Account, 
Local Groups, 
Domain Trust Discovery, 
Local Account, 
Account Discovery, 
Domain Groups, 
Permission Groups Discovery
|
Discovery, 
Discovery, 
Discovery, 
Discovery, 
Discovery, 
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disable_amsi_through_registry|Disable AMSI Through Registry]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disable_etw_through_registry|Disable ETW Through Registry]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disable_logs_using_wevtutil|Disable Logs Using WevtUtil]]

|
[https://attack.mitre.org/techniques/T1070/ T1070], 
[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
|
Indicator Removal on Host, 
Clear Windows Event Logs
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disable_net_user_account|Disable Net User Account]]

|
[https://attack.mitre.org/techniques/T1489/ T1489]
|
Service Stop
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disable_windows_behavior_monitoring|Disable Windows Behavior Monitoring]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Excessive_service_stop_attempt|Excessive Service Stop Attempt]]

|
[https://attack.mitre.org/techniques/T1489/ T1489]
|
Service Stop
|
Impact

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_net_app|Excessive Usage Of Net App]]

|
[https://attack.mitre.org/techniques/T1531/ T1531]
|
Account Access Removal
|
Impact

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_sc_service_utility|Excessive Usage Of SC Service Utility]]

|
[https://attack.mitre.org/techniques/T1569/ T1569], 
[https://attack.mitre.org/techniques/T1569.002/ T1569.002]
|
System Services, 
Service Execution
|
Execution, 
Execution

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Execute_javascript_with_jscript_com_clsid|Execute Javascript With Jscript COM CLSID]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.005/ T1059.005]
|
Command and Scripting Interpreter, 
Visual Basic
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Fsutil_zeroing_file|Fsutil Zeroing File]]

|
[https://attack.mitre.org/techniques/T1070/ T1070]
|
Indicator Removal on Host
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Icacls_grant_command|ICACLS Grant Command]]

|
[https://attack.mitre.org/techniques/T1222/ T1222]
|
File and Directory Permissions Modification
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Known_services_killed_by_ransomware|Known Services Killed by Ransomware]]

|
[https://attack.mitre.org/techniques/T1490/ T1490]
|
Inhibit System Recovery
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Modification_of_wallpaper|Modification Of Wallpaper]]

|
[https://attack.mitre.org/techniques/T1491/ T1491]
|
Defacement
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Msmpeng_application_dll_side_loading|Msmpeng Application DLL Side Loading]]

|
[https://attack.mitre.org/techniques/T1574.002/ T1574.002], 
[https://attack.mitre.org/techniques/T1574/ T1574]
|
DLL Side-Loading, 
Hijack Execution Flow
|
Persistence, Privilege Escalation, Defense Evasion, 
Persistence, Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Permission_modification_using_takeown_app|Permission Modification using Takeown App]]

|
[https://attack.mitre.org/techniques/T1222/ T1222]
|
File and Directory Permissions Modification
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Powershell_disable_security_monitoring|Powershell Disable Security Monitoring]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Powershell_enable_smb1protocol_feature|Powershell Enable SMB1Protocol Feature]]

|
[https://attack.mitre.org/techniques/T1027/ T1027], 
[https://attack.mitre.org/techniques/T1027.005/ T1027.005]
|
Obfuscated Files or Information, 
Indicator Removal from Tools
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Powershell_execute_com_object|Powershell Execute COM Object]]

|
[https://attack.mitre.org/techniques/T1546.015/ T1546.015], 
[https://attack.mitre.org/techniques/T1546/ T1546]
|
Component Object Model Hijacking, 
Event Triggered Execution
|
Privilege Escalation, Persistence, 
Privilege Escalation, Persistence

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Prevent_automatic_repair_mode_using_bcdedit|Prevent Automatic Repair Mode using Bcdedit]]

|
[https://attack.mitre.org/techniques/T1490/ T1490]
|
Inhibit System Recovery
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Prohibited_network_traffic_allowed|Prohibited Network Traffic Allowed]]

|
[https://attack.mitre.org/techniques/T1048/ T1048]
|
Exfiltration Over Alternative Protocol
|
Exfiltration

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Recon_avproduct_through_pwh_or_wmi|Recon AVProduct Through Pwh or WMI]]

|
[https://attack.mitre.org/techniques/T1592/ T1592]
|
Gather Victim Host Information
|
Reconnaissance

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Recursive_delete_of_directory_in_batch_cmd|Recursive Delete of Directory In Batch CMD]]

|
[https://attack.mitre.org/techniques/T1070.004/ T1070.004], 
[https://attack.mitre.org/techniques/T1070/ T1070]
|
File Deletion, 
Indicator Removal on Host
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]

|
[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Registry Run Keys / Startup Folder, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Remote_process_instantiation_via_wmi|Remote Process Instantiation via WMI]]

|
[https://attack.mitre.org/techniques/T1047/ T1047]
|
Windows Management Instrumentation
|
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Resize_shadowstorage_volume|Resize Shadowstorage Volume]]

|
[https://attack.mitre.org/techniques/T1489/ T1489]
|
Service Stop
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Revil_common_exec_parameter|Revil Common Exec Parameter]]

|
[https://attack.mitre.org/techniques/T1204/ T1204]
|
User Execution
|
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Revil_registry_entry|Revil Registry Entry]]

|
[https://attack.mitre.org/techniques/T1112/ T1112]
|
Modify Registry
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike|SMB Traffic Spike]]

|
[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
[https://attack.mitre.org/techniques/T1021/ T1021]
|
SMB/Windows Admin Shares, 
Remote Services
|
Lateral Movement, 
Lateral Movement

