FIN7

detections/endpoint/check_elevated_cmd_using_whoami.yml

@@ -0,0 +1,69 @@
+name: Check Elevated CMD using whoami
+id: a9079b18-1633-11ec-859c-acde48001122
+version: 1
+date: '2021-09-15'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious whoami execution to check if the
+  cmd or shell instance process is with elevated privileges. This technique was seen
+  in FIN7 js implant where it execute this as part of its data collection to the infected
+  machine to check if the running shell cmd process is elevated or not. This TTP is
+  really a good alert for known attacker that recon on the targetted host. This command
+  is not so commonly executed by a normal user or even an admin to check if a process
+  is elevated.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where  Processes.process = "*whoami*"
+  Processes.process = "*/group*" Processes.process = "* find *" Processes.process
+  = "*12288*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `check_elevated_cmd_using_whoami_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: unknown
+eferences:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
+tags:
+  analytic_story:
+  - FIN7
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1033
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint
+  impact: 70
+  confidence: 80
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: Process name $process_name$ with commandline $process$ in $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml

@@ -0,0 +1,71 @@
+name: Cmdline Tool Not Executed In CMD Shell
+id: 6c3f7dd8-153c-11ec-ac2d-acde48001122
+version: 1
+date: '2021-09-14'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious parent process execution of commandline
+  tool not in shell commandline. This technique was seen in FIN7 JSSLoader .net compile
+  payload where it run ipconfig.exe and systeminfo.exe using .net application. This
+  event cause some good TTP since those tool are commonly run in commandline not by
+  another application. This TTP is a good indicator for application gather host information
+  either an attacker or an automated tool made by admin.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where  (Processes.process_name = "ipconfig.exe"
+  OR Processes.process_name = "systeminfo.exe") AND NOT (Processes.parent_process_name
+  = "cmd.exe" OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name
+  = "explorer.exe") by Processes.parent_process_name Processes.parent_process Processes.process_name
+  Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmdline_tool_not_executed_in_cmd_shell_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: network operator or admin may create this type of tool to gather
+  host information
+references:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
+tags:
+  analytic_story:
+  - FIN7
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.007
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint
+  impact: 70
+  confidence: 80
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: parent process name $parent_process_name$ with child process $process_name$
+    to execute commandline tool in $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/jscript_execution_using_cscript_app.yml

@@ -0,0 +1,69 @@
+name: Jscript Execution Using Cscript App
+id: 002f1e24-146e-11ec-a470-acde48001122
+version: 1
+date: '2021-09-13'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a execution of jscript using cscript process.
+  Commonly when a user run jscript file it was executed by wscript.exe application.
+  This technique was seen in FIN7 js implant to execute its malicious script using
+  cscript process. This behavior is uncommon and a good artifacts to check further
+  anomalies within the network
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
+  = "cscript.exe" AND Processes.parent_process = "*//e:jscript*") OR (Processes.process_name
+  = "cscript.exe" AND Processes.process = "*//e:jscript*") by Processes.parent_process_name
+  Processes.parent_process Processes.process_name Processes.process_id Processes.process
+  Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `jscript_execution_using_cscript_app_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: unknown
+references:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
+tags:
+  analytic_story:
+  - FIN7
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.007
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: Process name $process_name$ with commandline $process$ to execute jscript
+    in $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/ms_scripting_process_loading_ldap_module.yml

@@ -0,0 +1,65 @@
+name: MS Scripting Process Loading Ldap Module
+id: 0b0c40dc-14a6-11ec-b267-acde48001122
+version: 1
+date: '2021-09-13'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious MS scripting process such as wscript.exe
+  or cscript.exe that loading ldap module to process ldap query. This behavior was
+  seen in FIN7 implant where it uses javascript to execute ldap query to parse host
+  information that will send to its C2 server. this anomaly detections is a good initial
+  step to hunt further a suspicious ldap query or ldap related events to the host
+  that may give you good information regarding ldap or AD information processing or
+  might be a attacker.
+search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded
+  IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") | stats min(_time) as firstTime
+  max(_time) as lastTime count by Image EventCode process_name ProcessId ProcessGuid
+  Computer ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `ms_scripting_process_loading_ldap_module_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: automation scripting language may used by network operator
+  to do ldap query.
+references:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
+tags:
+  analytic_story:
+  - FIN7
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.007
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - EventCode
+  - process_name
+  - ProcessId
+  - ProcessGuid
+  - Computer
+  - ImageLoaded
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: $process_name$ loading ldap modules $ImageLoaded$ in $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/ms_scripting_process_loading_wmi_module.yml

@@ -0,0 +1,66 @@
+name: MS Scripting Process Loading WMI Module
+id: 2eba3d36-14a6-11ec-a682-acde48001122
+version: 1
+date: '2021-09-13'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious MS scripting process such as wscript.exe
+  or cscript.exe that loading wmi module to process wmi query. This behavior was seen
+  in FIN7 implant where it uses javascript to execute wmi query to parse host information
+  that will send to its C2 server. this anomaly detections is a good initial step
+  to hunt further a suspicious wmi query or wmi related events to the host that may
+  give you good information regarding process that are commonly using wmi query or
+  modules or might be an attacker using this technique.
+search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded
+  IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" ,
+  "*\\wmiutils.dll", "*\\wbemcomn.dll") | stats min(_time) as firstTime max(_time)
+  as lastTime count by Image EventCode process_name ProcessId ProcessGuid Computer
+  ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `ms_scripting_process_loading_wmi_module_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: automation scripting language may used by network operator
+  to do ldap query.
+references:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
+tags:
+  analytic_story:
+  - FIN7
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.007
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - EventCode
+  - process_name
+  - ProcessId
+  - ProcessGuid
+  - Computer
+  - ImageLoaded
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: $process_name$ loading wmi modules $ImageLoaded$ in $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed