diff --git a/.gitignore b/.gitignore index 558ce4523f..0ac3d08ff8 100644 --- a/.gitignore +++ b/.gitignore @@ -111,3 +111,4 @@ venv.bak/ .mypy_cache/ package/bin/sftp-config.json package/default/sftp-config.json +*.code-snippets diff --git a/detections/deprecated/windows_disableantispyware_reg.yml b/detections/deprecated/windows_disableantispyware_reg.yml deleted file mode 100644 index bb43cc26ce..0000000000 --- a/detections/deprecated/windows_disableantispyware_reg.yml +++ /dev/null @@ -1,42 +0,0 @@ -name: Windows DisableAntiSpyware Registry -id: 23150a40-9301-4195-b802-5bb4f43067fb -version: 1 -date: '2020-11-06' -author: Rod Soto, Jose Hernandez, Splunk -type: batch -datamodel: -- Endpoint -description: The search looks for the Registry Key DisableAntiSpyware set to disable. - This is consistent with Ryuk infections across a fleet of endpoints. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_key_name="DisableAntiSpyware" - AND Registry.registry_value_name="DWORD (0x00000000)" by Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name | `drop_dm_object_name(Registry)` - | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_disableantispyware_registry_filter`' -how_to_implement: You must be ingesting data that records the process-system activity - from your hosts to populate the Endpoint Processes data-model object. If you are - using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which - you want to collect data. -known_false_positives: It is unusual to turn this feature on a Windows system since - it is a default security control, although it is not rare for some policies to disable - it. Although no false positives have been identified, use the provided filter macro - to tune the search. -references: [] -tags: - analytic_story: - - Ryuk Ransomware - asset_type: Endpoint - cis20: - - CIS 8 - kill_chain_phases: - - Delivery - mitre_attack_id: - - T1562.001 - nist: - - PR.PT - - DE.CM - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml new file mode 100644 index 0000000000..25c177eb71 --- /dev/null +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -0,0 +1,38 @@ +name: Any Powershell DownloadFile +id: 1a93b7ea-7af7-11eb-adb5-acde48001122 +version: 1 +date: '2021-03-01' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies the use of PowerShell downloading a file using `DownloadFile` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. + Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe) + Processes.process=*DownloadFile* by Processes.dest + Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `any_powershell_downloadfile_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: False positives may be present and filtering will need to occur by parent process or command line argument. It may be required to modify this query to an EDR product for more granular coverage. +references: +- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0 +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md +tags: + analytic_story: + - Malicious PowerShell + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + \ No newline at end of file diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml new file mode 100644 index 0000000000..acac1fcde6 --- /dev/null +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -0,0 +1,45 @@ +name: Any Powershell DownloadString +id: 4d015ef2-7adf-11eb-95da-acde48001122 +version: 1 +date: '2021-03-01' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies the use of PowerShell downloading a + file using `DownloadString` method. This particular method is utilized in many different + PowerShell frameworks to download files and output to disk. Identify the source + (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell + transaction logs are available, review for further details of the implant. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe + OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe + Processes.process=*.DownloadString* by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `any_powershell_downloadstring_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: False positives may be present and filtering will need to occur + by parent process or command line argument. It may be required to modify this query + to an EDR product for more granular coverage. +references: +- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0 +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md +tags: + analytic_story: + - Malicious PowerShell + - HAFNIUM Group + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + automated_detection_testing: passed diff --git a/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index a3db88ef9d..ad7f47f99e 100644 --- a/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -27,6 +27,7 @@ tags: analytic_story: - Malicious PowerShell - Credential Dumping + - HAFNIUM Group asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml new file mode 100644 index 0000000000..f2f415600b --- /dev/null +++ b/detections/endpoint/cobalt_strike_named_pipes.yml @@ -0,0 +1,58 @@ +name: Cobalt Strike Named Pipes +id: 5876d429-0240-4709-8b93-ea8330b411b5 +version: 1 +date: '2021-02-22' +description: 'The following analytic identifies the use of default or publicly known + named pipes used with Cobalt Strike. A named pipe is a named, one-way or duplex + pipe for communication between the pipe server and one or more pipe clients. Cobalt + Strike uses named pipes in many ways and has default values used with the Artifact + Kit and Malleable C2 Profiles. The following query assists with identifying these + default named pipes. Each EDR product presents named pipes a little different. Consider + taking the values and generating a query based on the product of choice. \ + + Upon triage, review the process performing the named pipe. If it is explorer.exe, + It is possible it was injected into by another process. Review recent parallel processes + to identify suspicious patterns or behaviors. A parallel process may have a network + connection, review and follow the connection back to identify any file modifications.' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +type: batch +datamodel: [] +references: +- https://attack.mitre.org/techniques/T1218/009/ +- https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipes +- https://www.cobaltstrike.com/help-smb-beacon +- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ +- https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752 +author: Michael Haag, Splunk +search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc*, \\DserNamePipe*, \\srvsvc_*, + \\mojo.