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike_-_mltk|SMB Traffic Spike - MLTK]]

|
[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
[https://attack.mitre.org/techniques/T1021/ T1021]
|
SMB/Windows Admin Shares, 
Remote Services
|
Lateral Movement, 
Lateral Movement

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Schtasks_used_for_forcing_a_reboot|Schtasks used for forcing a reboot]]

|
[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task, 
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation, 
Execution, Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Spike_in_file_writes|Spike in File Writes]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Start_up_during_safe_mode_boot|Start Up During Safe Mode Boot]]

|
[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Registry Run Keys / Startup Folder, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_event_log_service_behavior|Suspicious Event Log Service Behavior]]

|
[https://attack.mitre.org/techniques/T1070/ T1070], 
[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
|
Indicator Removal on Host, 
Clear Windows Event Logs
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_scheduled_task_from_public_directory|Suspicious Scheduled Task from Public Directory]]

|
[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task, 
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation, 
Execution, Persistence, Privilege Escalation

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_wevtutil_usage|Suspicious wevtutil Usage]]

|
[https://attack.mitre.org/techniques/T1070.001/ T1070.001], 
[https://attack.mitre.org/techniques/T1070/ T1070]
|
Clear Windows Event Logs, 
Indicator Removal on Host
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#System_processes_run_from_unexpected_locations|System Processes Run From Unexpected Locations]]

|
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
|
Masquerading, 
Rename System Utilities
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Tor_traffic|TOR Traffic]]

|
[https://attack.mitre.org/techniques/T1071/ T1071], 
[https://attack.mitre.org/techniques/T1071.001/ T1071.001]
|
Application Layer Protocol, 
Web Protocols
|
Command And Control, 
Command And Control

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Uac_bypass_with_colorui_com_object|UAC Bypass With Colorui COM Object]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.003/ T1218.003]
|
Signed Binary Proxy Execution, 
CMSTP
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Usn_journal_deletion|USN Journal Deletion]]

|
[https://attack.mitre.org/techniques/T1070/ T1070]
|
Indicator Removal on Host
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Uninstall_app_using_msiexec|Uninstall App Using MsiExec]]

|
[https://attack.mitre.org/techniques/T1218.007/ T1218.007], 
[https://attack.mitre.org/techniques/T1218/ T1218]
|
Msiexec, 
Signed Binary Proxy Execution
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Unusually_long_command_line|Unusually Long Command Line]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Unusually_long_command_line_-_mltk|Unusually Long Command Line - MLTK]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Wbadmin_delete_system_backups|WBAdmin Delete System Backups]]

|
[https://attack.mitre.org/techniques/T1490/ T1490]
|
Inhibit System Recovery
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Wbemprox_com_object_execution|Wbemprox COM Object Execution]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.003/ T1218.003]
|
Signed Binary Proxy Execution, 
CMSTP
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_clear_logs|WevtUtil Usage To Clear Logs]]

|
[https://attack.mitre.org/techniques/T1070/ T1070], 
[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
|
Indicator Removal on Host, 
Clear Windows Event Logs
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_disable_logs|Wevtutil Usage To Disable Logs]]

|
[https://attack.mitre.org/techniques/T1070/ T1070], 
[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
|
Indicator Removal on Host, 
Clear Windows Event Logs
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_within_public_path|WinEvent Scheduled Task Created Within Public Path]]

|
[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task, 
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation, 
Execution, Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_to_spawn_shell|WinEvent Scheduled Task Created to Spawn Shell]]

|
[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task, 
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation, 
Execution, Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Windows_event_log_cleared|Windows Event Log Cleared]]

|
[https://attack.mitre.org/techniques/T1070/ T1070], 
[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
|
Indicator Removal on Host, 
Clear Windows Event Logs
|
Defense Evasion, 
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Command and Control

* Delivery

* Exfiltration

* Exploitation

* Privilege Escalation

* Reconnaissance


====Reference====

* https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/

* https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html


''version'': 1
</div>
</div>

----

===Ransomware cloud===
Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features.

* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':
* '''Last Updated''': 2020-10-27
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Aws_detect_users_creating_keys_with_encrypt_policy_without_mfa|AWS Detect Users creating keys with encrypt policy without MFA]]

|
[https://attack.mitre.org/techniques/T1486/ T1486]
|
Data Encrypted for Impact
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Aws_detect_users_with_kms_keys_performing_encryption_s3|AWS Detect Users with KMS keys performing encryption S3]]

|
[https://attack.mitre.org/techniques/T1486/ T1486]
|
Data Encrypted for Impact
|
Impact

| Anomaly
|}

====Kill Chain Phase====


====Reference====

* https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/

* https://github.com/d1vious/git-wild-hunt

* https://www.youtube.com/watch?v=PgzNib37g0M


''version'': 1
</div>
</div>

----

===Remcos===
Leverage searches that allow you to detect and investigate unusual activities that might relate to the Remcos RAT trojan, including looking for file writes associated with its payload, screencapture, registry modification, UAC bypassed, persistence and data collection..

