Analytic Updates - 01262021

detections/endpoint/detect_mshta_inline_hta_execution.yml

@@ -0,0 +1,45 @@
+name: Detect mshta inline hta execution
+id: a0873b32-5b68-11eb-ae93-0242ac130002
+version: 5
+date: '2021-01-20'
+description: The following analytic identifies "mshta.exe" execution with inline
+  protocol handlers. "JavaScript", "VBScript", and "About" are the only supported
+  options when invoking HTA content directly on the command-line. The search will 
+  return the first time and last time these command-line arguments were used for 
+  these executions, as well as the target system, the user, process "mshta.exe" 
+  and its parent process.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
+author: Bhavin Patel, Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process)
+  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
+  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mshta.exe
+  (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*) by Processes.user
+  Processes.process_name Processes.parent_process_name Processes.dest  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` 
+  | `detect_mshta_inline_hta_execution_filter`'
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious MSHTA Activity
+  mitre_attack_id:
+  - T1218.005
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log

detections/endpoint/detect_mshta_renamed.yml

@@ -0,0 +1,41 @@
+name: Detect mshta renamed
+id: 8f45fcf0-5b68-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-20'
+description: The following analytic identifies renamed instances of mshta.exe executing.
+  Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This
+  analytic utilizes the internal name of the PE to identify if is the legitimate
+  mshta binary. Further analysis should be performed to review the executed content 
+  and validation it is the real mshta. 
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: ESCU
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=1 (OriginalFileName=mshta.exe AND process_name!=mshta.exe)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
+  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `detect_mshta_renamed_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of mshta.exe, but never renamed, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious MSHTA Activity
+  mitre_attack_id:
+  - T1218.005
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log

detections/endpoint/detect_mshta_url_in_command_line.yml

@@ -0,0 +1,45 @@
+name: Detect MSHTA Url in Command Line
+id: 9b3af1e6-5b68-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-20'
+description: This analytic identifies when Microsoft HTML Application Host (mshta.exe)
+  utility is used to make remote http connections. Adversaries may use mshta.exe to
+  proxy the download and execution of remote .hta files. The analytic identifies command
+  line arguments of http and https being used. This technique is commonly used by
+  malicious software to bypass preventative controls. The search will return the first
+  time and last time these command-line arguments were used for these executions,
+  as well as the target system, the user, process "rundll32.exe" and its parent process.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process)
+  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
+  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mshta.exe
+  (Processes.process="*http://*" OR Processes.process="*https://*") by Processes.user
+  Processes.process_name Processes.parent_process_name Processes.dest  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_mshta_url_in_command_line_filter`'
+known_false_positives: It is possible legitimate applications may perform this behavior
+  and will need to be filtered.
+tags:
+  analytics_story:
+  - Suspicious MSHTA Activity
+  mitre_attack_id:
+  - T1218.005
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

detections/endpoint/detect_rundll32_inline_hta_execution.yml

@@ -0,0 +1,46 @@
+name: Detect Rundll32 Inline HTA Execution
+id: 91c79f14-5b41-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-20'
+description: The following analytic identifies "rundll32.exe" execution with inline
+  protocol handlers. "JavaScript", "VBScript", and "About" are the only supported
+  options when invoking HTA content directly on the command-line. This type of behavior
+  is commonly observed with fileless malware or application whitelisting bypass techniques.
+  The search will return the first time and last time these command-line arguments
+  were used for these executions, as well as the target system, the user, process
+  "rundll32.exe" and its parent process.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process)
+  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
+  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*)
+  by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
+  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `detect_rundll32_inline_hta_execution_filter`'
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious MSHTA Activity
+  mitre_attack_id:
+  - T1218.005
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

detections/endpoint/nltest_domain_trust_discovery.yml

@@ -0,0 +1,47 @@
+name: NLTest Domain Trust Discovery
+id: c3e05466-5f22-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-25'
+description: This search looks for the execution of `nltest.exe` with command-line
+  arguments utilized to query for Domain Trust information. Two arguments `/domain
+  trusts`, returns a list of trusted domains, and `/all_trusts`, returns all trusted
+  domains. Red Teams and adversaries alike use NLTest.exe to enumerate the current
+  domain to assist with further understanding where to pivot next.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md
+- https://malware.news/t/lets-learn-trickbot-implements-network-collector-module-leveraging-cmd-wmi-ldap/19104
+- https://attack.mitre.org/techniques/T1482/
+- https://www.owasp.org/images/4/4b/Red_Team_Operating_in_a_Modern_Environment.pdf
+- https://ss64.com/nt/nltest.html
+- https://redcanary.com/threat-detection-report/techniques/domain-trust-discovery/
+- https://thedfirreport.com/2020/10/08/ryuks-return/
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=nltest.exe
+  OR Processes.process_name!=nltest.exe) (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*)
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `nltest_domain_trust_discovery_filter`'
+known_false_positives: Administrators may use nltest for troubleshooting purposes,
+  otherwise, rarely used.
+tags:
+  analytics_story:
+  - Ryuk Ransomware
+  mitre_attack_id:
+  - T1482
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed

detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml

@@ -0,0 +1,43 @@
+name: Suspicious microsoft workflow compiler rename
+id: f0db4464-55d9-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe.
+  Microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319
+  and is rarely utilized. When investigating, identify the executed code on disk and
+  review. A spawned child process from microsoft.workflow.compiler.exe is uncommon.
+  In any instance, microsoft.workflow.compiler.exe spawning from an Office product
+  or any living off the land binary is highly suspect.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=1 (OriginalFileName=microsoft.workflow.compiler.exe OR process_name=microsoft.workflow.compiler.exe)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
+  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `suspicious_microsoft_workflow_compiler_rename_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of microsoft.workflow.compiler.exe, triggering a false positive.
+tags:
+  analytics_story:
+  - Trusted Developer Utilities Proxy Execution
+  mitre_attack_id:
+  - T1127, T1036.003
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log
+  automated_detection_testing: passed

detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml

@@ -0,0 +1,40 @@
+name: Suspicious microsoft workflow compiler usage
+id: 9bbc62e8-55d8-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies microsoft.workflow.compiler.exe usage.
+  microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319
+  and is rarely utilized. When investigating, identify the executed code on disk and
+  review. It is not a commonly used process by many applications.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=microsoft.workflow.compiler.exe
+  by Processes.dest Processes.parent_process Processes.user | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_microsoft_workflow_compiler_usage_filter`'
+known_false_positives: Although unlikely, limited instances have been identified coming
+  from native Microsoft utilities similar to SCCM.
+tags:
+  analytics_story:
+  - Trusted Developer Utilities Proxy Execution
+  mitre_attack_id:
+  - T1127
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log
+  automated_detection_testing: passed