*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*, \\winsock*) + | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, process_id + process_path, PipeName | rename Computer as dest | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `cobalt_strike_named_pipes_filter`' +known_false_positives: The idea of using named pipes with Cobalt Strike is to blend + in. Therefore, some of the named pipes identified and added may cause false positives. + Filter by process name or pipe name to reduce false positives. +tags: + analytic_story: + - Cobalt Strike + mitre_attack_id: + - T1055 + kill_chain_phases: + - Actions on Objectives + cis20: + - CIS 8 + nist: + - PR.PT + - DE.CM + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + asset_type: Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + automated_detection_testing: passed diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index 0cb8e5f687..571d3cb8b4 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -21,6 +21,7 @@ references: [] tags: analytic_story: - DHS Report TA18-074A + - HAFNIUM Group asset_type: Windows automated_detection_testing: passed cis20: diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 1750a7346a..361ac30475 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -33,6 +33,7 @@ tags: analytic_story: - SamSam Ransomware - DHS Report TA18-074A + - HAFNIUM Group asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index bb8e357082..94ebb6d16a 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -36,6 +36,7 @@ references: tags: analytic_story: - Suspicious Regsvr32 Activity + - Cobalt Strike asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index 7c2425cc66..800a9204dc 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -24,6 +24,7 @@ tags: analytic_story: - Credential Dumping - Suspicious Rundll32 Activity + - HAFNIUM Group asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index 168bf52b29..75d8b440d3 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -17,7 +17,7 @@ description: 'Detect procdump.exe dumping the lsass process. This query looks fo the command line. Review other endpoint data sources for cross process (injection) into lsass.exe.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name=procdump.exe + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=procdump.exe OR Processes.process_name=procdump64.exe (Processes.process=*-ma* OR Processes.process=*-mm*) Processes.process=*lsass* by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`' @@ -32,6 +32,7 @@ references: tags: analytic_story: - Credential Dumping + - HAFNIUM Group asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/dump_lsass_via_procdump_rename.yml b/detections/endpoint/dump_lsass_via_procdump_rename.yml index a3134f16e9..a1de6284dc 100644 --- a/detections/endpoint/dump_lsass_via_procdump_rename.yml +++ b/detections/endpoint/dump_lsass_via_procdump_rename.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Credential Dumping + - HAFNIUM Group asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml new file mode 100644 index 0000000000..653ac291df --- /dev/null +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -0,0 +1,43 @@ +name: Eventvwr UAC Bypass +id: 9cf8fe08-7ad8-11eb-9819-acde48001122 +version: 1 +date: '2021-03-01' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following search identifies Eventvwr bypass by identifying the registry + modification into a specific path that eventvwr.msc looks to (but is not valid) + upon execution. A successful attack will include a suspicious command to be executed + upon eventvwr.msc loading. Upon triage, review the parallel processes that have + executed. Identify any additional registry modifications on the endpoint that may + look suspicious. Remediate as necessary. +search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) + as registry_key_name values(Registry.registry_path) as registry_path min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*mscfile\\shell\\open\\command\\*" by + Registry.user, Registry.dest , Registry.registry_value_name| `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `eventvwr_uac_bypass_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. +known_false_positives: Some false positives may be present and will need to be filtered. +references: +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md +- https://attack.mitre.org/techniques/T1548/002 +- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ +tags: + analytic_story: + - Windows Defense Evasion Tactics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Exploitation + - Privilege Escalation + mitre_attack_id: + - T1548.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + automated_detection_testing: passed diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml new file mode 100644 index 0000000000..686b19dad2 --- /dev/null +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -0,0 +1,52 @@ +name: FodHelper UAC Bypass +id: 909f8fd8-7ac8-11eb-a1f3-acde48001122 +version: 1 +date: '2021-03-01' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: 'Fodhelper.exe has a known UAC bypass as it attempts to look for specific + registry keys upon execution, that do not exist. Therefore, an attacker can write + its malicious commands in these registry keys to be executed by fodhelper.exe with + the highest privilege. \ + + 1. `HKCU:\Software\Classes\ms-settings\shell\open\command`\ + + 1. `HKCU:\Software\Classes\ms-settings\shell\open\command\DelegateExecute`\ + + 1. `HKCU:\Software\Classes\ms-settings\shell\open\command\(default)`\ + + Upon triage, fodhelper.exe will have a child process and read access will occur + on the registry keys. Isolate the endpoint and review parallel processes for additional + behavior.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=fodhelper.exe + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `fodhelper_uac_bypass_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited to no false positives are expected. +references: +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md +- https://github.com/gushmazuko/WinBypass/blob/master/FodhelperBypass.ps1 +- https://attack.mitre.org/techniques/T1548/002 +tags: + analytic_story: + - Windows Defense Evasion Tactics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Exploitation + - Privilege Escalation + mitre_attack_id: + - T1112 + - T1548.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + automated_detection_testing: passed diff --git a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml index 1ca64442d6..97a7eecbe2 100644 --- a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml @@ -31,6 +31,7 @@ tags: analytic_story: - Malicious PowerShell - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns + - HAFNIUM Group asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index ce4c1b25d8..f1d66ed880 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -28,6 +28,7 @@ references: [] tags: analytic_story: - DHS Report TA18-074A + - HAFNIUM Group asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml new file mode 100644 index 0000000000..3610be1a0c --- /dev/null +++ b/detections/endpoint/nishang_powershelltcponeline.yml @@ -0,0 +1,45 @@ +name: Nishang PowershellTCPOneLine +id: 1a382c6c-7c2e-11eb-ac69-acde48001122 +version: 1 +date: '2021-03-03' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: This query detects the Nishang Invoke-PowerShellTCPOneLine utility that + spawns a call back to a remote command and control server. This is a powershell + oneliner. In addition, this will capture on the command-line additional utilities + used by Nishang. Triage the endpoint and identify any parallel processes that look + suspicious. Review the reputation of the remote IP or domain contacted by the powershell + process. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe + OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe + (Processes.process=*Net.Sockets.TCPClient* AND Processes.process=*System.Text.ASCIIEncoding*) by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `nishang_powershelltcponeline_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited false positives may be present. Filter as needed based + on initial analysis. +references: +- https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1 +- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/ +- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/ +- https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/ +tags: + analytic_story: + - HAFNIUM Group + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1059.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + automated_detection_testing: passed diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml index 850fadeee6..cca6984d5d 100644 --- a/detections/endpoint/ntdsutil_export_ntds.yml +++ b/detections/endpoint/ntdsutil_export_ntds.yml @@ -1,4 +1,4 @@ -name: Ntdsutil export ntds +name: Ntdsutil Export NTDS id: da63bc76-61ae-11eb-ae93-0242ac130002 version: 1 date: '2021-01-28' @@ -37,6 +37,7 @@ references: tags: analytic_story: - Credential Dumping + - HAFNIUM Group asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml new file mode 100644 index 0000000000..2c1d899302 --- /dev/null +++ b/detections/endpoint/ryuk_wake_on_lan_command.yml @@ -0,0 +1,38 @@ +name: Ryuk Wake on LAN Command +id: 538d0152-7aaa-11eb-beaa-acde48001122 +version: 1 +date: '2021-03-01' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered off devices on a compromised network to have greater success encrypting them. This is a high fidelity indicator of Ryuk ransomware executing on an endpoint. + Upon triage, isolate the endpoint. Additional file modification events will be within the users profile (\appdata\roaming) and in public directories (users\public\). Review all Scheduled Tasks on the isolated endpoint and across the fleet. Suspicious Scheduled Tasks will include a path to a unknown binary and those endpoints should be isolated until triaged. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process="*8 LAN*" OR Processes.process="*9 REP*") by Processes.dest + Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `ryuk_wake_on_lan_command_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited to no known false positives. +references: +- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/ +- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-now-self-spreads-to-other-windows-lan-devices/ +- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf +tags: + analytic_story: + - Ryuk Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ryuk/windows-sysmon.log + kill_chain_phases: + - Exploitation + - Lateral Movement + mitre_attack_id: + - T1059.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + \ No newline at end of file diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml new file mode 100644 index 0000000000..8a8836d100 --- /dev/null +++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml @@ -0,0 +1,41 @@ +name: Suspicious DLLHost no Command Line Arguments +id: ff61e98c-0337-4593-a78f-72a676c56f26 +version: 1 +date: '2021-02-23' +author: Michael Haag, Splunk +type: batch +datamodel: [] +description: The following analytic identifies DLLHost.exe with no command line arguments. + It is unusual for DLLHost.exe to execute with no command line arguments present. + This particular behavior is common with malicious software, including Cobalt Strike. + During investigation, identify any network connections and parallel processes. Identify + any suspicious module loads related to credential dumping or file writes. DLLHost.exe + is natively found in C:\Windows\system32 and C:\Windows\syswow64. +search: '`sysmon` EventID=1 (process_name=dllhost.exe OR OriginalFileName=dllhost.exe) + | regex CommandLine="(dllhost\.exe.{0,4}$)" | stats count min(_time) as firstTime + max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name, + OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `suspicious_dllhost_no_command_line_arguments_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Limited false positives may be present in small environments. + Tuning may be required based on parent process. +references: +- https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile +- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ +tags: + analytic_story: + - Cobalt Strike + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + automated_detection_testing: passed diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml new file mode 100644 index 0000000000..3601b2c19a --- /dev/null +++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml @@ -0,0 +1,41 @@ +name: Suspicious GPUpdate no Command Line Arguments +id: f308490a-473a-40ef-ae64-dd7a6eba284a +version: 1 +date: '2021-02-23' +author: Michael Haag, Splunk +type: batch +datamodel: [] +description: The following analytic identifies gpupdate.exe with no command line arguments. + It is unusual for gpupdate.exe to execute with no command line arguments present. + This particular behavior is common with malicious software, including Cobalt Strike. + During investigation, identify any network connections and parallel processes. Identify + any suspicious module loads related to credential dumping or file writes. gpupdate.exe + is natively found in C:\Windows\system32 and C:\Windows\syswow64. +search: '`sysmon` EventID=1 (process_name=gpupdate.exe OR OriginalFileName=GPUpdate.exe) + | regex CommandLine="(gpupdate\.exe.