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-09-23
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Disabling_remote_user_account_control|Disabling Remote User Account Control]]

|
[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
[https://attack.mitre.org/techniques/T1548/ T1548]
|
Bypass User Account Control, 
Abuse Elevation Control Mechanism
|
Privilege Escalation, Defense Evasion, 
Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Executables_or_script_creation_in_suspicious_path|Executables Or Script Creation In Suspicious Path]]

|
[https://attack.mitre.org/techniques/T1036/ T1036]
|
Masquerading
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Malicious_inprocserver32_modification|Malicious InProcServer32 Modification]]

|
[https://attack.mitre.org/techniques/T1218.010/ T1218.010], 
[https://attack.mitre.org/techniques/T1112/ T1112]
|
Regsvr32, 
Modify Registry
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Process_deleting_its_process_file_path|Process Deleting Its Process File Path]]

|
[https://attack.mitre.org/techniques/T1070/ T1070]
|
Indicator Removal on Host
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Process_writing_dynamicwrapperx|Process Writing DynamicWrapperX]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1559.001/ T1559.001]
|
Command and Scripting Interpreter, 
Component Object Model
|
Execution, 
Execution

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]

|
[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
[https://attack.mitre.org/techniques/T1547/ T1547]
|
Registry Run Keys / Startup Folder, 
Boot or Logon Autostart Execution
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Remcos_rat_file_creation_in_remcos_folder|Remcos RAT File Creation in Remcos Folder]]

|
[https://attack.mitre.org/techniques/T1113/ T1113]
|
Screen Capture
|
Collection

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Remcos_client_registry_install_entry|Remcos client registry install entry]]

|
[https://attack.mitre.org/techniques/T1112/ T1112]
|
Modify Registry
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_image_creation_in_appdata_folder|Suspicious Image Creation In Appdata Folder]]

|
[https://attack.mitre.org/techniques/T1113/ T1113]
|
Screen Capture
|
Collection

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_process_file_path|Suspicious Process File Path]]

|
[https://attack.mitre.org/techniques/T1543/ T1543]
|
Create or Modify System Process
|
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_wav_file_in_appdata_folder|Suspicious WAV file in Appdata Folder]]

|
[https://attack.mitre.org/techniques/T1113/ T1113]
|
Screen Capture
|
Collection

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Vbscript_execution_using_wscript_app|Vbscript Execution Using Wscript App]]

|
[https://attack.mitre.org/techniques/T1059.005/ T1059.005], 
[https://attack.mitre.org/techniques/T1059/ T1059]
|
Visual Basic, 
Command and Scripting Interpreter
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Winhlp32_spawning_a_process|Winhlp32 Spawning a Process]]

|
[https://attack.mitre.org/techniques/T1055/ T1055]
|
Process Injection
|
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Wscript_or_cscript_suspicious_child_process|Wscript Or Cscript Suspicious Child Process]]

|
[https://attack.mitre.org/techniques/T1055/ T1055], 
[https://attack.mitre.org/techniques/T1543/ T1543], 
[https://attack.mitre.org/techniques/T1134.004/ T1134.004], 
[https://attack.mitre.org/techniques/T1134/ T1134]
|
Process Injection, 
Create or Modify System Process, 
Parent PID Spoofing, 
Access Token Manipulation
|
Defense Evasion, Privilege Escalation, 
Persistence, Privilege Escalation, 
Defense Evasion, Privilege Escalation, 
Defense Evasion, Privilege Escalation

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation


====Reference====

* https://success.trendmicro.com/solution/1123281-remcos-malware-information

* https://attack.mitre.org/software/S0332/

* https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos#:~:text=Remcos%20(acronym%20of%20Remote%20Control,used%20to%20remotely%20control%20computers.&text=Remcos%20can%20be%20used%20for,been%20used%20in%20hacking%20campaigns.


''version'': 1
</div>
</div>

----

===Revil ransomware===
Leverage searches that allow you to detect and investigate unusual activities that might relate to the Revil ransomware, including looking for file writes associated with Revil, encrypting network shares, deleting shadow volume storage, registry key modification, deleting of security logs, and more.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-06-04
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Allow_network_discovery_in_firewall|Allow Network Discovery In Firewall]]

|
[https://attack.mitre.org/techniques/T1562.007/ T1562.007], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Cloud Firewall, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Delete_shadowcopy_with_powershell|Delete ShadowCopy With PowerShell]]

|
[https://attack.mitre.org/techniques/T1490/ T1490]
|
Inhibit System Recovery
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disable_windows_behavior_monitoring|Disable Windows Behavior Monitoring]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Modification_of_wallpaper|Modification Of Wallpaper]]

|
[https://attack.mitre.org/techniques/T1491/ T1491]
|
Defacement
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Msmpeng_application_dll_side_loading|Msmpeng Application DLL Side Loading]]

