diff --git a/bin/generate.py b/bin/generate.py index 0d9255e762..ac7fcc9daa 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -279,10 +279,8 @@ def generate_workbench_panels(response_tasks, stories, TEMPLATE_PATH, OUTPUT_PAT template = j2_env.get_template('panel.j2') file_path = "default/data/ui/panels/workbench_panel_" + response_file_name + ".xml" output_path = path.join(OUTPUT_PATH, file_path) - if response_task['search'].find(">") is not -1: - response_task['search']= response_task['search'].replace(">",">") - if response_task['search'].find("<") is not -1: - response_task['search']= response_task['search'].replace("<","<") + response_task['search']= response_task['search'].replace(">",">") + response_task['search']= response_task['search'].replace("<","<") output = template.render(search=response_task['search']) with open(output_path, 'w') as f: diff --git a/bin/validate.py b/bin/validate.py index 0246833c06..a7910d98bc 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -62,7 +62,7 @@ def validate_schema(REPO_PATH, type, objects): return objects, error, errors -def validate_objects(REPO_PATH, objects): +def validate_objects(REPO_PATH, objects, verbose): # uuids uuids = [] @@ -76,6 +76,8 @@ def validate_objects(REPO_PATH, objects): validation_errors, uuids = validate_standard_fields(object, uuids) errors = errors + validation_errors + if verbose: + print("validating object {0}".format(object['name'])) for object in objects['detections']: if object['type'] == 'ESCU': errors = errors + validate_detection_search(object, objects['macros']) @@ -159,6 +161,11 @@ def validate_detection_search(object, macros): errors.append("ERROR: Missing filter for detection: " + object['name']) filter_macro = re.search("([a-z0-9_]*_filter)", object['search']) + + if not filter_macro: + errors.append("ERROR: filter macro not found for detection: " + object['name']) + return errors + if filter_macro.group(1) != (object['name'].replace(' ', '_').replace('-', '_').replace('.', '_').replace('/', '_').lower() + '_filter'): errors.append("ERROR: filter for detection: " + object['name'] + " needs to use the name of the detection in lowercase and the special characters needs to be converted into _ .") @@ -242,7 +249,7 @@ def validate_lookups_content(REPO_PATH, lookup_path, lookup): if len(errors) > 0: schema_errors = schema_errors + errors - validation_errors = validate_objects(REPO_PATH, objects) + validation_errors = validate_objects(REPO_PATH, objects, verbose) schema_errors = schema_errors + validation_errors diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 769cd03188..36721065e3 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -36,6 +36,7 @@ known_false_positives: It is possible for a legitimate file with these extension tags: analytics_story: - SamSam Ransomware + - Ryuk Ransonware - Ransomware mitre_attack_id: - T1485 diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml index 80a66f6fe2..05e1439f30 100644 --- a/detections/endpoint/common_ransomware_notes.yml +++ b/detections/endpoint/common_ransomware_notes.yml @@ -23,6 +23,7 @@ tags: analytics_story: - SamSam Ransomware - Ransomware + - Ryuk Ransomware mitre_attack_id: - T1485 kill_chain_phases: diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml new file mode 100644 index 0000000000..84b082ca8c --- /dev/null +++ b/detections/endpoint/ryuk_test_files_detected.yml @@ -0,0 +1,32 @@ +name: Ryuk Test Files Detected +id: 57d44d70-28d9-4ed1-acf5-1c80ae2bbce3 +version: 1 +date: '2020-11-06' +description: 'The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Ryuk propagation.' +how_to_implement: 'You must be ingesting data that records the filesystem activity + from your hosts to populate the Endpoint Filesystem data-model object. If you are + using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which + you want to collect data.' +type: ESCU +references: [] +author: Rod Soto, Jose Hernandez, Splunk +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + lastTime FROM datamodel=Endpoint.Filesystem WHERE "Filesystem.file_path"=C:\\*Ryuk* BY "Filesystem.dest", "Filesystem.user", "Filesystem.file_path" + | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `ryuk_test_files_detected_filter`' +known_false_positives: If there are files with this keywoord as file names it might trigger false possitives, please make use of our filters to tune out potential FPs. +tags: + mitre_attack_id: + - T1486 + analytics_story: + - Ryuk Ransomware + kill_chain_phases: + - Delivery + cis20: + - CIS 8 + nist: + - PR.PT + - DE.CM + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml index 4e7b278bb3..7fcdf0b8c6 100644 --- a/detections/endpoint/samsam_test_file_write.yml +++ b/detections/endpoint/samsam_test_file_write.yml @@ -1,5 +1,5 @@ name: Samsam Test File Write -id: 69c12d59-d951-431e-ab77-ec426b8d65e6 +id: 493a879d-519d-428f-8f57-a06a0fdc107e version: 1 date: '2018-12-14' description: The search looks for a file named "test.txt" written to the windows system diff --git a/detections/endpoint/spike_in_file_writes.yml b/detections/endpoint/spike_in_file_writes.yml index b35941f8f0..ec80b049b5 100644 --- a/detections/endpoint/spike_in_file_writes.yml +++ b/detections/endpoint/spike_in_file_writes.yml @@ -25,6 +25,7 @@ known_false_positives: It is important to understand that if you happen to insta tags: analytics_story: - SamSam Ransomware + - Ryuk Ransomware - Ransomware kill_chain_phases: - Actions on Objectives diff --git a/detections/endpoint/windows_connhost_exe_force_flag.yml b/detections/endpoint/windows_connhost_exe_force_flag.yml new file mode 100644 index 0000000000..d238f63107 --- /dev/null +++ b/detections/endpoint/windows_connhost_exe_force_flag.yml @@ -0,0 +1,31 @@ +name: Windows connhost exe started forcefully +id: c114aaca-68ee-41c2-ad8c-32bf21db8769 +version: 1 +date: '2020-11-06' +description: 'The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1. +This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware.' +how_to_implement: You must be ingesting data that records the process-system activity + from your hosts to populate the Endpoint Processes data-model object. If you are + using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which + you want to collect data. +type: ESCU +references: [] +author: Rod Soto, Jose Hernandez, Splunk +search: '| `sysmon` CommandLine="*C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1*" EventCode=4688 + | table CommandLine, Computer, EventCode, SubjectUserSid + | `windows_connhost_exe_started_forcefully_filter`' +known_false_positives: This process should not be ran forcefully, we have not see any false positives for this detection +tags: + mitre_attack_id: + - T1059.003 + analytics_story: + - Ryuk Ransomware + kill_chain_phases: + - Delivery + cis20: + - CIS 8 + nist: + - PR.PT + - DE.CM + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml new file mode 100644 index 0000000000..5cf387faaf --- /dev/null +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -0,0 +1,36 @@ +name: Windows DisableAntiSpyware Registry +id: 23150a40-9301-4195-b802-5bb4f43067fb +version: 1 +date: '2020-11-06' +description: The search looks for the Registry Key DisableAntiSpyware set to disable. + This is consistent with Ryuk infections across a fleet of endpoints. +how_to_implement: You must be ingesting data that records the process-system activity + from your hosts to populate the Endpoint Processes data-model object. If you are + using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which + you want to collect data. +type: ESCU +references: [] +author: Rod Soto, Jose Hernandez, Splunk +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_key_name="DisableAntiSpyware" AND + Registry.registry_value_name="DWORD (0x00000000)" by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name + | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_disableantispyware_registry_filter`' +known_false_positives: It is unusual to turn this feature on a Windows system since it is a default security control, although it is not rare for some policies to disable it. + Although no false positives have been identified, use the provided filter macro to tune the search. +tags: + mitre_attack_id: + - T1562.001 + analytics_story: + - Ryuk Ransomware + kill_chain_phases: + - Delivery + cis20: + - CIS 8 + nist: + - PR.PT + - DE.CM + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml new file mode 100644 index 0000000000..74a6fa6acd --- /dev/null +++ b/detections/endpoint/windows_security_account_manager_stopped.yml @@ -0,0 +1,34 @@ +name: Windows Security Account Manager Stopped +id: 69c12d59-d951-431e-ab77-ec426b8d65e6 +version: 1 +date: '2020-11-06' +description: The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. + This is consistent with Ryuk infections across a fleet of endpoints. +how_to_implement: You must be ingesting data that records the process-system activity + from your hosts to populate the Endpoint Processes data-model object. If you are + using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which + you want to collect data. +type: ESCU +references: [] +author: Rod Soto, Jose Hernandez, Splunk +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes WHERE ("Processes.process_name"="net*.exe" "Processes.process"="*stop \"samss\"*") BY "Processes.dest", "Processes.user", "Processes.process" + | `drop_dm_object_name(Processes)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_security_account_manager_stopped_filter`' +known_false_positives: SAM is a critical windows service, stopping it would cause major issues on an endpoint this makes false positive rare. AlthoughNo false positives have been identified. +tags: + mitre_attack_id: + - T1489 + analytics_story: + - Ryuk Ransomware + kill_chain_phases: + - Delivery + cis20: + - CIS 8 + nist: + - PR.PT + - DE.CM + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/network/remote_desktop_network_bruteforce.yml b/detections/network/remote_desktop_network_bruteforce.yml index 972dfd3b8b..c69a0c7bd5 100644 --- a/detections/network/remote_desktop_network_bruteforce.yml +++ b/detections/network/remote_desktop_network_bruteforce.yml @@ -21,6 +21,7 @@ known_false_positives: RDP gateways may have unusually high amounts of traffic f tags: analytics_story: - SamSam Ransomware + - Ryuk Ransomware mitre_attack_id: - T1021.001 kill_chain_phases: diff --git a/detections/network/remote_desktop_network_traffic.yml b/detections/network/remote_desktop_network_traffic.yml index e3e4fbe976..4fa73789d2 100644 --- a/detections/network/remote_desktop_network_traffic.yml +++ b/detections/network/remote_desktop_network_traffic.yml @@ -28,6 +28,7 @@ known_false_positives: Remote Desktop may be used legitimately by users on the n tags: analytics_story: - SamSam Ransomware + - Ryuk Ransomware - Hidden Cobra Malware - Lateral Movement mitre_attack_id: diff --git a/lookups/ransomware_extensions.csv b/lookups/ransomware_extensions.csv index 11cae0e9fe..d226ac48d4 100644 --- a/lookups/ransomware_extensions.csv +++ b/lookups/ransomware_extensions.csv @@ -288,4 +288,5 @@ Extensions,Name .wcry,WannaCry .wnry,WannaCry .wncryt,WannaCry -.WNCRYT,WannaCry \ No newline at end of file +.WNCRYT,WannaCry +.RYK,Ryuk diff --git a/lookups/ransomware_notes.csv b/lookups/ransomware_notes.csv index 4c2e4edc0f..ead875e6e9 100644 --- a/lookups/ransomware_notes.csv +++ b/lookups/ransomware_notes.csv @@ -56,4 +56,4 @@ HELP_DECRYPT_YOUR_FILES.HTML,True *-HELP_FOR_DECRYPT_FILE.html,True *-SORRY-FOR-FILES.html,True *-READ-FOR-HELLPP.html,True -PLEASE_READ_FOR_DECRYPT_FILES_*.html,True \ No newline at end of file +RyukReadMe.html,True diff --git a/stories/ransomware_ryuk.yml b/stories/ransomware_ryuk.yml new file mode 100644 index 0000000000..2cc87777ce --- /dev/null +++ b/stories/ransomware_ryuk.yml @@ -0,0 +1,20 @@ +name: Ryuk Ransomware +id: 507edc74-13d5-4339-878e-b9744ded1f35 +version: 1 +date: '2020-11-06' +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the Ryuk ransomware, including looking for file writes associated + with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, suspicious psexec use, and more. +narrative: 'Cybersecurity Infrastructure Security Agency (CISA) released Alert (AA20-302A) on October 28th called “Ransomware Activity Targeting the Healthcare and Public Health Sector.” This alert details TTPs associated with ongoing and possible imminent attacks against the Healthcare sector, and is a joint advisory in coordination with other U.S. Government agencies. The objective of these malicious campaigns is to infiltrate targets in named sectors and to drop ransomware payloads, which will likely cause disruption of service and increase risk of actual harm to the health and safety of patients at hospitals, even with the aggravant of an ongoing COVID-19 pandemic. This document specifically refers to several crimeware exploitation frameworks, emphasizing the use of Ryuk ransomware as payload. +The Ryuk ransomware payload is not new. It has been well documented and identified in multiple variants. Payloads need a carrier, and for Ryuk it has often been exploitation frameworks such as Cobalt Strike, or popular crimeware frameworks such as Emotet or Trickbot.' +author: Jose Hernandez, Splunk +type: ESCU +references: +- https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html +- https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/ +- https://us-cert.cisa.gov/ncas/alerts/aa20-302a +tags: + analytics_story: Ryuk Ransomware + usecase: Advanced Threat Detection + category: + - Malware diff --git a/stories/samsam_ransomware.yml b/stories/ransomware_samsam.yml similarity index 100% rename from stories/samsam_ransomware.yml rename to stories/ransomware_samsam.yml