{0,4}$)" | stats count min(_time) as firstTime + max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name, + OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `suspicious_gpupdate_no_command_line_arguments_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Limited false positives may be present in small environments. + Tuning may be required based on parent process. +references: +- https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile +- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ +tags: + analytic_story: + - Cobalt Strike + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + automated_detection_testing: passed diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml index 4252a742a7..023502c92a 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - Trusted Developer Utilities Proxy Execution + - Cobalt Strike asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml index 21360144b3..d10bb10c39 100644 --- a/detections/endpoint/suspicious_msbuild_path.yml +++ b/detections/endpoint/suspicious_msbuild_path.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Trusted Developer Utilities Proxy Execution MSBuild + - Cobalt Strike asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml index d1144fcfc8..83b0a7f78b 100644 --- a/detections/endpoint/suspicious_msbuild_rename.yml +++ b/detections/endpoint/suspicious_msbuild_rename.yml @@ -27,6 +27,7 @@ references: tags: analytic_story: - Trusted Developer Utilities Proxy Execution MSBuild + - Cobalt Strike asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml index 7c062b319c..e448aace4e 100644 --- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml @@ -1,4 +1,4 @@ -name: Suspicious Rundll32 no CommandLine Arguments +name: Suspicious Rundll32 no Command Line Arguments id: e451bd16-e4c5-4109-8eb1-c4c6ecf048b4 version: 1 date: '2021-02-09' @@ -15,7 +15,7 @@ search: '`sysmon` EventID=1 (process_name=rundll32.exe OR OriginalFileName=RUNDL | regex CommandLine="(rundll32\.exe.{0,4}$)" | stats count min(_time) as firstTime max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `suspicious_rundll32_no_commandline_arguments_filter`' + | `security_content_ctime(lastTime)` | `suspicious_rundll32_no_command_line_arguments_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml new file mode 100644 index 0000000000..26e0ceb588 --- /dev/null +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -0,0 +1,45 @@ +name: Suspicious Scheduled Task from Public Directory +id: 7feb7972-7ac3-11eb-bac8-acde48001122 +version: 1 +date: '2021-03-01' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following detection identifies Scheduled Tasks registering (creating + a new task) a binary or script to run from a public directory which includes users\public, + \programdata\ and \windows\temp. Upon triage, review the binary or script in the + command line for legitimacy, whether an approved binary/script or not. In addition, + capture the binary or script in question and analyze for further behaviors. Identify + the source and contain the endpoint. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe + (Processes.process=*\\users\\public\\* OR Processes.process=*\\programdata\\* OR + Processes.process=*windows\\temp*) Processes.process=*/create* by Processes.dest + Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `suspicious_scheduled_task_from_public_directory_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited false positives may be present. Filter as needed by + parent process or command line argument. +references: +- https://attack.mitre.org/techniques/T1053/005/ +tags: + analytic_story: + - Ransomware + - Ryuk Ransomware + - Windows Persistence Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon.log + kill_chain_phases: + - Exploitation + - Privilege Escalation + mitre_attack_id: + - T1053.005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + automated_detection_testing: passed diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml new file mode 100644 index 0000000000..77041734ab --- /dev/null +++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml @@ -0,0 +1,41 @@ +name: Suspicious SearchProtocolHost no Command Line Arguments +id: f52d2db8-31f9-4aa7-a176-25779effe55c +version: 1 +date: '2021-02-23' +author: Michael Haag, Splunk +type: batch +datamodel: [] +description: The following analytic identifies searchprotocolhost.exe with no command + line arguments. It is unusual for searchprotocolhost.exe to execute with no command + line arguments present. This particular behavior is common with malicious software, + including Cobalt Strike. During investigation, identify any network connections + and parallel processes. Identify any suspicious module loads related to credential + dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 + and C:\Windows\syswow64. +search: '`sysmon` EventID=1 (process_name=searchprotocolhost.exe OR OriginalFileName=SearchProtocolHost.exe) + | regex CommandLine="(searchprotocolhost\.exe.{0,4}$)" | stats count min(_time) + as firstTime max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, + process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_searchprotocolhost_no_command_line_arguments_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Limited false positives may be present in small environments. + Tuning may be required based on parent process. +references: +- https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc +tags: + analytic_story: + - Cobalt Strike + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + automated_detection_testing: passed diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml new file mode 100644 index 0000000000..3eb088638b --- /dev/null +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -0,0 +1,50 @@ +name: Windows DisableAntiSpyware Registry +id: 23150a40-9301-4195-b802-5bb4f43067fb +version: 2 +date: '2021-03-02' +author: Rod Soto, Jose Hernandez, Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The search looks for the Registry Key DisableAntiSpyware set to disable. + This is consistent with Ryuk infections across a fleet of endpoints. This particular + behavior is typically executed when an ransomware actor gains access to an endpoint + and beings to perform execution. Usually, a batch (.bat) will be executed and multiple + registry and scheduled task modifications will occur. During triage, review parallel + processes and identify any further file modifications. Endpoint should be isolated. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_key_name="DisableAntiSpyware" + AND Registry.registry_value_name="DWORD (0x00000001)" by Registry.dest Registry.user + Registry.registry_path Registry.registry_value_name | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_disableantispyware_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. +known_false_positives: It is unusual to turn this feature off a Windows system since + it is a default security control, although it is not rare for some policies to disable + it. Although no false positives have been identified, use the provided filter macro + to tune the search. +references: +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +tags: + analytic_story: + - Ryuk Ransomware + - Windows Defense Evasion Tactics + asset_type: Endpoint + cis20: + - CIS 8 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Delivery + mitre_attack_id: + - T1562.001 + nist: + - PR.PT + - DE.CM + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml b/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml index e829ed6c99..7e8aacb673 100644 --- a/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml +++ b/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml @@ -37,6 +37,7 @@ references: [] tags: analytic_story: - Collection and Staging + - HAFNIUM Group asset_type: Endpoint cis20: - CIS 7 diff --git a/detections/experimental/endpoint/suspicious_curl_network_connection.yml b/detections/experimental/endpoint/suspicious_curl_network_connection.yml new file mode 100644 index 0000000000..77cfa71ba9 --- /dev/null +++ b/detections/experimental/endpoint/suspicious_curl_network_connection.yml @@ -0,0 +1,37 @@ +name: Suspicious Curl Network Connection +id: 3f613dc0-21f2-4063-93b1-5d3c15eef22f +version: 1 +date: '2021-02-22' +description: 'The following analytic identifies the use of a curl contacting suspicious remote domains to checkin to command and control servers or download further implants. + In the context of Silver Sparrow, curl is identified contacting s3.amazonaws.com. This particular behavior is common with MacOS adware-malicious software.' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +type: batch +datamodel: +- Endpoint +references: +- https://redcanary.com/blog/clipping-silver-sparrows-wings/ +- https://marcosantadev.com/manage-plist-files-plistbuddy/ +author: Michael Haag, Splunk +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl + Processes.process=s3.amazonaws.com by Processes.dest + Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_curl_network_connection_filter`' +known_false_positives: Unknown. Filter as needed. +tags: + analytic_story: + - Silver Sparrow + mitre_attack_id: + - T1105 + kill_chain_phases: + - Actions on Objectives + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + asset_type: Endpoint + dataset: [] diff --git a/detections/experimental/endpoint/suspicious_plistbuddy_usage.yml b/detections/experimental/endpoint/suspicious_plistbuddy_usage.yml new file mode 100644 index 0000000000..b8600c55eb --- /dev/null +++ b/detections/experimental/endpoint/suspicious_plistbuddy_usage.yml @@ -0,0 +1,51 @@ +name: Suspicious PlistBuddy Usage +id: c3194009-e0eb-4f84-87a9-4070f8688f00 +version: 1 +date: '2021-02-22' +description: 'The following analytic identifies the use of a native MacOS utility, PlistBuddy, creating or modifying a properly list (.plist) file. In the instance of Silver Sparrow, + the following commands were executed:\ + + - PlistBuddy -c "Add :Label string init_verx" ~/Library/Launchagents/init_verx.plist \ + + - PlistBuddy -c "Add :RunAtLoad bool true" ~/Library/Launchagents/init_verx.plist \ + + - PlistBuddy -c "Add :StartInterval integer 3600" ~/Library/Launchagents/init_verx.plist \ + + - PlistBuddy -c "Add :ProgramArguments array" ~/Library/Launchagents/init_verx.plist \ + + - PlistBuddy -c "Add :ProgramArguments:0 string /bin/sh" ~/Library/Launchagents/init_verx.plist \ + + - PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist \ + + Upon triage, capture the property list file being written to disk and review for further indicators. Contain the endpoint and triage further.' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +type: batch +datamodel: +- Endpoint +references: +- https://redcanary.com/blog/clipping-silver-sparrows-wings/ +- https://marcosantadev.com/manage-plist-files-plistbuddy/ +author: Michael Haag, Splunk +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=PlistBuddy + (Processes.process=*LaunchAgents* OR Processes.process=*RunAtLoad* OR Processes.process=*true*) by Processes.dest + Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_plistbuddy_usage_filter`' +known_false_positives: Some legitimate applications may use PlistBuddy to create or modify property lists and possibly generate false positives. Review the property list being modified or created to confirm. +tags: + analytic_story: + - Silver Sparrow + mitre_attack_id: + - T1543.001 + kill_chain_phases: + - Actions on Objectives + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + asset_type: Endpoint + dataset: [] diff --git a/detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml b/detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml new file mode 100644 index 0000000000..f3d2c0d72f --- /dev/null +++ b/detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml @@ -0,0 +1,44 @@ +name: Suspicious PlistBuddy Usage via OSquery +id: 20ba6c32-c733-4a32-b64e-2688cf231399 +version: 1 +date: '2021-02-22' +description: 'The following analytic identifies the use of a native MacOS utility, PlistBuddy, creating or modifying a properly list (.plist) file. In the instance of Silver Sparrow, + the following commands were executed:\ + + - PlistBuddy -c "Add :Label string init_verx" ~/Library/Launchagents/init_verx.plist \ + + - PlistBuddy -c "Add :RunAtLoad bool true" ~/Library/Launchagents/init_verx.plist \ + + - PlistBuddy -c "Add :StartInterval integer 3600" ~/Library/Launchagents/init_verx.plist \ + + - PlistBuddy -c "Add :ProgramArguments array" ~/Library/Launchagents/init_verx.plist \ + + - PlistBuddy -c "Add :ProgramArguments:0 string /bin/sh" ~/Library/Launchagents/init_verx.plist \ + + - PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist \ + + Upon triage, capture the property list file being written to disk and review for further indicators. Contain the endpoint and triage further.' +how_to_implement: OSQuery must be installed and configured to pick up process events (info + at https://osquery.io) as well as using the