From 77af8684bc64dad271c41e57033b618824aee94a Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 6 Nov 2020 12:32:48 -0500 Subject: [PATCH 01/12] ryuk story and detections --- .../endpoint/common_ransomware_extensions.yml | 3 +- .../endpoint/common_ransomware_notes.yml | 3 +- .../endpoint/ryuk_test_files_detected.yml | 31 ++++++++++++++++ detections/endpoint/spike_in_file_writes.yml | 1 + ...ndows_security_account_manager_stopped.yml | 35 +++++++++++++++++++ .../remote_desktop_network_bruteforce.yml | 1 + .../remote_desktop_network_traffic.yml | 1 + lookups/ransomware_extensions.csv | 3 +- lookups/ransomware_notes.csv | 2 +- stories/ransomware_ryuk.yml | 20 +++++++++++ ...m_ransomware.yml => ransomware_samsam.yml} | 0 11 files changed, 96 insertions(+), 4 deletions(-) create mode 100644 detections/endpoint/ryuk_test_files_detected.yml create mode 100644 detections/endpoint/windows_security_account_manager_stopped.yml create mode 100644 stories/ransomware_ryuk.yml rename stories/{samsam_ransomware.yml => ransomware_samsam.yml} (100%) diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index b7ea897b2f..0a15ca6cb3 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -1,7 +1,7 @@ name: Common Ransomware Extensions id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec version: 3 -date: '2020-03-16' +date: '2020-11-06' description: The search looks for file modifications with extensions commonly used by Ransomware how_to_implement: 'You must be ingesting data that records the filesystem activity @@ -36,6 +36,7 @@ known_false_positives: It is possible for a legitimate file with these extension tags: analytics_story: - SamSam Ransomware + - Ryuk Ransonware - Ransomware kill_chain_phases: - Actions on Objectives diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml index 4b8b8c9c48..3d75b66985 100644 --- a/detections/endpoint/common_ransomware_notes.yml +++ b/detections/endpoint/common_ransomware_notes.yml @@ -1,7 +1,7 @@ name: Common Ransomware Notes id: ada0f478-84a8-4641-a3f1-d82362d6bd71 version: 3 -date: '2020-03-16' +date: '2020-11-06' description: The search looks for files created with names matching those typically used in ransomware notes that tell the victim how to get their data back. how_to_implement: You must be ingesting data that records file-system activity from @@ -23,6 +23,7 @@ tags: analytics_story: - SamSam Ransomware - Ransomware + - Ryuk Ransomware kill_chain_phases: - Actions on Objectives cis20: diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml new file mode 100644 index 0000000000..4b609b2b5f --- /dev/null +++ b/detections/endpoint/ryuk_test_files_detected.yml @@ -0,0 +1,31 @@ +name: Samsam Test File Write +id: b26a218c-cac9-4ac1-85d7-dfa8331ca4c3 +version: 1 +date: '2020-11-06' +description: The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Samsam propagation. how_to_implement: You must be ingesting data that records the file-system activity + from your hosts to populate the Endpoint file-system data-model node. If you are + using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which + you want to collect data. +type: ESCU +references: [] +author: Rod Soto, Jose Hernandez, Splunk +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + lastTime FROM datamodel=Endpoint.Filesystem WHERE "Filesystem.file_path"=C:\\*Ryuk* BY "Filesystem.dest", "Filesystem.user", "Filesystem.file_path" + | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `ryuk_test_files_detected_filter`' +known_false_positives: If there are files with this keywoord as file names it might trigger false possitives, please make use of our filters to tune out potential FPs. +tags: + mitre_attack_id: + - T1486 + analytics_story: + - Ryuk Ransomware + kill_chain_phases: + - Delivery + cis20: + - CIS 8 + nist: + - PR.PT + - DE.CM + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/spike_in_file_writes.yml b/detections/endpoint/spike_in_file_writes.yml index b35941f8f0..ec80b049b5 100644 --- a/detections/endpoint/spike_in_file_writes.yml +++ b/detections/endpoint/spike_in_file_writes.yml @@ -25,6 +25,7 @@ known_false_positives: It is important to understand that if you happen to insta tags: analytics_story: - SamSam Ransomware + - Ryuk Ransomware - Ransomware kill_chain_phases: - Actions on Objectives diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml new file mode 100644 index 0000000000..5ff408d5c9 --- /dev/null +++ b/detections/endpoint/windows_security_account_manager_stopped.yml @@ -0,0 +1,35 @@ +name: Windows Security Account Manager Stopped +id: 69c12d59-d951-431e-ab77-ec426b8d65e6 +version: 1 +date: '2020-11-06' +description: The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. + This is consistent with Ryuk infections across a fleet of endpoints. + directory tree, which is consistent with Samsam propagation. +how_to_implement: You must be ingesting data that records the process-system activity + from your hosts to populate the Endpoint Processes data-model object. If you are + using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which + you want to collect data. +type: ESCU +references: [] +author: Rod Soto, Jose Hernandez, Splunk +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes WHERE ("Processes.process_name"="net*.exe" "Processes.process"="*stop \"samss\"*") BY "Processes.dest", "Processes.user", "Processes.process" + | `drop_dm_object_name(Processes)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_security_account_manager_stopped_filter`' +known_false_positives: SAM is a critical windows service, stopping it would cause major issues on an endpoint this makes false positive rare. AlthoughNo false positives have been identified. +tags: + mitre_attack_id: + - T1489 + analytics_story: + - Ryuk Ransomware + kill_chain_phases: + - Delivery + cis20: + - CIS 8 + nist: + - PR.PT + - DE.CM + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/network/remote_desktop_network_bruteforce.yml b/detections/network/remote_desktop_network_bruteforce.yml index 972dfd3b8b..c69a0c7bd5 100644 --- a/detections/network/remote_desktop_network_bruteforce.yml +++ b/detections/network/remote_desktop_network_bruteforce.yml @@ -21,6 +21,7 @@ known_false_positives: RDP gateways may have unusually high amounts of traffic f tags: analytics_story: - SamSam Ransomware + - Ryuk Ransomware mitre_attack_id: - T1021.001 kill_chain_phases: diff --git a/detections/network/remote_desktop_network_traffic.yml b/detections/network/remote_desktop_network_traffic.yml index e3e4fbe976..4fa73789d2 100644 --- a/detections/network/remote_desktop_network_traffic.yml +++ b/detections/network/remote_desktop_network_traffic.yml @@ -28,6 +28,7 @@ known_false_positives: Remote Desktop may be used legitimately by users on the n tags: analytics_story: - SamSam Ransomware + - Ryuk Ransomware - Hidden Cobra Malware - Lateral Movement mitre_attack_id: diff --git a/lookups/ransomware_extensions.csv b/lookups/ransomware_extensions.csv index 11cae0e9fe..d226ac48d4 100644 --- a/lookups/ransomware_extensions.csv +++ b/lookups/ransomware_extensions.csv @@ -288,4 +288,5 @@ Extensions,Name .wcry,WannaCry .wnry,WannaCry .wncryt,WannaCry -.WNCRYT,WannaCry \ No newline at end of file +.WNCRYT,WannaCry +.RYK,Ryuk diff --git a/lookups/ransomware_notes.csv b/lookups/ransomware_notes.csv index 4c2e4edc0f..ead875e6e9 100644 --- a/lookups/ransomware_notes.csv +++ b/lookups/ransomware_notes.csv @@ -56,4 +56,4 @@ HELP_DECRYPT_YOUR_FILES.HTML,True *-HELP_FOR_DECRYPT_FILE.html,True *-SORRY-FOR-FILES.html,True *-READ-FOR-HELLPP.html,True -PLEASE_READ_FOR_DECRYPT_FILES_*.html,True \ No newline at end of file +RyukReadMe.html,True diff --git a/stories/ransomware_ryuk.yml b/stories/ransomware_ryuk.yml new file mode 100644 index 0000000000..2cc87777ce --- /dev/null +++ b/stories/ransomware_ryuk.yml @@ -0,0 +1,20 @@ +name: Ryuk Ransomware +id: 507edc74-13d5-4339-878e-b9744ded1f35 +version: 1 +date: '2020-11-06' +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the Ryuk ransomware, including looking for file writes associated + with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, suspicious psexec use, and more. +narrative: 'Cybersecurity Infrastructure Security Agency (CISA) released Alert (AA20-302A) on October 28th called “Ransomware Activity Targeting the Healthcare and Public Health Sector.” This alert details TTPs associated with ongoing and possible imminent attacks against the Healthcare sector, and is a joint advisory in coordination with other U.S. Government agencies. The objective of these malicious campaigns is to infiltrate targets in named sectors and to drop ransomware payloads, which will likely cause disruption of service and increase risk of actual harm to the health and safety of patients at hospitals, even with the aggravant of an ongoing COVID-19 pandemic. This document specifically refers to several crimeware exploitation frameworks, emphasizing the use of Ryuk ransomware as payload. +The Ryuk ransomware payload is not new. It has been well documented and identified in multiple variants. Payloads need a carrier, and for Ryuk it has often been exploitation frameworks such as Cobalt Strike, or popular crimeware frameworks such as Emotet or Trickbot.' +author: Jose Hernandez, Splunk +type: ESCU +references: +- https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html +- https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/ +- https://us-cert.cisa.gov/ncas/alerts/aa20-302a +tags: + analytics_story: Ryuk Ransomware + usecase: Advanced Threat Detection + category: + - Malware diff --git a/stories/samsam_ransomware.yml b/stories/ransomware_samsam.yml similarity index 100% rename from stories/samsam_ransomware.yml rename to stories/ransomware_samsam.yml From 301c13f7faf1db2a21148b78cbfa52a10fd01126 Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 6 Nov 2020 17:34:40 -0500 Subject: [PATCH 02/12] new detections --- .../windows_connhost_exe_force_flag.yml | 31 ++++++++++++++++ .../windows_disableantispyware_reg.yml | 36 +++++++++++++++++++ 2 files changed, 67 insertions(+) create mode 100644 detections/endpoint/windows_connhost_exe_force_flag.yml create mode 100644 detections/endpoint/windows_disableantispyware_reg.yml diff --git a/detections/endpoint/windows_connhost_exe_force_flag.yml b/detections/endpoint/windows_connhost_exe_force_flag.yml new file mode 100644 index 0000000000..fa912a9ccf --- /dev/null +++ b/detections/endpoint/windows_connhost_exe_force_flag.yml @@ -0,0 +1,31 @@ +name: Windows connhost.exe started forcefully +id: c114aaca-68ee-41c2-ad8c-32bf21db8769 +version: 1 +date: '2020-11-06' +description: 'The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1. +This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware.' +how_to_implement: You must be ingesting data that records the process-system activity + from your hosts to populate the Endpoint Processes data-model object. If you are + using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which + you want to collect data. +type: ESCU +references: [] +author: Rod Soto, Jose Hernandez, Splunk +search: '| `sysmon` CommandLine="*C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1*" EventCode=4688 + | | table CommandLine, Computer, EventCode, SubjectUserSid + | `windows_connhost_exe_force_flag`' +known_false_positives: This process should not be ran forcefully, we have not see any false positives for this detection +tags: + mitre_attack_id: + - T1059.003 + analytics_story: + - Ryuk Ransomware + kill_chain_phases: + - Delivery + cis20: + - CIS 8 + nist: + - PR.PT + - DE.CM + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml new file mode 100644 index 0000000000..40a4b57954 --- /dev/null +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -0,0 +1,36 @@ +name: Windows DisableAntiSpyware Registry +id: 23150a40-9301-4195-b802-5bb4f43067fb +version: 1 +date: '2020-11-06' +description: The search looks for the Registry Key DisableAntiSpyware set to disable. + This is consistent with Ryuk infections across a fleet of endpoints. +how_to_implement: You must be ingesting data that records the process-system activity + from your hosts to populate the Endpoint Processes data-model object. If you are + using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which + you want to collect data. +type: ESCU +references: [] +author: Rod Soto, Jose Hernandez, Splunk +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_key_name="DisableAntiSpyware" AND + Registry.registry_value_name="DWORD (0x00000000)" by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name + | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_disableantispyware_reg_filter`' +known_false_positives: It is unusual to turn this feature on a Windows system since it is a default security control, although it is not rare for some policies to disable it. + Although no false positives have been identified, use the provided filter macro to tune the search. +tags: + mitre_attack_id: + - T1562.001 + analytics_story: + - Ryuk Ransomware + kill_chain_phases: + - Delivery + cis20: + - CIS 8 + nist: + - PR.PT + - DE.CM + security_domain: endpoint + asset_type: Endpoint From 2ecead42323959bcaea92d8c986c06013d308111 Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 6 Nov 2020 18:32:56 -0500 Subject: [PATCH 03/12] added additional checks to validate --- bin/validate.py | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/bin/validate.py