|
[https://attack.mitre.org/techniques/T1574.002/ T1574.002], 
[https://attack.mitre.org/techniques/T1574/ T1574]
|
DLL Side-Loading, 
Hijack Execution Flow
|
Persistence, Privilege Escalation, Defense Evasion, 
Persistence, Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Powershell_disable_security_monitoring|Powershell Disable Security Monitoring]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Revil_common_exec_parameter|Revil Common Exec Parameter]]

|
[https://attack.mitre.org/techniques/T1204/ T1204]
|
User Execution
|
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Revil_registry_entry|Revil Registry Entry]]

|
[https://attack.mitre.org/techniques/T1112/ T1112]
|
Modify Registry
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Wbemprox_com_object_execution|Wbemprox COM Object Execution]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.003/ T1218.003]
|
Signed Binary Proxy Execution, 
CMSTP
|
Defense Evasion, 
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Exploitation


====Reference====

* https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/

* https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/


''version'': 1
</div>
</div>

----

===Ryuk ransomware===
Leverage searches that allow you to detect and investigate unusual activities that might relate to the Ryuk ransomware, including looking for file writes associated with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, suspicious psexec use, and more.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint], [https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic Network_Traffic]
* '''Last Updated''': 2020-11-06
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Bcdedit_failure_recovery_modification|BCDEdit Failure Recovery Modification]]

|
[https://attack.mitre.org/techniques/T1490/ T1490]
|
Inhibit System Recovery
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Common_ransomware_extensions|Common Ransomware Extensions]]

|
[https://attack.mitre.org/techniques/T1485/ T1485]
|
Data Destruction
|
Impact

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Common_ransomware_notes|Common Ransomware Notes]]

|
[https://attack.mitre.org/techniques/T1485/ T1485]
|
Data Destruction
|
Impact

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Nltest_domain_trust_discovery|NLTest Domain Trust Discovery]]

|
[https://attack.mitre.org/techniques/T1482/ T1482]
|
Domain Trust Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_bruteforce|Remote Desktop Network Bruteforce]]

|
[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
[https://attack.mitre.org/techniques/T1021/ T1021]
|
Remote Desktop Protocol, 
Remote Services
|
Lateral Movement, 
Lateral Movement

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_traffic|Remote Desktop Network Traffic]]

|
[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
[https://attack.mitre.org/techniques/T1021/ T1021]
|
Remote Desktop Protocol, 
Remote Services
|
Lateral Movement, 
Lateral Movement

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Ryuk_test_files_detected|Ryuk Test Files Detected]]

|
[https://attack.mitre.org/techniques/T1486/ T1486]
|
Data Encrypted for Impact
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Ryuk_wake_on_lan_command|Ryuk Wake on LAN Command]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1059.003/ T1059.003]
|
Command and Scripting Interpreter, 
Windows Command Shell
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Spike_in_file_writes|Spike in File Writes]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_scheduled_task_from_public_directory|Suspicious Scheduled Task from Public Directory]]

|
[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task, 
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation, 
Execution, Persistence, Privilege Escalation

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Wbadmin_delete_system_backups|WBAdmin Delete System Backups]]

|
[https://attack.mitre.org/techniques/T1490/ T1490]
|
Inhibit System Recovery
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_within_public_path|WinEvent Scheduled Task Created Within Public Path]]

|
[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task, 
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation, 
Execution, Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_to_spawn_shell|WinEvent Scheduled Task Created to Spawn Shell]]

|
[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task, 
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation, 
Execution, Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Windows_disableantispyware_registry|Windows DisableAntiSpyware Registry]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Windows_security_account_manager_stopped|Windows Security Account Manager Stopped]]

|
[https://attack.mitre.org/techniques/T1489/ T1489]
|
Service Stop
|
Impact

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Delivery

* Exploitation

* Lateral Movement

* Privilege Escalation

* Reconnaissance


====Reference====

* https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html

* https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/

* https://us-cert.cisa.gov/ncas/alerts/aa20-302a


''version'': 1
</div>
</div>

----

===Samsam ransomware===
Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint], [https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic Network_Traffic], [https://docs.splunk.com/Documentation/CIM/latest/User/Web Web]
* '''Last Updated''': 2018-12-13
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Attacker_tools_on_endpoint|Attacker Tools On Endpoint]]

|
[https://attack.mitre.org/techniques/T1036.005/ T1036.005], 
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1003/ T1003], 
[https://attack.mitre.org/techniques/T1595/ T1595]
|
Match Legitimate Name or Location, 
Masquerading, 
OS Credential Dumping, 
Active Scanning
|
Defense Evasion, 
Defense Evasion, 
Credential Access, 
Reconnaissance

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Batch_file_write_to_system32|Batch File Write to System32]]

|
[https://attack.mitre.org/techniques/T1204/ T1204], 
[https://attack.mitre.org/techniques/T1204.002/ T1204.002]
|
User Execution, 
Malicious File
|
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Common_ransomware_extensions|Common Ransomware Extensions]]

|
[https://attack.mitre.org/techniques/T1485/ T1485]
|
Data Destruction
|
Impact

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Common_ransomware_notes|Common Ransomware Notes]]

|
[https://attack.mitre.org/techniques/T1485/ T1485]
|
Data Destruction
|
Impact

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Deleting_shadow_copies|Deleting Shadow Copies]]

|
[https://attack.mitre.org/techniques/T1490/ T1490]
|
Inhibit System Recovery
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]

|
[https://attack.mitre.org/techniques/T1021/ T1021], 
[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
|
Remote Services, 
SMB/Windows Admin Shares
|
Lateral Movement, 
Lateral Movement

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]

|
[https://attack.mitre.org/techniques/T1569/ T1569], 
[https://attack.mitre.org/techniques/T1569.002/ T1569.002]
|
System Services, 
Service Execution
|
Execution, 
Execution

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Detect_attackers_scanning_for_vulnerable_jboss_servers|Detect attackers scanning for vulnerable JBoss servers]]

|
[https://attack.mitre.org/techniques/T1082/ T1082]
|
System Information Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_malicious_requests_to_exploit_jboss_servers|Detect malicious requests to exploit JBoss servers]]

|
|
|

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#File_with_samsam_extension|File with Samsam Extension]]

|
|
|

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_bruteforce|Remote Desktop Network Bruteforce]]

|
[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
[https://attack.mitre.org/techniques/T1021/ T1021]
|
Remote Desktop Protocol, 
Remote Services
|
Lateral Movement, 
Lateral Movement

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_traffic|Remote Desktop Network Traffic]]

|
[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
[https://attack.mitre.org/techniques/T1021/ T1021]
|
Remote Desktop Protocol, 
Remote Services
|
Lateral Movement, 
Lateral Movement

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Samsam_test_file_write|Samsam Test File Write]]

|
[https://attack.mitre.org/techniques/T1486/ T1486]
|
Data Encrypted for Impact
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Spike_in_file_writes|Spike in File Writes]]

|
|
|

| Anomaly
|}

====Kill Chain Phase====

* Actions on Objectives

* Command and Control

* Delivery

* Execution

* Exploitation

* Installation

* Lateral Movement

* Reconnaissance


====Reference====

* https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/

* https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/

* https://thehackernews.com/2018/07/samsam-ransomware-attacks.html


''version'': 1
</div>
</div>

----

===Trickbot===
Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection even in LDAP environment.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-04-20
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Account_discovery_with_net_app|Account Discovery With Net App]]

|
[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
[https://attack.mitre.org/techniques/T1087/ T1087]
|
Domain Account, 
Account Discovery
|
Discovery, 
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Attempt_to_stop_security_service|Attempt To Stop Security Service]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Cobalt_strike_named_pipes|Cobalt Strike Named Pipes]]

|
[https://attack.mitre.org/techniques/T1055/ T1055]
|
Process Injection
|
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Mshta_spawning_rundll32_or_regsvr32_process|Mshta spawning Rundll32 OR Regsvr32 Process]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.005/ T1218.005]
|
Signed Binary Proxy Execution, 
Mshta
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_application_spawn_rundll32_process|Office Application Spawn rundll32 process]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_document_executing_macro_code|Office Document Executing Macro Code]]

|
[https://attack.mitre.org/techniques/T1566/ T1566], 
[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
|
Phishing, 
Spearphishing Attachment
|
Initial Access, 
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Office_product_spawn_cmd_process|Office Product Spawn CMD Process]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.005/ T1218.005]
|
Signed Binary Proxy Execution, 
Mshta
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Powershell_remote_thread_to_known_windows_process|Powershell Remote Thread To Known Windows Process]]

|
[https://attack.mitre.org/techniques/T1055/ T1055]
|
Process Injection
|
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Schedule_task_with_rundll32_command_trigger|Schedule Task with Rundll32 Command Trigger]]

|
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_startw|Suspicious Rundll32 StartW]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Trickbot_named_pipe|Trickbot Named Pipe]]

|
[https://attack.mitre.org/techniques/T1055/ T1055]
|
Process Injection
|
Defense Evasion, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Wermgr_process_connecting_to_ip_check_web_services|Wermgr Process Connecting To IP Check Web Services]]

|
[https://attack.mitre.org/techniques/T1590/ T1590], 
[https://attack.mitre.org/techniques/T1590.005/ T1590.005]
|
Gather Victim Network Information, 
IP Addresses
|
Reconnaissance, 
Reconnaissance

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Wermgr_process_create_executable_file|Wermgr Process Create Executable File]]

|
[https://attack.mitre.org/techniques/T1027/ T1027]
|
Obfuscated Files or Information
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Wermgr_process_spawned_cmd_or_powershell_process|Wermgr Process Spawned CMD Or Powershell Process]]

|
[https://attack.mitre.org/techniques/T1059/ T1059]
|
Command and Scripting Interpreter
|
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Write_executable_in_smb_share|Write Executable in SMB Share]]

|
[https://attack.mitre.org/techniques/T1021/ T1021], 
[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
|
Remote Services, 
SMB/Windows Admin Shares
|
Lateral Movement, 
Lateral Movement

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Exploitation

* Installation

* Lateral Movement

* Reconnaissance


====Reference====

* https://en.wikipedia.org/wiki/Trickbot

* https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/


''version'': 1
</div>
</div>

----

===Unusual processes===
Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2020-02-04
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Attacker_tools_on_endpoint|Attacker Tools On Endpoint]]

|
[https://attack.mitre.org/techniques/T1036.005/ T1036.005], 
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1003/ T1003], 
[https://attack.mitre.org/techniques/T1595/ T1595]
|
Match Legitimate Name or Location, 
Masquerading, 
OS Credential Dumping, 
Active Scanning
|
Defense Evasion, 
Defense Evasion, 
Credential Access, 
Reconnaissance

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option|Credential Extraction indicative of FGDump and CacheDump with s option]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option|Credential Extraction indicative of FGDump and CacheDump with v option]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_use_of_mimikatz_modules|Credential Extraction indicative of use of Mimikatz modules]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_extraction_native_microsoft_debuggers_peek_into_the_kernel|Credential Extraction native Microsoft debuggers peek into the kernel]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Credential_extraction_native_microsoft_debuggers_via_z_command_line_option|Credential Extraction native Microsoft debuggers via z command line option]]

|
[https://attack.mitre.org/techniques/T1003/ T1003]
|
OS Credential Dumping
|
Credential Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_rare_executables|Detect Rare Executables]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Detect_processes_used_for_system_network_configuration_discovery|Detect processes used for System Network Configuration Discovery]]

|
[https://attack.mitre.org/techniques/T1016/ T1016]
|
System Network Configuration Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#First_time_seen_command_line_argument|First time seen command line argument]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1117/ T1117], 
[https://attack.mitre.org/techniques/T1202/ T1202]
|
Command and Scripting Interpreter, 
Regsvr32, 
Indirect Command Execution
|
Execution, 
, 
Defense Evasion

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#More_than_usual_number_of_lolbas_applications_in_short_time_period|More than usual number of LOLBAS applications in short time period]]

|
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Command and Scripting Interpreter, 
Scheduled Task/Job
|
Execution, 
Execution, Persistence, Privilege Escalation

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Rare_parent-child_process_relationship|Rare Parent-Child Process Relationship]]

|
[https://attack.mitre.org/techniques/T1203/ T1203], 
[https://attack.mitre.org/techniques/T1059/ T1059], 
[https://attack.mitre.org/techniques/T1053/ T1053], 
[https://attack.mitre.org/techniques/T1072/ T1072]
|
Exploitation for Client Execution, 
Command and Scripting Interpreter, 
Scheduled Task/Job, 
Software Deployment Tools
|
Execution, 
Execution, 
Execution, Persistence, Privilege Escalation, 
Execution, Lateral Movement

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Rundll_loading_dll_by_ordinal|RunDLL Loading DLL By Ordinal]]

|
[https://attack.mitre.org/techniques/T1218/ T1218], 
[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
|
Signed Binary Proxy Execution, 
Rundll32
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Rundll32_shimcache_flush|Rundll32 Shimcache Flush]]

|
[https://attack.mitre.org/techniques/T1112/ T1112]
|
Modify Registry
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_copy_on_system32|Suspicious Copy on System32]]

|
[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
[https://attack.mitre.org/techniques/T1036/ T1036]
|
Rename System Utilities, 
Masquerading
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#System_processes_run_from_unexpected_locations|System Processes Run From Unexpected Locations]]

|
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
|
Masquerading, 
Rename System Utilities
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Unusually_long_command_line|Unusually Long Command Line]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Unusually_long_command_line|Unusually Long Command Line]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Unusually_long_command_line_-_mltk|Unusually Long Command Line - MLTK]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Verclsid_clsid_execution|Verclsid CLSID Execution]]

|
[https://attack.mitre.org/techniques/T1218.012/ T1218.012], 
[https://attack.mitre.org/techniques/T1218/ T1218]
|
Verclsid, 
Signed Binary Proxy Execution
|
Defense Evasion, 
Defense Evasion

| Hunting
|-
| [[Documentation:ESSOC:detections:Detections#Winrm_spawning_a_process|WinRM Spawning a Process]]

|
[https://attack.mitre.org/techniques/T1190/ T1190]
|
Exploit Public-Facing Application
|
Initial Access

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Wscript_or_cscript_suspicious_child_process|Wscript Or Cscript Suspicious Child Process]]

|
[https://attack.mitre.org/techniques/T1055/ T1055], 
[https://attack.mitre.org/techniques/T1543/ T1543], 
[https://attack.mitre.org/techniques/T1134.004/ T1134.004], 
[https://attack.mitre.org/techniques/T1134/ T1134]
|
Process Injection, 
Create or Modify System Process, 
Parent PID Spoofing, 
Access Token Manipulation
|
Defense Evasion, Privilege Escalation, 
Persistence, Privilege Escalation, 
Defense Evasion, Privilege Escalation, 
Defense Evasion, Privilege Escalation

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Command and Control

* Denial of Service

* Exploitation

* Installation

* Privilege Escalation


====Reference====

* https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html

* https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf

* https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262


''version'': 2
</div>
</div>

----

===Windows file extension and association abuse===
Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2018-01-26
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Execution_of_file_with_multiple_extensions|Execution of File with Multiple Extensions]]

|
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
|
Masquerading, 
Rename System Utilities
|
Defense Evasion, 
Defense Evasion

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives


====Reference====

* https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/

* https://attack.mitre.org/wiki/Technique/T1042


''version'': 1
</div>
</div>

----

===Windows service abuse===
Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2017-11-02
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#First_time_seen_running_windows_service|First Time Seen Running Windows Service]]

|
[https://attack.mitre.org/techniques/T1569/ T1569], 
[https://attack.mitre.org/techniques/T1569.002/ T1569.002]
|
System Services, 
Service Execution
|
Execution, 
Execution

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Illegal_service_and_process_control_via_mimikatz_modules|Illegal Service and Process Control via Mimikatz modules]]

|
[https://attack.mitre.org/techniques/T1055/ T1055], 
[https://attack.mitre.org/techniques/T1106/ T1106], 
[https://attack.mitre.org/techniques/T1569/ T1569]
|
Process Injection, 
Native API, 
System Services
|
Defense Evasion, Privilege Escalation, 
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Illegal_service_and_process_control_via_powersploit_modules|Illegal Service and Process Control via PowerSploit modules]]

|
[https://attack.mitre.org/techniques/T1055/ T1055], 
[https://attack.mitre.org/techniques/T1106/ T1106], 
[https://attack.mitre.org/techniques/T1569/ T1569]
|
Process Injection, 
Native API, 
System Services
|
Defense Evasion, Privilege Escalation, 
Execution, 
Execution

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Reg_exe_manipulating_windows_services_registry_keys|Reg exe Manipulating Windows Services Registry Keys]]

|
[https://attack.mitre.org/techniques/T1574.011/ T1574.011], 
[https://attack.mitre.org/techniques/T1574/ T1574]
|
Services Registry Permissions Weakness, 
Hijack Execution Flow
|
Persistence, Privilege Escalation, Defense Evasion, 
Persistence, Privilege Escalation, Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]

|
[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
[https://attack.mitre.org/techniques/T1543/ T1543]
|
Windows Service, 
Create or Modify System Process
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Installation


====Reference====

* https://attack.mitre.org/wiki/Technique/T1050

* https://attack.mitre.org/wiki/Technique/T1031


''version'': 3
</div>
</div>

----

===Xmrig===
Leverage searches that allow you to detect and investigate unusual activities that might relate to the xmrig monero, including looking for file writes associated with its payload, process command-line, defense evasion (killing services, deleting users, modifying files or folder permission, killing other malware or other coin miner) and hacking tools including Telegram as mean of command and control (C2) to download other files. Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems which may impact system and/or hosted service availability. One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive. (1) Servers and cloud-based (2) systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2021-05-07
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Attacker_tools_on_endpoint|Attacker Tools On Endpoint]]

|
[https://attack.mitre.org/techniques/T1036.005/ T1036.005], 
[https://attack.mitre.org/techniques/T1036/ T1036], 
[https://attack.mitre.org/techniques/T1003/ T1003], 
[https://attack.mitre.org/techniques/T1595/ T1595]
|
Match Legitimate Name or Location, 
Masquerading, 
OS Credential Dumping, 
Active Scanning
|
Defense Evasion, 
Defense Evasion, 
Credential Access, 
Reconnaissance

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Attempt_to_disable_services|Attempt To Disable Services]]

|
[https://attack.mitre.org/techniques/T1489/ T1489]
|
Service Stop
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Attempt_to_delete_services|Attempt To delete Services]]

|
[https://attack.mitre.org/techniques/T1489/ T1489]
|
Service Stop
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Delete_a_net_user|Delete A Net User]]

|
[https://attack.mitre.org/techniques/T1489/ T1489]
|
Service Stop
|
Impact

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Deleting_of_net_users|Deleting Of Net Users]]

|
[https://attack.mitre.org/techniques/T1531/ T1531]
|
Account Access Removal
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Deny_permission_using_cacls_utility|Deny Permission using Cacls Utility]]

|
[https://attack.mitre.org/techniques/T1222/ T1222]
|
File and Directory Permissions Modification
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disable_net_user_account|Disable Net User Account]]

|
[https://attack.mitre.org/techniques/T1489/ T1489]
|
Service Stop
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disable_windows_app_hotkeys|Disable Windows App Hotkeys]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Disabling_net_user_account|Disabling Net User Account]]

|
[https://attack.mitre.org/techniques/T1531/ T1531]
|
Account Access Removal
|
Impact

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Download_files_using_telegram|Download Files Using Telegram]]

|
[https://attack.mitre.org/techniques/T1105/ T1105]
|
Ingress Tool Transfer
|
Command And Control

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Enumerate_users_local_group_using_telegram|Enumerate Users Local Group Using Telegram]]

|
[https://attack.mitre.org/techniques/T1087/ T1087]
|
Account Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Excessive_attempt_to_disable_services|Excessive Attempt To Disable Services]]

|
[https://attack.mitre.org/techniques/T1489/ T1489]
|
Service Stop
|
Impact

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Excessive_service_stop_attempt|Excessive Service Stop Attempt]]

|
[https://attack.mitre.org/techniques/T1489/ T1489]
|
Service Stop
|
Impact

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_cacls_app|Excessive Usage Of Cacls App]]

|
[https://attack.mitre.org/techniques/T1222/ T1222]
|
File and Directory Permissions Modification
|
Defense Evasion

