The Day After Log4Shell

bin/jinja2_templates/detection.j2

@@ -49,3 +49,7 @@ tags:
   {% for observable in observables -%}
   - {{observable}}
   {% endfor -%}
+  nist:
+  -
+  cis20:
+  -

detections/endpoint/any_powershell_downloadfile.yml

@@ -33,6 +33,7 @@ tags:
   analytic_story:
   - Malicious PowerShell
   - Ingress Tool Transfer
+  - Log4Shell CVE-2021-44228
   automated_detection_testing: passed
   confidence: 70
   context:
@@ -66,6 +67,8 @@ tags:
     type: Process
     role:
     - Child Process
+  cve:
+  - CVE-2021-44228
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/cmd_carry_out_string_command_parameter.yml

@@ -1,32 +1,36 @@
 name: CMD Carry Out String Command Parameter
 id: 54a6ed00-3256-11ec-b031-acde48001122
-version: 1
-date: '2021-10-21'
-author: Teoderick Contreras, Splunk, Bhavin Patel, Splunk
+version: 2
+date: '2021-12-13'
+author: Teoderick Contreras, Bhavin Patel, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: This search looks for command-line arguments where `cmd.exe /c` is used
-  to execute a program. This technique is commonly seen in adversaries and malware
-  to execute batch command using different shell like powershell or different process
-  other than cmd.exe. This is a good hunting query for suspicious commandline made
-  by a script or relative process execute it.
+description: 'The following analytic identifies command-line arguments where `cmd.exe /c` is used
+  to execute a program. `cmd /c` is used to run commands in MS-DOS and terminate after
+  command or process completion. This technique is commonly seen in adversaries and malware
+  to execute batch command using different shell like PowerShell or different process
+  other than `cmd.exe`. This is a good hunting query for suspicious command-line made
+  by a script or relative process execute it.'
 search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_cmd` AND Processes.process="*
   /c *" by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `cmd_carry_out_string_command_parameter_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: unknown
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives may be high based on legitimate scripted code in any environment.
+  Filter as needed.
 references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IcedID
+  - Log4Shell CVE-2021-44228
   automated_detection_testing: passed
   confidence: 50
   context:
@@ -37,7 +41,7 @@ tags:
   impact: 60
   kill_chain_phases:
   - Exploitation
-  message: $process_name$ with commandline $process$ in $dest$
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting spawn a new process. 
   mitre_attack_id:
   - T1059.003
   - T1059
@@ -50,6 +54,8 @@ tags:
     type: User
     role:
     - Victim
+  cve:
+  - CVE-2021-44228
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/curl_download_and_bash_execution.yml

@@ -0,0 +1,77 @@
+name: Curl Download and Bash Execution
+id: 900bc324-59f3-11ec-9fb4-acde48001122
+version: 1
+date: '2021-12-10'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of curl on Linux or MacOS attempting to download a file from a remote source and pipe it to bash. This is typically found with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl
+  (Processes.process="*-s *") OR (Processes.process="*|*" AND Processes.process="*bash*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `curl_download_and_bash_execution_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is occurring correctly. 
+  If the EDR is not parsing the pipe bash in the command-line, modifying the analytic will be required.
+  Add parent process name (Processes.parent_process_name) as needed to filter.
+known_false_positives: False positives should be limited, however filtering may be required.
+references:
+  - https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java
+  - https://www.lunasec.io/docs/blog/log4j-zero-day/ 
+  - https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  - Log4Shell CVE-2021-44228
+  dataset: 
+  - "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/linux-sysmon_curlwget.log"
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1105
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+    - _time
+    - Processes.dest
+    - Processes.user
+    - Processes.parent_process_name #parent process name
+    - Processes.parent_process #parent cmdline
+    - Processes.process_name #process name
+    - Processes.process #process cmdline
+    - Processes.process_id
+    - Processes.parent_process_path
+    - Processes.process_path
+    - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $process_name$ was identified on endpoint $dest$ attempting to download a remote file and run it with bash.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  cve:
+  - CVE-2021-44228

detections/endpoint/hunting_for_log4shell.yml

@@ -0,0 +1,118 @@
+name: Hunting for Log4Shell
+id: 158b68fa-5d1a-11ec-aac8-acde48001122
+version: 1
+date: '2021-12-14'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Web
+description: 'The following hunting query assists with quickly assessing CVE-2021-44228,
+  or Log4Shell, activity mapped to the Web Datamodel. This is a combination query
+  attempting to identify, score and dashboard. Because the Log4Shell vulnerability
+  requires the string to be in the logs, this will work to identify the activity anywhere
+  in the HTTP headers using _raw. Modify the first line to use the same pattern matching
+  against other log sources. Scoring is based on a simple rubric of 0-5. 5 being the
+  best match, and less than 5 meant to identify additional patterns that will equate
+  to a higher total score. \
+
+  The first jndi match identifies the standard pattern of `{jndi:` \
+
+  jndi_fastmatch is meant to identify any jndi in the logs. The score is set low and
+  is meant to be the "base" score used later. \
+
+  jndi_proto is a protocol match that identifies `jndi` and one of `ldap, ldaps, rmi,
+  dns, nis, iiop, corba, nds, http, https.` \
+
+  all_match is a very well written regex by https://gist.github.com/Schvenn that identifies
+  nearly all patterns of this attack behavior. \
+
+  env works to identify environment variables in the header, meant to capture `AWS_ACCESS_KEY_ID`,
+  `AWS_SECRET_ACCESS_KEY` and `env`. \
+
+  uri_detect is string match looking for the common uri paths currently being scanned/abused
+  in the wild. \
+
+  keywords matches on enumerated values that, like `$ctx:loginId`, that may be found
+  in the header used by the adversary. \
+
+  lookup matching is meant to catch some basic obfuscation that has been identified
+  using upper, lower and date. \
+
+  Scoring will then occur based on any findings. The base score is meant to be 2 ,
+  created by jndi_fastmatch. Everything else is meant to increase that score. \
+
+  Finally, a simple table is created to show the scoring and the _raw field. Sort
+  based on score or columns of interest.'
+search: '| from datamodel Web.Web | eval jndi=if(match(_raw, "(\{|%7B)[jJnNdDiI]{4}:"),4,0)
+  | eval jndi_fastmatch=if(match(_raw, "[jJnNdDiI]{4}"),2,0) | eval jndi_proto=if(match(_raw,"(?i)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http|https):"),5,0)
+  | eval all_match = if(match(_raw, "(?i)(%(25){0,}20|\s)*(%(25){0,}24|\$)(%(25){0,}20|\s)*(%(25){0,}7B|{)(%(25){0,}20|\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\s)*(%(25){0,}3A|:)[\w\%]+(%(25){1,}3A|:)(%(25){1,}2F|\/)[^\n]+"),5,0)
+  | eval env_var = if(match(_raw, "env:") OR match(_raw, "env:AWS_ACCESS_KEY_ID")
+  OR match(_raw, "env:AWS_SECRET_ACCESS_KEY"),5,0) | eval uridetect = if(match(_raw,
+  "(?i)Basic\/Command\/Base64|Basic\/ReverseShell|Basic\/TomcatMemshell|Basic\/JBossMemshell|Basic\/WebsphereMemshell|Basic\/SpringMemshell|Basic\/Command|Deserialization\/CommonsCollectionsK|Deserialization\/CommonsBeanutils|Deserialization\/Jre8u20\/TomcatMemshell|Deserialization\/CVE_2020_2555\/WeblogicMemshell|TomcatBypass|GroovyBypass|WebsphereBypass"),4,0)
+  | eval keywords = if(match(_raw,"(?i)\$\{ctx\:loginId\}|\$\{map\:type\}|\$\{filename\}|\$\{date\:MM-dd-yyyy\}|\$\{docker\:containerId\}|\$\{docker\:containerName\}|\$\{docker\:imageName\}|\$\{env\:USER\}|\$\{event\:Marker\}|\$\{mdc\:UserId\}|\$\{java\:runtime\}|\$\{java\:vm\}|\$\{java\:os\}|\$\{jndi\:logging/context-name\}|\$\{hostName\}|\$\{docker\:containerId\}|\$\{k8s\:accountName\}|\$\{k8s\:clusterName\}|\$\{k8s\:containerId\}|\$\{k8s\:containerName\}|\$\{k8s\:host\}|\$\{k8s\:labels.app\}|\$\{k8s\:labels.podTemplateHash\}|\$\{k8s\:masterUrl\}|\$\{k8s\:namespaceId\}|\$\{k8s\:namespaceName\}|\$\{k8s\:podId\}|\$\{k8s\:podIp\}|\$\{k8s\:podName\}|\$\{k8s\:imageId\}|\$\{k8s\:imageName\}|\$\{log4j\:configLocation\}|\$\{log4j\:configParentLocation\}|\$\{spring\:spring.application.name\}|\$\{main\:myString\}|\$\{main\:0\}|\$\{main\:1\}|\$\{main\:2\}|\$\{main\:3\}|\$\{main\:4\}|\$\{main\:bar\}|\$\{name\}|\$\{marker\}|\$\{marker\:name\}|\$\{spring\:profiles.active[0]|\$\{sys\:logPath\}|\$\{web\:rootDir\}|\$\{sys\:user.name\}"),4,0)
+  | eval obf = if(match(_raw, "(\$|%24)[^ /]*({|%7b)[^ /]*(j|%6a)[^ /]*(n|%6e)[^ /]*(d|%64)[^
+  /]*(i|%69)[^ /]*(:|%3a)[^ /]*(:|%3a)[^ /]*(/|%2f)"),5,0) | eval lookups = if(match(_raw,
+  "date:") OR match(_raw, "upper:") OR match(_raw, "lower:"),4,0) | addtotals fieldname=Score,
+  jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, obf,
+  lookups | where Score > 2 | stats values(Score) by  jndi, jndi_proto, env_var, uridetect,
+  all_match, jndi_fastmatch, keywords, lookups, obf, _raw | `hunting_for_log4shell_filter`'
+how_to_implement: Out of the box, the Web datamodel is required to be pre-filled.
+  However, tested was performed against raw httpd access logs. Change the first line
+  to any dataset to pass the regex's against.
+known_false_positives: It is highly possible you will find false positives, however,
+  the base score is set to 2 for _any_ jndi found in raw logs. tune and change as
+  needed, include any filtering.
+references:
+- https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72
+- https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b#gistcomment-3994449
+- https://regex101.com/r/OSrm0q/1/
+- https://github.com/Neo23x0/signature-base/blob/master/yara/expl_log4j_cve_2021_44228.yar
+- https://news.sophos.com/en-us/2021/12/12/log4shell-hell-anatomy-of-an-exploit-outbreak/
+- https://gist.github.com/MHaggis/1899b8554f38c8692a9fb0ceba60b44c
+- https://twitter.com/sasi2103/status/1469764719850442760?s=20
+tags:
+  analytic_story:
+  - Log4Shell CVE-2021-44228
+  asset_type: Web Server
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/java/log4shell-nginx.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1190
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - Web.http_user_agent
+  - _raw
+  security_domain: network
+  impact: 80
+  confidence: 50
+  risk_score: 40
+  context:
+  - Source:network
+  message: Hunting for Log4Shell exploitation has occurred.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: http_method
+    type: Other
+    role:
+    - other
+  - name: src
+    type: Other
+    role:
+    - other
+  cve:
+  - CVE-2021-44228
+  automated_detection_testing: passed