b/bin/validate.py index 0246833c06..a7910d98bc 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -62,7 +62,7 @@ def validate_schema(REPO_PATH, type, objects): return objects, error, errors -def validate_objects(REPO_PATH, objects): +def validate_objects(REPO_PATH, objects, verbose): # uuids uuids = [] @@ -76,6 +76,8 @@ def validate_objects(REPO_PATH, objects): validation_errors, uuids = validate_standard_fields(object, uuids) errors = errors + validation_errors + if verbose: + print("validating object {0}".format(object['name'])) for object in objects['detections']: if object['type'] == 'ESCU': errors = errors + validate_detection_search(object, objects['macros']) @@ -159,6 +161,11 @@ def validate_detection_search(object, macros): errors.append("ERROR: Missing filter for detection: " + object['name']) filter_macro = re.search("([a-z0-9_]*_filter)", object['search']) + + if not filter_macro: + errors.append("ERROR: filter macro not found for detection: " + object['name']) + return errors + if filter_macro.group(1) != (object['name'].replace(' ', '_').replace('-', '_').replace('.', '_').replace('/', '_').lower() + '_filter'): errors.append("ERROR: filter for detection: " + object['name'] + " needs to use the name of the detection in lowercase and the special characters needs to be converted into _ .") @@ -242,7 +249,7 @@ def validate_lookups_content(REPO_PATH, lookup_path, lookup): if len(errors) > 0: schema_errors = schema_errors + errors - validation_errors = validate_objects(REPO_PATH, objects) + validation_errors = validate_objects(REPO_PATH, objects, verbose) schema_errors = schema_errors + validation_errors From 2d37dc2e26176a552b3799df7ac3d9997abe24cf Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 6 Nov 2020 19:07:54 -0500 Subject: [PATCH 04/12] fixed validation errors --- detections/endpoint/ryuk_test_files_detected.yml | 11 ++++++----- detections/endpoint/samsam_test_file_write.yml | 2 +- .../endpoint/windows_connhost_exe_force_flag.yml | 16 ++++++++-------- .../endpoint/windows_disableantispyware_reg.yml | 2 +- .../windows_security_account_manager_stopped.yml | 1 - 5 files changed, 16 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml index 4b609b2b5f..1f9938949b 100644 --- a/detections/endpoint/ryuk_test_files_detected.yml +++ b/detections/endpoint/ryuk_test_files_detected.yml @@ -1,11 +1,12 @@ -name: Samsam Test File Write -id: b26a218c-cac9-4ac1-85d7-dfa8331ca4c3 +name: Ryuk Test Files Detected +id: 57d44d70-28d9-4ed1-acf5-1c80ae2bbce3 version: 1 date: '2020-11-06' -description: The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Samsam propagation. how_to_implement: You must be ingesting data that records the file-system activity - from your hosts to populate the Endpoint file-system data-model node. If you are +description: 'The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Samsam propagation. how_to_implement: You must be ingesting data that records the file-system activity' +how_to_implement: 'You must be ingesting data that records the filesystem activity + from your hosts to populate the Endpoint Filesystem data-model object. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which - you want to collect data. + you want to collect data.' type: ESCU references: [] author: Rod Soto, Jose Hernandez, Splunk diff --git a/detections/endpoint/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml index 4e7b278bb3..7fcdf0b8c6 100644 --- a/detections/endpoint/samsam_test_file_write.yml +++ b/detections/endpoint/samsam_test_file_write.yml @@ -1,5 +1,5 @@ name: Samsam Test File Write -id: 69c12d59-d951-431e-ab77-ec426b8d65e6 +id: 493a879d-519d-428f-8f57-a06a0fdc107e version: 1 date: '2018-12-14' description: The search looks for a file named "test.txt" written to the windows system diff --git a/detections/endpoint/windows_connhost_exe_force_flag.yml b/detections/endpoint/windows_connhost_exe_force_flag.yml index fa912a9ccf..d238f63107 100644 --- a/detections/endpoint/windows_connhost_exe_force_flag.yml +++ b/detections/endpoint/windows_connhost_exe_force_flag.yml @@ -1,4 +1,4 @@ -name: Windows connhost.exe started forcefully +name: Windows connhost exe started forcefully id: c114aaca-68ee-41c2-ad8c-32bf21db8769 version: 1 date: '2020-11-06' @@ -12,20 +12,20 @@ type: ESCU references: [] author: Rod Soto, Jose Hernandez, Splunk search: '| `sysmon` CommandLine="*C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1*" EventCode=4688 - | | table CommandLine, Computer, EventCode, SubjectUserSid - | `windows_connhost_exe_force_flag`' + | table CommandLine, Computer, EventCode, SubjectUserSid + | `windows_connhost_exe_started_forcefully_filter`' known_false_positives: This process should not be ran forcefully, we have not see any false positives for this detection tags: mitre_attack_id: - T1059.003 analytics_story: - - Ryuk Ransomware + - Ryuk Ransomware kill_chain_phases: - - Delivery + - Delivery cis20: - - CIS 8 + - CIS 8 nist: - - PR.PT - - DE.CM + - PR.PT + - DE.CM security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml index 40a4b57954..5cf387faaf 100644 --- a/detections/endpoint/windows_disableantispyware_reg.yml +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` - | `windows_disableantispyware_reg_filter`' + | `windows_disableantispyware_registry_filter`' known_false_positives: It is unusual to turn this feature on a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search. tags: diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml index 5ff408d5c9..74a6fa6acd 100644 --- a/detections/endpoint/windows_security_account_manager_stopped.yml +++ b/detections/endpoint/windows_security_account_manager_stopped.yml @@ -4,7 +4,6 @@ version: 1 date: '2020-11-06' description: The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. This is consistent with Ryuk infections across a fleet of endpoints. - directory tree, which is consistent with Samsam propagation. how_to_implement: You must be ingesting data that records the process-system activity from your hosts to populate the Endpoint Processes data-model object. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which From 7af33cfd4f92ec4ba9dd967b418050b4811b1fcb Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Sun, 8 Nov 2020 10:27:03 -0500 Subject: [PATCH 05/12] ryuktestfilestestfile --- tests/endpoint/ryuk_test_files_detected.test.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 tests/endpoint/ryuk_test_files_detected.test.yml diff --git a/tests/endpoint/ryuk_test_files_detected.test.yml b/tests/endpoint/ryuk_test_files_detected.test.yml new file mode 100644 index 0000000000..47ef34e331 --- /dev/null +++ b/tests/endpoint/ryuk_test_files_detected.test.yml @@ -0,0 +1,10 @@ +name: Ryuk Test Files Detected +detections: +- name: Ryuk Test Files Detected + file: detections/endpoint/ryuk_test_files_detected.yml + pass_condition: '| stats count | where count > 0' +- attack_data: + file_name: windows-sysmon.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1486.all/Ryuk_Test_Files_Detected_57d44d70-28d9-4ed1-acf5-1c80ae2bbce3.json + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From 2fd9f07c75176adf5c084ff4e0ac3e7a2302ec1a Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Sun, 8 Nov 2020 10:57:02 -0500 Subject: [PATCH 06/12] winconhostryuksearch --- .../Windows_connhost_exe_started_forcefully.test.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 tests/endpoint/Windows_connhost_exe_started_forcefully.test.yml diff --git a/tests/endpoint/Windows_connhost_exe_started_forcefully.test.yml b/tests/endpoint/Windows_connhost_exe_started_forcefully.test.yml new file mode 100644 index 0000000000..81df307b01 --- /dev/null +++ b/tests/endpoint/Windows_connhost_exe_started_forcefully.test.yml @@ -0,0 +1,10 @@ +name: Windows connhost exe started forcefully +detections: +- name: Windows connhost exe started forcefully + file: detections/endpoint/windows_connhost_exe_force_flag.yml + pass_condition: '| stats count | where count > 0' +- attack_data: + file_name: windows-sysmon.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1059.all/Windows_connhost_exe_started_forcefully_c114aaca-68ee-41c2-ad8c-32bf21db8769.json + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From e21455a145974e4e4df9094ac06d3c51dc041709 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Sun, 8 Nov 2020 11:10:49 -0500 Subject: [PATCH 07/12] fixnamedaddedantispyware --- ...est.yml => windows_conhost_exe_force_flag.test.yml} | 0 tests/endpoint/windows_disableantispyware_reg.test.yml | 10 ++++++++++ 2 files changed, 10 insertions(+) rename tests/endpoint/{Windows_connhost_exe_started_forcefully.test.yml => windows_conhost_exe_force_flag.test.yml} (100%) create mode 100644 tests/endpoint/windows_disableantispyware_reg.test.yml diff --git a/tests/endpoint/Windows_connhost_exe_started_forcefully.test.yml b/tests/endpoint/windows_conhost_exe_force_flag.test.yml similarity index 100% rename from tests/endpoint/Windows_connhost_exe_started_forcefully.test.yml rename to tests/endpoint/windows_conhost_exe_force_flag.test.yml diff --git a/tests/endpoint/windows_disableantispyware_reg.test.yml b/tests/endpoint/windows_disableantispyware_reg.test.yml new file mode 100644 index 0000000000..9862fece2a --- /dev/null +++ b/tests/endpoint/windows_disableantispyware_reg.test.yml @@ -0,0 +1,10 @@ +name: Windows DisableAntiSpyware Registry +detections: +- name: Windows DisableAntiSpyware Registry + file: detections/endpoint/windows_disableantispyware_reg.yml + pass_condition: '| stats count | where count > 0' +- attack_data: + file_name: windows-sysmon.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1562.001/Windows_DisableAntiSpyware_Registry_23150a40-9301-4195-b802-5bb4f43067fb.json + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From f8a131528d64198cf19699893293951862b52027 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Sun, 8 Nov 2020 11:30:34 -0500 Subject: [PATCH 08/12] widowswsecuritysamsearch --- .../windows_security_account_manager_stopped.test.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 tests/endpoint/windows_security_account_manager_stopped.test.yml diff --git a/tests/endpoint/windows_security_account_manager_stopped.test.yml b/tests/endpoint/windows_security_account_manager_stopped.test.yml new file mode 100644 index 0000000000..337da0feca --- /dev/null +++ b/tests/endpoint/windows_security_account_manager_stopped.test.yml @@ -0,0 +1,10 @@ +name: Windows Security Account Manager Stopped +detections: +- name: Windows Security Account Manager Stopped + file: detections/endpoint/windows_security_account_manager_stopped.yml + pass_condition: '| stats count | where count > 0' +- attack_data: + file_name: windows-sysmon.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1489.all/windows_security_account_manager_stopped_69c12d59-d951-431e-ab77-ec426b8d65e6.json + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From f8fc4fa95d54f3f09ef0019665d4b55999528fa6 Mon Sep 17 00:00:00 2001 From: divious1 Date: Mon, 9 Nov 2020 11:10:10 -0500 Subject: [PATCH 09/12] fixing warning on comparisons --- bin/generate.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index 0d9255e762..66ee9225b7 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -279,9 +279,9 @@ def generate_workbench_panels(response_tasks, stories, TEMPLATE_PATH, OUTPUT_PAT template = j2_env.get_template('panel.j2') file_path = "default/data/ui/panels/workbench_panel_" + response_file_name + ".xml" output_path = path.join(OUTPUT_PATH, file_path) - if response_task['search'].find(">") is not -1: + if response_task['search'].find(">") != -1: response_task['search']= response_task['search'].replace(">",">") - if response_task['search'].find("<") is not -1: + if response_task['search'].find("<") != -1: response_task['search']= response_task['search'].replace("<","<") output = template.render(search=response_task['search']) From 6b8b2b61ec0147c61e2ffec9244f5dc3d2adc87e Mon Sep 17 00:00:00 2001 From: divious1 Date: Mon, 9 Nov 2020 14:55:16 -0500 Subject: [PATCH 10/12] Revert "Merge remote-tracking branch 'origin/ryuktestsfiles' into ryuk-story" This reverts commit b1db736eb236454aa0301458b8ef1bbbe29bbdd1, reversing changes made to 026bb228a01555c15bbb17b43fd8516c42f702f6. --- tests/endpoint/ryuk_test_files_detected.test.yml | 10 ---------- tests/endpoint/windows_conhost_exe_force_flag.test.yml | 10 ---------- tests/endpoint/windows_disableantispyware_reg.test.yml | 10 ---------- .../windows_security_account_manager_stopped.test.yml | 10 ---------- 4 files changed, 40 deletions(-) delete mode 100644 tests/endpoint/ryuk_test_files_detected.test.yml delete mode 100644 tests/endpoint/windows_conhost_exe_force_flag.test.yml delete mode 100644 tests/endpoint/windows_disableantispyware_reg.test.yml delete mode 100644 tests/endpoint/windows_security_account_manager_stopped.test.yml diff --git a/tests/endpoint/ryuk_test_files_detected.test.yml b/tests/endpoint/ryuk_test_files_detected.test.yml deleted file mode 100644 index 47ef34e331..0000000000 --- a/tests/endpoint/ryuk_test_files_detected.