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_net_app|Excessive Usage Of Net App]]

|
[https://attack.mitre.org/techniques/T1531/ T1531]
|
Account Access Removal
|
Impact

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_taskkill|Excessive Usage Of Taskkill]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Executables_or_script_creation_in_suspicious_path|Executables Or Script Creation In Suspicious Path]]

|
[https://attack.mitre.org/techniques/T1036/ T1036]
|
Masquerading
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Grant_permission_using_cacls_utility|Grant Permission Using Cacls Utility]]

|
[https://attack.mitre.org/techniques/T1222/ T1222]
|
File and Directory Permissions Modification
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Hide_user_account_from_sign-in_screen|Hide User Account From Sign-In Screen]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Icacls_grant_command|ICACLS Grant Command]]

|
[https://attack.mitre.org/techniques/T1222/ T1222]
|
File and Directory Permissions Modification
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Icacls_deny_command|Icacls Deny Command]]

|
[https://attack.mitre.org/techniques/T1222/ T1222]
|
File and Directory Permissions Modification
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Modify_acl_permission_to_files_or_folder|Modify ACL permission To Files Or Folder]]

|
[https://attack.mitre.org/techniques/T1222/ T1222]
|
File and Directory Permissions Modification
|
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Modify_acls_permission_of_files_or_folders|Modify ACLs Permission Of Files Or Folders]]

|
[https://attack.mitre.org/techniques/T1222/ T1222]
|
File and Directory Permissions Modification
|
Defense Evasion

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Process_kill_base_on_file_path|Process Kill Base On File Path]]

|
[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
[https://attack.mitre.org/techniques/T1562/ T1562]
|
Disable or Modify Tools, 
Impair Defenses
|
Defense Evasion, 
Defense Evasion

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Schtasks_run_task_on_demand|Schtasks Run Task On Demand]]

|
[https://attack.mitre.org/techniques/T1053/ T1053]
|
Scheduled Task/Job
|
Execution, Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_driver_loaded_path|Suspicious Driver Loaded Path]]

|
[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
[https://attack.mitre.org/techniques/T1543/ T1543]
|
Windows Service, 
Create or Modify System Process
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_process_file_path|Suspicious Process File Path]]

|
[https://attack.mitre.org/techniques/T1543/ T1543]
|
Create or Modify System Process
|
Persistence, Privilege Escalation

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Xmrig_driver_loaded|XMRIG Driver Loaded]]

|
[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
[https://attack.mitre.org/techniques/T1543/ T1543]
|
Windows Service, 
Create or Modify System Process
|
Persistence, Privilege Escalation, 
Persistence, Privilege Escalation

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Command and Control

* Exploitation

* Installation


====Reference====

* https://github.com/xmrig/xmrig

* https://www.getmonero.org/resources/user-guides/mine-to-pool.html

* https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/

* https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/


''version'': 1
</div>
</div>

----



==Vulnerability==


===Apache struts vulnerability===
Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint Endpoint]
* '''Last Updated''': 2018-12-06
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Suspicious_java_classes|Suspicious Java Classes]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Unusually_long_content-type_length|Unusually Long Content-Type Length]]

|
|
|

| Anomaly
|-
| [[Documentation:ESSOC:detections:Detections#Web_servers_executing_suspicious_processes|Web Servers Executing Suspicious Processes]]

|
[https://attack.mitre.org/techniques/T1082/ T1082]
|
System Information Discovery
|
Discovery

| TTP
|}

====Kill Chain Phase====

* Actions on Objectives

* Delivery

* Exploitation


====Reference====

* https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf


''version'': 1
</div>
</div>

----

===Jboss vulnerability===
In March of 2016, adversaries were seen using JexBoss--an open-source utility used for testing and exploiting JBoss application servers. These searches help detect evidence of these attacks, such as network connections to external resources or web services spawning atypical child processes, among others.

* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''':[https://docs.splunk.com/Documentation/CIM/latest/User/Web Web]
* '''Last Updated''': 2017-09-14
* '''Use Case''': Advanced Threat Detection

<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">

====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
|-
| [[Documentation:ESSOC:detections:Detections#Detect_attackers_scanning_for_vulnerable_jboss_servers|Detect attackers scanning for vulnerable JBoss servers]]

|
[https://attack.mitre.org/techniques/T1082/ T1082]
|
System Information Discovery
|
Discovery

| TTP
|-
| [[Documentation:ESSOC:detections:Detections#Detect_malicious_requests_to_exploit_jboss_servers|Detect malicious requests to exploit JBoss servers]]

|
|
|

| TTP
|}

====Kill Chain Phase====

* Delivery

* Reconnaissance


====Reference====

* http://www.deependresearch.org/2016/04/jboss-exploits-view-from-victim.html


''version'': 1
</div>
</div>

----




<pre>
#############
# Automatically generated by doc_gen.py in https://github.com/splunk/security_content
# On Date: 2021-10-28 22:46:01.071905 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
</pre>