-
Notifications
You must be signed in to change notification settings - Fork 384
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #3291 from splunk/analytics_enhancement
analytics_enhancement
- Loading branch information
Showing
14 changed files
with
404 additions
and
36 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
8 changes: 4 additions & 4 deletions
8
...ndpoint/suspicious_driver_loaded_path.yml → ...recated/suspicious_driver_loaded_path.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
6 changes: 3 additions & 3 deletions
6
detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
88 changes: 88 additions & 0 deletions
88
detections/endpoint/windows_process_execution_in_temp_dir.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,88 @@ | ||
| name: Windows Process Execution in Temp Dir | ||
| id: f6fbe929-4187-4ba4-901e-8a34be838443 | ||
| version: 1 | ||
| date: '2025-01-27' | ||
| author: Teoderick Contreras, Splunk | ||
| status: production | ||
| type: Anomaly | ||
| description: The following analytic identifies processes running from %temp% directory file paths. | ||
| It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process paths within the Endpoint | ||
| data model. This activity is significant because adversaries often use unconventional file paths to execute malicious code without requiring administrative privileges. If confirmed malicious, this behavior could indicate an attempt to bypass security controls, leading to unauthorized software execution, potential system compromise, and further malicious activities within the environment. | ||
| data_source: | ||
| - Sysmon EventID 1 | ||
| - Windows Event Log Security 4688 | ||
| - CrowdStrike ProcessRollup2 | ||
| search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes | ||
| where Processes.process_path IN("*\\temp\\*") | ||
| by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user | ||
| | `drop_dm_object_name(Processes)` | ||
| | `security_content_ctime(firstTime)` | ||
| | `security_content_ctime(lastTime)` | ||
| | `windows_process_execution_in_temp_dir_filter`' | ||
| how_to_implement: The detection is based on data that originates from Endpoint Detection | ||
| and Response (EDR) agents. These agents are designed to provide security-related | ||
| telemetry from the endpoints where the agent is installed. To implement this search, | ||
| you must ingest logs that contain the process GUID, process name, and parent process. | ||
| Additionally, you must ingest complete command-line executions. These logs must | ||
| be processed using the appropriate Splunk Technology Add-ons that are specific to | ||
| the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` | ||
| data model. Use the Splunk Common Information Model (CIM) to normalize the field | ||
| names and speed up the data modeling process. | ||
| known_false_positives: Administrators may allow execution of specific binaries in | ||
| non-standard paths. Filter as needed. | ||
| references: | ||
| - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ | ||
| - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ | ||
| - https://twitter.com/pr0xylife/status/1590394227758104576 | ||
| - https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat | ||
| - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ | ||
| drilldown_searches: | ||
| - name: View the detection results for - "$dest$" | ||
| search: '%original_detection_search% | search dest = "$dest$"' | ||
| earliest_offset: $info_min_time$ | ||
| latest_offset: $info_max_time$ | ||
| - name: View risk events for the last 7 days for - "$dest$" | ||
| search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | ||
| starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime | ||
| values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) | ||
| as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) | ||
| as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | ||
| | `security_content_ctime(lastTime)`' | ||
| earliest_offset: $info_min_time$ | ||
| latest_offset: $info_max_time$ | ||
| rba: | ||
| message: Suspicious process $process_name$ running from temp directory- | ||
| $process_path$ on host- $dest$ | ||
| risk_objects: | ||
| - field: dest | ||
| type: system | ||
| score: 30 | ||
| threat_objects: | ||
| - field: process_path | ||
| type: process_name | ||
| tags: | ||
| analytic_story: | ||
| - Ryuk Ransomware | ||
| - Trickbot | ||
| - Qakbot | ||
| - AgentTesla | ||
| - Remcos | ||
| - NjRAT | ||
| - Ransomware | ||
| asset_type: Endpoint | ||
| mitre_attack_id: | ||
| - T1543 | ||
| - T1036 | ||
| - T1036.005 | ||
| product: | ||
| - Splunk Enterprise | ||
| - Splunk Enterprise Security | ||
| - Splunk Cloud | ||
| security_domain: endpoint | ||
| tests: | ||
| - name: True Positive Test | ||
| attack_data: | ||
| - data: | ||
| https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/process_temp_path/process_temp_path.log | ||
| source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational | ||
| sourcetype: XmlWinEventLog |
78 changes: 78 additions & 0 deletions
78
detections/endpoint/windows_security_and_backup_services_stop.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,78 @@ | ||
| name: Windows Security And Backup Services Stop | ||
| id: 9c24aef6-cad9-4931-acce-74318aa5663b | ||
| version: 1 | ||
| date: '2025-02-07' | ||
| author: Teoderick Contreras, Splunk | ||
| status: production | ||
| type: TTP | ||
| description: The following analytic detects the suspicious termination of known services | ||
| commonly targeted by ransomware before file encryption. It leverages Windows System | ||
| Event Logs (EventCode 7036) to identify when critical services such as Volume Shadow | ||
| Copy, backup, and antivirus services are stopped. This activity is significant because | ||
| ransomware often disables these services to avoid errors and ensure successful file | ||
| encryption. If confirmed malicious, this behavior could lead to widespread data | ||
| encryption, rendering files inaccessible and potentially causing significant operational | ||
| disruption and data loss. | ||
| data_source: | ||
| - Windows Event Log System 7036 | ||
| search: '`wineventlog_system` `normalized_service_binary_field` | ||
| | rename param1 as display_name | ||
| | where param2="stopped" AND (match(display_name, "(?i)(Volume Shadow Copy|VSS|backup|sophos|sql|memtas|mepocs|veeam|svc\$|DefWatch|ccEvtMgr|ccSetMgr|SavRoam|RTVscan|QBFCService|QBIDPService|Intuit\.QuickBooks\.FCS|QBCFMonitorService|YooBackup|YooIT|Veeam|PDVFSService|BackupExec|WdBoot|WdFilter|WdNisDrv|WdNisSvc|WinDefend|wscsvc|Sense|sppsvc|SecurityHealthService)") | ||
| OR match(normalized_service_name, "(?i)(Volume Shadow Copy|VSS|backup|sophos|sql|memtas|mepocs|veeam|svc\$|DefWatch|ccEvtMgr|ccSetMgr|SavRoam|RTVscan|QBFCService|QBIDPService|Intuit\.QuickBooks\.FCS|QBCFMonitorService|YooBackup|YooIT|Veeam|PDVFSService|BackupExec|WdBoot|WdFilter|WdNisDrv|WdNisSvc|WinDefend|wscsvc|Sense|sppsvc|SecurityHealthService)")) | ||
| | stats count min(_time) as firstTime max(_time) as lastTime by EventCode display_name dest normalized_service_name | ||
| | `security_content_ctime(firstTime)` | ||
| | `security_content_ctime(lastTime)` | ||
| | `windows_security_and_backup_services_stop_filter`' | ||
| how_to_implement: To successfully implement this search, you need to be ingesting | ||
| logs with the 7036 EventCode ScManager in System audit Logs from your endpoints. | ||
| known_false_positives: Admin activities or installing related updates may do a sudden | ||
| stop to list of services we monitor. | ||
| references: | ||
| - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ | ||
| - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ | ||
| - https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/ | ||
| - https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html | ||
| drilldown_searches: | ||
| - name: View the detection results for - "$dest$" | ||
| search: '%original_detection_search% | search dest = "$dest$"' | ||
| earliest_offset: $info_min_time$ | ||
| latest_offset: $info_max_time$ | ||
| - name: View risk events for the last 7 days for - "$dest$" | ||
| search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | ||
| starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime | ||
| values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) | ||
| as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) | ||
| as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | ||
| | `security_content_ctime(lastTime)`' | ||
| earliest_offset: $info_min_time$ | ||
| latest_offset: $info_max_time$ | ||
| rba: | ||
| message: Known services $param1$ terminated by a potential ransomware on $dest$ | ||
| risk_objects: | ||
| - field: dest | ||
| type: system | ||
| score: 72 | ||
| threat_objects: | ||
| - field: display_name | ||
| type: service | ||
| tags: | ||
| analytic_story: | ||
| - LockBit Ransomware | ||
| - Ransomware | ||
| - Compromised Windows Host | ||
| - BlackMatter Ransomware | ||
| asset_type: Endpoint | ||
| mitre_attack_id: | ||
| - T1490 | ||
| product: | ||
| - Splunk Enterprise | ||
| - Splunk Enterprise Security | ||
| - Splunk Cloud | ||
| security_domain: endpoint | ||
| tests: | ||
| - name: True Positive Test | ||
| attack_data: | ||
| - data: | ||
| https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/known_services_killed_by_ransomware/windows-xml.log | ||
| source: XmlWinEventLog:System | ||
| sourcetype: XmlWinEventLog |
Oops, something went wrong.