Falling for Follina

detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml

@@ -0,0 +1,87 @@
+name: Windows Execute Arbitrary Commands with MSDT
+id: e1d5145f-38fe-42b9-a5d5-457796715f97
+version: 1
+date: '2022-05-30'
+author: Michael Haag, Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies a recently disclosed arbitraty command execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. 
+  During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe
+  Processes.process="*ms-msdt:/id*" Processes.process="*IT_BrowseForFile=*" Processes.process="*IT_RebrowseForFile=*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_execute_arbitrary_commands_with_msdt_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present, filter as needed. 
+references:
+  - https://isc.sans.edu/diary/rss/28694
+  - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
+  - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
+  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
+  - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
+  - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
+tags:
+  analytic_story:
+  - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
+  asset_type: Endpoint
+  cve:
+  - CVE-2022-30190
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log
+  impact: 100
+  kill_chain_phases:
+  - Exploitation
+  message: A parent process $parent_process_name$ has spawned a child
+    process $process_name$ on host $dest$ possibly indicative of indirect command execution.
+  mitre_attack_id:
+  - T1202
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 100
+  security_domain: endpoint

detections/endpoint/windows_office_product_spawning_msdt.yml

@@ -0,0 +1,89 @@
+name: Windows Office Product Spawning MSDT
+id: 127eba64-c981-40bf-8589-1830638864a7
+version: 1
+date: '2022-05-30'
+author: Michael Haag, Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies a Microsoft Office product spawning the Windows msdt.exe process. MSDT is a Diagnostics Troubleshooting Wizard native to Windows. This behavior is related to a recently identified sample utilizing protocol handlers to evade preventative controls, including if macros are disabled in the document.
+  During triage, review file modifications for html. In addition, parallel processes including PowerShell and CertUtil.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe") Processes.process_name=msdt.exe
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` 
+  | `windows_office_product_spawning_msdt_filter`'
+how_to_implement: how To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives should be limited, however filter as needed.
+references:
+  - https://isc.sans.edu/diary/rss/28694
+  - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
+  - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
+  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
+  - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
+  - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
+  asset_type: Endpoint
+  cve:
+  - CVE-2022-30190
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log
+  impact: 100
+  kill_chain_phases:
+  - Exploitation
+  message: Office parent process $parent_process_name$ has spawned a child
+    process $process_name$ on host $dest$.
+  mitre_attack_id:
+  - T1566
+  - T1566.001
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 100
+  security_domain: endpoint

stories/microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml

@@ -0,0 +1,25 @@
+name: Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
+id: 2a60a99e-c93a-4036-af70-768fac838019
+version: 1
+date: '2022-05-31'
+author: 'Michael Haag, Teoderick Contreras, Splunk'
+description: On Monday May 30, 2022, Microsoft issued CVE-2022-30190 regarding the Microsoft Support Diagnostic Tool (MSDT) in Windows vulnerability.
+narrative: 
+  A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user''s rights.
+references:
+  - https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
+  - https://isc.sans.edu/diary/rss/28694
+  - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
+  - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
+  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
+  - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
+  - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
+tags:
+  analytic_story: Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

stories/windows_drivers.yml

@@ -16,7 +16,8 @@ references:
   - https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/
 tags:
   analytic_story: Windows Drivers
-  category: []
+  category: 
+  - Adversary Tactics
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

tests/endpoint/windows_execute_arbitrary_commands_with_msdt.test.yml

@@ -0,0 +1,13 @@
+name: Windows Execute Arbitrary Commands with MSDT Unit Test
+tests:
+- name: Windows Execute Arbitrary Commands with MSDT
+  file: endpoint/windows_execute_arbitrary_commands_with_msdt.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: msdt.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

tests/endpoint/windows_office_product_spawning_msdt.test.yml

@@ -0,0 +1,13 @@
+name: Windows Office Product Spawning MSDT Unit Test
+tests:
+- name: Windows Office Product Spawning MSDT
+  file: endpoint/windows_office_product_spawning_msdt.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: msdt.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true