Splunk OSQuery Add-on https://splunkbase.splunk.com/app/4402. Modify the macro and validate fields are correct. +type: batch +datamodel: [] +references: +- https://redcanary.com/blog/clipping-silver-sparrows-wings/ +- https://marcosantadev.com/manage-plist-files-plistbuddy/ +author: Michael Haag, Splunk +search: '`osquery_process` "columns.cmdline"="*LaunchAgents*" OR "columns.cmdline"="*RunAtLoad*" OR "columns.cmdline"="*true*" | `suspicious_plistbuddy_usage_via_osquery_filter`' +known_false_positives: Some legitimate applications may use PlistBuddy to create or modify property lists and possibly generate false positives. Review the property list being modified or created to confirm. +tags: + analytic_story: + - Silver Sparrow + mitre_attack_id: + - T1543.001 + kill_chain_phases: + - Actions on Objectives + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + asset_type: Endpoint + dataset: [] diff --git a/detections/experimental/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml b/detections/experimental/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml new file mode 100644 index 0000000000..31d0b5c9de --- /dev/null +++ b/detections/experimental/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml @@ -0,0 +1,37 @@ +name: Suspicious SQLite3 LSQuarantine Behavior +id: e1997b2e-655f-4561-82fd-aeba8e1c1a86 +version: 1 +date: '2021-02-22' +description: 'The following analytic identifies the use of a SQLite3 querying the MacOS preferences to identify the original URL the pkg was downloaded from. + This particular behavior is common with MacOS adware-malicious software. Upon triage, review other processes in parallel for suspicious activity. Identify any recent package installations.' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +type: batch +datamodel: +- Endpoint +references: +- https://redcanary.com/blog/clipping-silver-sparrows-wings/ +- https://marcosantadev.com/manage-plist-files-plistbuddy/ +author: Michael Haag, Splunk +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=sqlite3 + Processes.process=*LSQuarantine* by Processes.dest + Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_sqlite3_lsquarantine_behavior_filter`' +known_false_positives: Unknown. +tags: + analytic_story: + - Silver Sparrow + mitre_attack_id: + - T1074 + kill_chain_phases: + - Actions on Objectives + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + asset_type: Endpoint + dataset: [] diff --git a/detections/experimental/endpoint/unified_messaging_service_spawning_a_process.yml b/detections/experimental/endpoint/unified_messaging_service_spawning_a_process.yml new file mode 100644 index 0000000000..73f783c19c --- /dev/null +++ b/detections/experimental/endpoint/unified_messaging_service_spawning_a_process.yml @@ -0,0 +1,43 @@ +name: Unified Messaging Service Spawning a Process +id: f1126df0-7bd5-11eb-988f-acde48001122 +version: 1 +date: '2021-03-02' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: This detection identifies Microsoft Exchange Server's Unified Messaging services, + umworkerprocess.exe and umservice.exe, spawning a child process, indicating possible exploitation + of CVE-2021-26857 vulnerability. The query filters out werfault.exe and wermgr.exe mostly due to + potential false positives, however, if there is an excessive amount of "wermgr.exe" or "WerFault.exe" + failures, it may be due to the active exploitation. + During triage, identify any additional suspicious parallel processes. Identify any recent out of + place file modifications. Review Exchange logs following Microsofts guide. To contain, perform + egress filtering or restrict public access to Exchange. In final, patch the vulnerablity and monitor. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="umworkerprocess.exe" OR Processes.parent_process_name="UMService.exe" (Processes.process_name!="wermgr.exe" OR Processes.process_name!="werfault.exe") + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `unified_messaging_service_spawning_a_process_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Unknown. Tune out child processes as needed to limit volume of false positives. +references: +- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/ +- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/ +- https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/ +tags: + analytic_story: + - HAFNIUM Group + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1190 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + \ No newline at end of file diff --git a/detections/experimental/endpoint/w3wp_spawning_shell.yml b/detections/experimental/endpoint/w3wp_spawning_shell.yml new file mode 100644 index 0000000000..8ecf756e98 --- /dev/null +++ b/detections/experimental/endpoint/w3wp_spawning_shell.yml @@ -0,0 +1,35 @@ +name: W3WP Spawning Shell +id: 0f03423c-7c6a-11eb-bc47-acde48001122 +version: 1 +date: '2021-03-03' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe, or IIS. In addition to IIS logs, this behavior with an EDR product will capture potential webshell activity, similar to the HAFNIUM Group abusing CVEs, on publicly available Exchange mail servers. + During triage, review the parent process and child process of the shell being spawned. Review the command-line arguments and any file modifications that may occur. Identify additional parallel process, child processes, that may highlight further commands executed. After triaging, work to contain the threat and patch the system that is vulnerable. +search: '| tstats `security_content_summariesonly` count values(Processes.process_name) + as process_name values(Processes.process) as process min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=w3wp.exe + AND Processes.process_name=cmd.exe OR Processes.process_name=powershell.exe by Processes.dest Processes.parent_process + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `w3wp_spawning_shell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Baseline your environment before production. It is possible build systems using IIS will spawn cmd.exe to perform a software build. Filter as needed. +references: +- https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/ +tags: + analytic_story: + - HAFNIUM Group + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1505.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + \ No newline at end of file diff --git a/stories/cobalt_strike.yml b/stories/cobalt_strike.yml index 5db3a3fd72..bb4cc786aa 100644 --- a/stories/cobalt_strike.yml +++ b/stories/cobalt_strike.yml @@ -7,18 +7,28 @@ type: batch description: Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility. narrative: 'This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Cobalt Strike. Cobalt Strike has many ways to be enhanced by using aggressor scripts, malleable C2 profiles, default attack packages, and much more. - For endpoint behavior, Cobalt Strike is most commonly identified via named pipes, spawn to processes, and DLL function names. - On the network, depending on the malleable C2 profile used, it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt Strike.\ + For endpoint behavior, Cobalt Strike is most commonly identified via named pipes, spawn to processes, and DLL function names. Many additional variables are provided for in memory operation of the beacon implant. + On the network, depending on the malleable C2 profile used, it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt Strike. + Not every query may be specific to Cobalt Strike the tool, but the methodologies and techniques used by it.\ + Splunk Threat Research reviewed all publicly available instances of Malleabe C2 Profiles and generated a list of the most commonly used spawnto and pipenames.\ + + `Spawnto_x86` and `spawnto_x64` is the process that Cobalt Strike will spawn and injects shellcode into.\ + + Pipename sets the named pipe name used in Cobalt Strikes Beacon SMB C2 traffic.\ + + With that, new detections were generated focused on these spawnto processes spawning without command line arguments. Similar, the named pipes most commonly used by Cobalt Strike added as a detection. In generating content for Cobalt Strike, the following is considered:\ - 1. Is it normal for to have no command line arguments? No command line arguments and a network connection?\ + - Is it normal for spawnto_ value to have no command line arguments? No command line arguments and a network connection?\ - 1. What is the default, or normal, process lineage for ?\ + - What is the default, or normal, process lineage for spawnto_ value?\ - 1. Does the make network connections?\ + - Does the spawnto_ value make network connections?\ - 1. Is it normal for to load jscript, vbscript, Amsi.dll, and clr.dll?.' + - Is it normal for spawnto_ value to load jscript, vbscript, Amsi.dll, and clr.dll?\ + + While investigating a detection related to this Analytic Story, keep in mind the parent process, process path, and any file modifications that may occur. Tuning may need to occur to remove any false positives.' references: - https://www.cobaltstrike.com/ @@ -26,6 +36,8 @@ references: - https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/ - https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html - https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html +- https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence +- https://github.com/zer0yu/Awesome-CobaltStrike tags: analytic_story: Cobalt Strike category: diff --git a/stories/hafnium_group.yml b/stories/hafnium_group.yml new file mode 100644 index 0000000000..f6647be9e5 --- /dev/null +++ b/stories/hafnium_group.yml @@ -0,0 +1,27 @@ +name: HAFNIUM Group +id: beae2ab0-7c3f-11eb-8b63-acde48001122 +version: 1 +date: '2021-03-03' +author: Michael Haag, Splunk +type: batch +description: HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVEs in the wild - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065. +narrative: 'On Tuesday, March 2, 2021, Microsoft released a set of security patches for its mail server, Microsoft Exchange. These patches respond to a group of vulnerabilities known to impact Exchange 2013, 2016, and 2019. It is important to note that an Exchange 2010 security update has also been issued, though the CVEs do not reference that version as being vulnerable.\ + + While the CVEs do not shed much light on the specifics of the vulnerabilities or exploits, the first vulnerability (CVE-2021-26855) has a remote network attack vector that allows the attacker, a group Microsoft named HAFNIUM, to authenticate as the Exchange server. Three additional vulnerabilities (CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) were also identified as part of this activity. When chained together along with CVE-2021-26855 for initial access, the attacker would have complete control over the Exchange server. This includes the ability to run code as SYSTEM and write to any path on the server.\ + + The following Splunk detections assist with identifying the HAFNIUM groups tradecraft and methodology.' +references: +- https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html +- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/ +- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/ +- https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/ +tags: + analytic_story: + - HAFNIUM Group + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/silver_sparrow.yml b/stories/silver_sparrow.yml new file mode 100644 index 0000000000..2c9ea4f838 --- /dev/null +++ b/stories/silver_sparrow.yml @@ -0,0 +1,24 @@ +name: Silver Sparrow +id: cb4f48fe-7699-11eb-af77-acde48001122 +version: 1 +date: '2021-02-24' +author: Michael Haag, Splunk +type: batch +description: Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking MacOS (Intel and M1) malicious software downloader utilizing JavaScript for execution and a launchAgent to establish persistence. +narrative: 'Silver Sparrow works is a dropper and uses typical persistence mechanisms on a Mac. It is cross platform, covering both Intel and Apple M1 architecture. + To this date, no implant has been downloaded for malicious purposes. During installation of the update.pkg or updater.pkg file, the malicious software utilizes JavaScript to generate files and scripts on disk for persistence.These files later download a implant from an S3 bucket every hour. + This analytic assists with identifying different types of macOS malware families establishing LaunchAgent persistence. + Per SentinelOne source, it is predicted that Silver Sparrow is likely selling itself as a mechanism to 3rd party “affiliates” or pay-per-install (PPI) partners, typically seen as commodity adware/malware. + Additional indicators and behaviors may be found within the references.' +references: +- https://redcanary.com/blog/clipping-silver-sparrows-wings/ +- https://www.sentinelone.com/blog/5-things-you-need-to-know-about-silver-sparrow/ +tags: + analytic_story: Silver Sparrow + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/suspicious_mshta_activity.yml b/stories/suspicious_mshta_activity.yml index bf10152d8e..71e73efbbf 100644 --- a/stories/suspicious_mshta_activity.yml +++ b/stories/suspicious_mshta_activity.yml @@ -15,13 +15,19 @@ narrative: 'One common adversary tactic is to bypass application control solutio The searches in this story help you detect and investigate suspicious activity that may indicate that an attacker is leveraging mshta.exe to execute malicious code.