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Ryuk Test Files Detected -detections: -- name: Ryuk Test Files Detected - file: detections/endpoint/ryuk_test_files_detected.yml - pass_condition: '| stats count | where count > 0' -- attack_data: - file_name: windows-sysmon.log - data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1486.all/Ryuk_Test_Files_Detected_57d44d70-28d9-4ed1-acf5-1c80ae2bbce3.json - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/tests/endpoint/windows_conhost_exe_force_flag.test.yml b/tests/endpoint/windows_conhost_exe_force_flag.test.yml deleted file mode 100644 index 81df307b01..0000000000 --- a/tests/endpoint/windows_conhost_exe_force_flag.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Windows connhost exe started forcefully -detections: -- name: Windows connhost exe started forcefully - file: detections/endpoint/windows_connhost_exe_force_flag.yml - pass_condition: '| stats count | where count > 0' -- attack_data: - file_name: windows-sysmon.log - data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1059.all/Windows_connhost_exe_started_forcefully_c114aaca-68ee-41c2-ad8c-32bf21db8769.json - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/tests/endpoint/windows_disableantispyware_reg.test.yml b/tests/endpoint/windows_disableantispyware_reg.test.yml deleted file mode 100644 index 9862fece2a..0000000000 --- a/tests/endpoint/windows_disableantispyware_reg.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Windows DisableAntiSpyware Registry -detections: -- name: Windows DisableAntiSpyware Registry - file: detections/endpoint/windows_disableantispyware_reg.yml - pass_condition: '| stats count | where count > 0' -- attack_data: - file_name: windows-sysmon.log - data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1562.001/Windows_DisableAntiSpyware_Registry_23150a40-9301-4195-b802-5bb4f43067fb.json - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog diff --git a/tests/endpoint/windows_security_account_manager_stopped.test.yml b/tests/endpoint/windows_security_account_manager_stopped.test.yml deleted file mode 100644 index 337da0feca..0000000000 --- a/tests/endpoint/windows_security_account_manager_stopped.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Windows Security Account Manager Stopped -detections: -- name: Windows Security Account Manager Stopped - file: detections/endpoint/windows_security_account_manager_stopped.yml - pass_condition: '| stats count | where count > 0' -- attack_data: - file_name: windows-sysmon.log - data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1489.all/windows_security_account_manager_stopped_69c12d59-d951-431e-ab77-ec426b8d65e6.json - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog From 30c6fa660646c90c7f59c20369b428d6cbe307ec Mon Sep 17 00:00:00 2001 From: divious1 Date: Mon, 9 Nov 2020 17:32:13 -0500 Subject: [PATCH 11/12] fixing minor mistakes --- bin/generate.py | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index 66ee9225b7..ac7fcc9daa 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -279,10 +279,8 @@ def generate_workbench_panels(response_tasks, stories, TEMPLATE_PATH, OUTPUT_PAT template = j2_env.get_template('panel.j2') file_path = "default/data/ui/panels/workbench_panel_" + response_file_name + ".xml" output_path = path.join(OUTPUT_PATH, file_path) - if response_task['search'].find(">") != -1: - response_task['search']= response_task['search'].replace(">",">") - if response_task['search'].find("<") != -1: - response_task['search']= response_task['search'].replace("<","<") + response_task['search']= response_task['search'].replace(">",">") + response_task['search']= response_task['search'].replace("<","<") output = template.render(search=response_task['search']) with open(output_path, 'w') as f: From d73c630bb09c71e640753b003f128a1e63868e80 Mon Sep 17 00:00:00 2001 From: divious1 Date: Mon, 9 Nov 2020 17:38:09 -0500 Subject: [PATCH 12/12] removed samsam notes --- detections/endpoint/ryuk_test_files_detected.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml index 1f9938949b..84b082ca8c 100644 --- a/detections/endpoint/ryuk_test_files_detected.yml +++ b/detections/endpoint/ryuk_test_files_detected.yml @@ -2,7 +2,7 @@ name: Ryuk Test Files Detected id: 57d44d70-28d9-4ed1-acf5-1c80ae2bbce3 version: 1 date: '2020-11-06' -description: 'The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Samsam propagation. how_to_implement: You must be ingesting data that records the file-system activity' +description: 'The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Ryuk propagation.' how_to_implement: 'You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint Filesystem data-model object. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which