Komodo

detections/deprecated/dump_lsass_via_procdump_rename.yml

@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - Credential Dumping
   - HAFNIUM Group
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/create_local_admin_accounts_using_net_exe.yml

@@ -27,6 +27,7 @@ tags:
   analytic_story:
   - DHS Report TA18-074A
   - Azorult
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml

@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - Credential Dumping
+  - CISA AA22-257A
   asset_type: Windows
   cis20:
   - CIS 6

detections/endpoint/detect_exchange_web_shell.yml

@@ -51,6 +51,7 @@ tags:
   analytic_story:
   - HAFNIUM Group
   - ProxyShell
+  - CISA AA22-257A
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/detect_mimikatz_using_loaded_images.yml

@@ -30,6 +30,7 @@ tags:
   - Detect Zerologon Attack
   - Cloud Federated Credential Abuse
   - DarkSide Ransomware
+  - CISA AA22-257A
   asset_type: Windows
   cis20:
   - CIS 6

detections/endpoint/detect_new_local_admin_account.yml

@@ -22,6 +22,7 @@ tags:
   analytic_story:
   - DHS Report TA18-074A
   - HAFNIUM Group
+  - CISA AA22-257A
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/dump_lsass_via_comsvcs_dll.yml

@@ -28,6 +28,7 @@ tags:
   - HAFNIUM Group
   - Living Off The Land
   - Industroyer2
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/dump_lsass_via_procdump.yml

@@ -1,7 +1,7 @@
 name: Dump LSASS via procdump
 id: 3742ebfe-64c2-11eb-ae93-0242ac130002
-version: 2
-date: '2021-09-16'
+version: 3
+date: '2022-08-31'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -31,10 +31,12 @@ references:
 - https://attack.mitre.org/techniques/T1003/001/
 - https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
+- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
 tags:
   analytic_story:
   - Credential Dumping
   - HAFNIUM Group
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/extraction_of_registry_hives.yml

@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - DarkSide Ransomware
   - Credential Dumping
+  - CISA AA22-257A
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml

@@ -33,6 +33,7 @@ tags:
   - Living Off The Land
   - Azorult
   - DarkCrystal RAT
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/schtasks_run_task_on_demand.yml

@@ -28,6 +28,7 @@ tags:
   analytic_story:
   - XMRig
   - Industroyer2
+  - CISA AA22-257A
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/short_lived_scheduled_task.yml

@@ -26,6 +26,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Lateral Movement
+  - CISA AA22-257A
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml

@@ -0,0 +1,92 @@
+name: Windows Execute Arbitrary Commands with MSDT
+id: f253f9c2-10f0-4cc8-b469-f505ba8c2038
+version: 1
+date: '2022-09-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies a recently disclosed arbitraty command
+  execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample
+  identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve
+  a remote payload. During triage, review file modifications for html. Identify parallel
+  process execution that may be related, including an Office Product.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msdt.exe"
+  AND (like (cmd_line, "%msdt%") OR like (cmd_line, "%ms-msdt:%") OR like (cmd_line, "%ms-msdt:/id%") OR like (cmd_line, "%ms-msdt:-id%") OR like (cmd_line, "%ms-msdt:/id%"))
+  AND (like (cmd_line, "%it_browseforfile=%") OR like (cmd_line, "%it_rebrowseforfile=%") OR like (cmd_line, "%.xml%"))
+  AND like (cmd_line, "%pcwdiagnostic%")
+  | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present, filter as needed. Added .xml
+  to potentially capture any answer file usage. Remove as needed.
+references:
+  - https://isc.sans.edu/diary/rss/28694
+  - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
+  - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
+  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
+  - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
+  - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
+tags:
+  analytic_story:
+  - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log
+  impact: 100 
+  cve:
+  - CVE-2022-30190
+  kill_chain_phases:
+  - Exploitation
+  message: $process_name$ on $dest_device_id$ under user $dest_user_id$ possibly indicative of indirect command execution.
+  mitre_attack_id:
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 100
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml

@@ -0,0 +1,85 @@
+name: Windows Ingress Tool Transfer Using Explorer
+id: 695bfad6-9662-4f9e-a576-bf02a951aa60
+version: 1
+date: '2022-09-13'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies the Windows Explorer process with a URL within the command-line.
+  Explorer.exe is known Windows process that handles start menu, taskbar, desktop and file manager. 
+  Many adversaries abuse this process, like DCRat malware, where it attempts to open the URL with the default browser application 
+  on the target host by putting the URL as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check 
+  which user and how this process was executed, what is the parent process and what is the URL link. This technique is not commonly used to open an URL.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="explorer.exe" 
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) AND NOT (like(parent_process_name, "userinit.exe") OR like(parent_process_name, "svchost.exe"))
+  | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints.
+known_false_positives: False positives may be present based on legitimate applications or third party utilities. Filter out any additional parent process names. 
+references:
+  - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
+tags:
+  analytic_story:
+  - DarkCrystal RAT
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105_explorer-windows-security.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote destination to download an additional payload.
+  mitre_attack_id:
+  - T1105
+  nist:
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 25
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml

@@ -1,7 +1,7 @@
 name: Windows LOLBin Binary in Non Standard Path
 id: 25689101-012a-324a-94d3-08301e6c065a
-version: 3
-date: '2022-07-19'
+version: 4
+date: '2022-08-31'
 author: Michael Haag, Splunk
 type: Anomaly
 datamodel:
@@ -16,11 +16,11 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
   null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
 
-  $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bash.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR 
+  $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR 
   process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="cscript.exe" OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe" OR process_name="diantz.exe" OR 
   process_name="diskshadow.exe" OR process_name="dllhost.exe" OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe" OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe" OR 
   process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="msconfig.exe" OR process_name="msdt.exe" OR process_name="mshta.exe" OR 
-  process_name="msiexec.exe" OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="onedrivestandaloneupdater.exe" OR process_name="pcalua.exe" OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe" OR process_name="psr.exe" OR process_name="rasautou.exe" OR 
+  process_name="msiexec.exe" OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="pcalua.exe" OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe" OR process_name="psr.exe" OR process_name="rasautou.exe" OR 
   process_name="reg.exe" OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe" OR process_name="replace.exe" OR process_name="rpcping.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" OR process_name="runscripthelper.exe" OR process_name="sc.exe" OR process_name="schtasks.exe" OR process_name="scriptrunner.exe" OR 
   process_name="settingsynchost.exe" OR process_name="syncappvpublishingserver.exe" OR process_name="ttdinject.exe" OR process_name="tttracer.exe" OR process_name="vbc.exe" OR process_name="verclsid.exe" OR process_name="wab.exe" OR process_name="wlrmdr.exe" OR process_name="wmic.exe" OR process_name="workfolders.exe" OR process_name="wscript.exe" OR process_name="wsreset.exe" OR process_name="wuauclt.exe" OR process_name="xwizard.exe";
 

detections/endpoint/ssa___windows_odbcconf_load_response_file.yml

@@ -0,0 +1,84 @@
+name: Windows Odbcconf Load Response File
+id: 7b6c3fac-0c37-4efc-a85e-de88f42b6763
+version: 1
+date: '2022-09-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies the odbcconf.exe, Windows Open Database
+  Connectivity utility, loading up a resource file. The file extension is arbitrary
+  and may be named anything. The resource file itself may have different commands
+  supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands.
+  During triage, review file modifications and parallel processes.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="odbcconf.exe"
+  AND (like (cmd_line, "%-f %") OR like (cmd_line, "%/f %")) AND like (cmd_line, "%.rsp%") | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present and filtering may need to occur
+  based on legitimate application usage. Filter as needed.
+references:
+  - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html
+  - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw
+tags:
+  analytic_story:
+  - Living Off The Land
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: $process_name$ has been identified on $dest_device_id$ under user $dest_user_id$ attempting to circumvent controls.
+  mitre_attack_id:
+  - T1218.008
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 42
+  security_domain: endpoint
+  asset_type: Endpoint