detections/endpoint/java_class_file_download_by_java_user_agent.yml

@@ -0,0 +1,69 @@
+name: Java Class File download by Java User Agent
+id: 8281ce42-5c50-11ec-82d2-acde48001122
+version: 1
+date: '2021-12-13'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Web
+description: The following analytic identifies a Java user agent performing a GET
+  request for a .class file from the remote site. This is potentially indicative of
+  exploitation of the Java application and may be related to current event CVE-2021-44228
+  (Log4Shell).
+search: '| tstats count from datamodel=Web where Web.http_user_agent="*Java*" Web.http_method="GET"
+  Web.url="*.class*" by Web.http_user_agent Web.http_method, Web.url,Web.url_length
+  Web.src, Web.dest | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `java_class_file_download_by_java_user_agent_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  web or proxy logs, or ensure it is being filled by a proxy like device, into the
+  Web Datamodel. For additional filtering, allow list private IP space or restrict
+  by known good.
+known_false_positives: Filtering may be required in some instances, filter as needed.
+references:
+- https://arstechnica.com/information-technology/2021/12/as-log4shell-wreaks-havoc-payroll-service-reports-ransomware-attack/
+tags:
+  analytic_story:
+  - Log4Shell CVE-2021-44228
+  asset_type: Web Server
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/java/java.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1190
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - Web.http_user_agent
+  security_domain: network
+  impact: 80
+  confidence: 50
+  risk_score: 40
+  context:
+  - Source:network
+  message: A Java user agent $http_user_agent$ was performing a $http_method$ to retrieve
+    a remote class file.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: http_user_agent
+    type: Other
+    role:
+    - other
+  - name: http_method
+    type: Other
+    role:
+    - Other
+  automated_detection_testing: passed
+  cve:
+  - CVE-2021-44228

detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml

@@ -29,15 +29,17 @@ how_to_implement: You must be ingesting data that records process activity from
 known_false_positives: Legitimate process can have this combination of command-line
   options, but it's not common.
 references:
-- https://regexr.com/663rr
-- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
-- https://ss64.com/ps/powershell.html
-- https://twitter.com/M_haggis/status/1440758396534214658?s=20
+  - https://regexr.com/663rr
+  - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
+  - https://ss64.com/ps/powershell.html
+  - https://twitter.com/M_haggis/status/1440758396534214658?s=20
+  - https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
 tags:
   analytic_story:
   - Malicious PowerShell
   - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
   - HAFNIUM Group
+  - Log4Shell CVE-2021-44228
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
@@ -91,3 +93,5 @@ tags:
   - Processes.dest
   risk_score: 81
   security_domain: endpoint
+  cve:
+  - CVE-2021-44228