\ - Triage\ Validate execution \ 1. Determine if MSHTA.exe executed. Validate the OriginalFileName + Triage\ + + Validate execution \ + + 1. Determine if MSHTA.exe executed. Validate the OriginalFileName of MSHTA.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.\ 1. Determine if script code was executed with MSHTA.\ - Situational Awareness\ The objective of this step is meant to identify suspicious + Situational Awareness\ + + The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSHTA.exe.\ 1. Parent process. Is the parent process a known LOLBin? Is the parent process an @@ -33,7 +39,9 @@ narrative: 'One common adversary tactic is to bypass application control solutio 1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\ - Retrieval of script code\ The objective of this step is to confirm the executed + Retrieval of script code\ + + The objective of this step is to confirm the executed script code is benign or malicious.' references: - https://redcanary.com/blog/introducing-atomictestharnesses/ diff --git a/tests/endpoint/any_powershell_downloadfile.test.yml b/tests/endpoint/any_powershell_downloadfile.test.yml new file mode 100644 index 0000000000..e972ca5e31 --- /dev/null +++ b/tests/endpoint/any_powershell_downloadfile.test.yml @@ -0,0 +1,12 @@ +name: Any Powershell DownloadFile Unit Test +tests: +- name: Any Powershell DownloadFile + file: endpoint/any_powershell_downloadfile.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/any_powershell_downloadstring.test.yml b/tests/endpoint/any_powershell_downloadstring.test.yml new file mode 100644 index 0000000000..122ff59583 --- /dev/null +++ b/tests/endpoint/any_powershell_downloadstring.test.yml @@ -0,0 +1,12 @@ +name: Any Powershell DownloadString Unit Test +tests: +- name: Any Powershell DownloadString + file: endpoint/any_powershell_downloadstring.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/cobalt_strike_named_pipes.test.yml b/tests/endpoint/cobalt_strike_named_pipes.test.yml new file mode 100644 index 0000000000..26e57ea485 --- /dev/null +++ b/tests/endpoint/cobalt_strike_named_pipes.test.yml @@ -0,0 +1,12 @@ +name: Cobalt Strike Named Pipes Unit Test +tests: +- name: Cobalt Strike Named Pipes + file: endpoint/cobalt_strike_named_pipes.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/eventvwr_uac_bypass.test.yml b/tests/endpoint/eventvwr_uac_bypass.test.yml new file mode 100644 index 0000000000..27cbf0b7ce --- /dev/null +++ b/tests/endpoint/eventvwr_uac_bypass.test.yml @@ -0,0 +1,12 @@ +name: Eventvwr UAC Bypass Unit Test +tests: +- name: Eventvwr UAC Bypass + file: endpoint/eventvwr_uac_bypass.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/fodhelper_uac_bypass.test.yml b/tests/endpoint/fodhelper_uac_bypass.test.yml new file mode 100644 index 0000000000..ad95587bd1 --- /dev/null +++ b/tests/endpoint/fodhelper_uac_bypass.test.yml @@ -0,0 +1,12 @@ +name: FodHelper UAC Bypass Unit Test +tests: +- name: FodHelper UAC Bypass + file: endpoint/fodhelper_uac_bypass.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/nishang_powershelltcponeline.test.yml b/tests/endpoint/nishang_powershelltcponeline.test.yml new file mode 100644 index 0000000000..13c85185a5 --- /dev/null +++ b/tests/endpoint/nishang_powershelltcponeline.test.yml @@ -0,0 +1,12 @@ +name: Nishang PowershellTCPOneLine Unit Test +tests: +- name: Nishang PowershellTCPOneLine + file: endpoint/nishang_powershelltcponeline.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/ryuk_wake_on_lan_command.test.yml b/tests/endpoint/ryuk_wake_on_lan_command.test.yml new file mode 100644 index 0000000000..1d542adcc2 --- /dev/null +++ b/tests/endpoint/ryuk_wake_on_lan_command.test.yml @@ -0,0 +1,12 @@ +name: Ryuk Wake on LAN Command Unit Test +tests: +- name: Ryuk Wake on LAN Command + file: endpoint/ryuk_wake_on_lan_command.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ryuk/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_dllhost_no_command_line_arguments.test.yml b/tests/endpoint/suspicious_dllhost_no_command_line_arguments.test.yml new file mode 100644 index 0000000000..32e85893de --- /dev/null +++ b/tests/endpoint/suspicious_dllhost_no_command_line_arguments.test.yml @@ -0,0 +1,12 @@ +name: Suspicious DLLHost no command line arguments Unit Test +tests: +- name: Suspicious DLLHost no Command Line Arguments + file: endpoint/suspicious_dllhost_no_command_line_arguments.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_gpupdate_no_command_line_arguments.test.yml b/tests/endpoint/suspicious_gpupdate_no_command_line_arguments.test.yml new file mode 100644 index 0000000000..ddc754c4f6 --- /dev/null +++ b/tests/endpoint/suspicious_gpupdate_no_command_line_arguments.test.yml @@ -0,0 +1,12 @@ +name: Suspicious GPUpdate no Command Line Arguments Unit Test +tests: +- name: Suspicious GPUpdate no Command Line Arguments + file: endpoint/suspicious_gpupdate_no_command_line_arguments.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_scheduled_task_from_public_directory.test.yml b/tests/endpoint/suspicious_scheduled_task_from_public_directory.test.yml new file mode 100644 index 0000000000..0d93992299 --- /dev/null +++ b/tests/endpoint/suspicious_scheduled_task_from_public_directory.test.yml @@ -0,0 +1,12 @@ +name: Suspicious Scheduled Task from Public Directory Unit Test +tests: +- name: Suspicious Scheduled Task from Public Directory + file: endpoint/suspicious_scheduled_task_from_public_directory.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.test.yml b/tests/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.test.yml new file mode 100644 index 0000000000..baa7ec883c --- /dev/null +++ b/tests/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.test.yml @@ -0,0 +1,12 @@ +name: Suspicious SearchProtocolHost no Command Line Arguments Unit Test +tests: +- name: Suspicious SearchProtocolHost no Command Line Arguments + file: endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/windows_disableantispyware_reg.test.yml b/tests/endpoint/windows_disableantispyware_reg.test.yml new file mode 100644 index 0000000000..806f786399 --- /dev/null +++ b/tests/endpoint/windows_disableantispyware_reg.test.yml @@ -0,0 +1,12 @@ +name: Windows Disable Antispyware Reg Unit Test +tests: +- name: Windows Disable Antispyware Reg + file: endpoint/windows_disableantispyware_reg.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog