WIP - 02Rel3

.gitignore

@@ -111,3 +111,4 @@ venv.bak/
 .mypy_cache/
 package/bin/sftp-config.json
 package/default/sftp-config.json
+*.code-snippets

detections/endpoint/any_powershell_downloadfile.yml

@@ -0,0 +1,38 @@
+name: Any Powershell DownloadFile
+id: 1a93b7ea-7af7-11eb-adb5-acde48001122
+version: 1
+date: '2021-03-01'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of PowerShell downloading a file using `DownloadFile` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. 
+  Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe)
+  Processes.process=*DownloadFile* by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `any_powershell_downloadfile_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: False positives may be present and filtering will need to occur by parent process or command line argument. It may be required to modify this query to an EDR product for more granular coverage.
+references:
+- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+

detections/endpoint/any_powershell_downloadstring.yml

@@ -0,0 +1,45 @@
+name: Any Powershell DownloadString
+id: 4d015ef2-7adf-11eb-95da-acde48001122
+version: 1
+date: '2021-03-01'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of PowerShell downloading a
+  file using `DownloadString` method. This particular method is utilized in many different
+  PowerShell frameworks to download files and output to disk. Identify the source
+  (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
+  transaction logs are available, review for further details of the implant.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe
+  OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe
+  Processes.process=*.DownloadString*  by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `any_powershell_downloadstring_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: False positives may be present and filtering will need to occur
+  by parent process or command line argument. It may be required to modify this query
+  to an EDR product for more granular coverage.
+references:
+- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  - HAFNIUM Group
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  automated_detection_testing: passed

detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml

@@ -27,6 +27,7 @@ tags:
   analytic_story:
   - Malicious PowerShell
   - Credential Dumping
+  - HAFNIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/cobalt_strike_named_pipes.yml

@@ -0,0 +1,58 @@
+name: Cobalt Strike Named Pipes
+id: 5876d429-0240-4709-8b93-ea8330b411b5
+version: 1
+date: '2021-02-22'
+description: 'The following analytic identifies the use of default or publicly known
+  named pipes used with Cobalt Strike. A named pipe is a named, one-way or duplex
+  pipe for communication between the pipe server and one or more pipe clients. Cobalt
+  Strike uses named pipes in many ways and has default values used with the Artifact
+  Kit and Malleable C2 Profiles. The following query assists with identifying these
+  default named pipes. Each EDR product presents named pipes a little different. Consider
+  taking the values and generating a query based on the product of choice. \
+
+  Upon triage, review the process performing the named pipe. If it is explorer.exe,
+  It is possible it was injected into by another process. Review recent parallel processes
+  to identify suspicious patterns or behaviors. A parallel process may have a network
+  connection, review and follow the connection back to identify any file modifications.'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: batch
+datamodel: []
+references:
+- https://attack.mitre.org/techniques/T1218/009/
+- https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipes
+- https://www.cobaltstrike.com/help-smb-beacon
+- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
+- https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc*, \\DserNamePipe*, \\srvsvc_*,
+  \\mojo.*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*, \\winsock*)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, process_id
+  process_path, PipeName | rename Computer as dest | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `cobalt_strike_named_pipes_filter`'
+known_false_positives: The idea of using named pipes with Cobalt Strike is to blend
+  in. Therefore, some of the named pipes identified and added may cause false positives.
+  Filter by process name or pipe name to reduce false positives.
+tags:
+  analytic_story:
+  - Cobalt Strike
+  mitre_attack_id:
+  - T1055
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+  automated_detection_testing: passed

detections/endpoint/detect_new_local_admin_account.yml

@@ -21,6 +21,7 @@ references: []
 tags:
   analytic_story:
   - DHS Report TA18-074A
+  - HAFNIUM Group
   asset_type: Windows
   automated_detection_testing: passed
   cis20:

detections/endpoint/detect_psexec_with_accepteula_flag.yml

@@ -33,6 +33,7 @@ tags:
   analytic_story:
   - SamSam Ransomware
   - DHS Report TA18-074A
+  - HAFNIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/detect_regsvr32_application_control_bypass.yml

@@ -36,6 +36,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Regsvr32 Activity
+  - Cobalt Strike
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/dump_lsass_via_comsvcs_dll.yml

@@ -24,6 +24,7 @@ tags:
   analytic_story:
   - Credential Dumping
   - Suspicious Rundll32 Activity
+  - HAFNIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/dump_lsass_via_procdump.yml

@@ -17,7 +17,7 @@ description: 'Detect procdump.exe dumping the lsass process. This query looks fo
   the command line. Review other endpoint data sources for cross process (injection)
   into lsass.exe.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=procdump.exe
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=procdump.exe OR Processes.process_name=procdump64.exe
   (Processes.process=*-ma* OR Processes.process=*-mm*) Processes.process=*lsass* by
   Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`'
@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - Credential Dumping
+  - HAFNIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/dump_lsass_via_procdump_rename.yml

@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - Credential Dumping
+  - HAFNIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/eventvwr_uac_bypass.yml

@@ -0,0 +1,43 @@
+name: Eventvwr UAC Bypass
+id: 9cf8fe08-7ad8-11eb-9819-acde48001122
+version: 1
+date: '2021-03-01'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following search identifies Eventvwr bypass by identifying the registry
+  modification into a specific path that eventvwr.msc looks to (but is not valid)
+  upon execution. A successful attack will include a suspicious command to be executed
+  upon eventvwr.msc loading. Upon triage, review the parallel processes that have
+  executed. Identify any additional registry modifications on the endpoint that may
+  look suspicious. Remediate as necessary.
+search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
+  as registry_key_name values(Registry.registry_path) as registry_path min(_time)
+  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where  Registry.registry_path="*mscfile\\shell\\open\\command\\*"  by
+  Registry.user, Registry.dest , Registry.registry_value_name| `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `eventvwr_uac_bypass_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node.
+known_false_positives: Some false positives may be present and will need to be filtered.
+references:
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
+- https://attack.mitre.org/techniques/T1548/002
+- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1548.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  automated_detection_testing: passed

detections/endpoint/fodhelper_uac_bypass.yml

@@ -0,0 +1,52 @@
+name: FodHelper UAC Bypass
+id: 909f8fd8-7ac8-11eb-a1f3-acde48001122
+version: 1
+date: '2021-03-01'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: 'Fodhelper.exe has a known UAC bypass as it attempts to look for specific
+  registry keys upon execution, that do not exist. Therefore, an attacker can write
+  its malicious commands in these registry keys to be executed by fodhelper.exe with
+  the highest privilege. \
+
+  1. `HKCU:\Software\Classes\ms-settings\shell\open\command`\
+
+  1. `HKCU:\Software\Classes\ms-settings\shell\open\command\DelegateExecute`\
+
+  1. `HKCU:\Software\Classes\ms-settings\shell\open\command\(default)`\
+
+  Upon triage, fodhelper.exe will have a child process and read access will occur
+  on the registry keys. Isolate the endpoint and review parallel processes for additional
+  behavior.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=fodhelper.exe
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `fodhelper_uac_bypass_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Limited to no false positives are expected.
+references:
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
+- https://github.com/gushmazuko/WinBypass/blob/master/FodhelperBypass.ps1
+- https://attack.mitre.org/techniques/T1548/002
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  - Privilege Escalation
+  mitre_attack_id:
+  - T1112
+  - T1548.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  automated_detection_testing: passed

detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml

@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - Malicious PowerShell
   - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
+  - HAFNIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml

@@ -28,6 +28,7 @@ references: []
 tags:
   analytic_story:
   - DHS Report TA18-074A
+  - HAFNIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20: