Skip to content

Commit 1f5975b

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3294 from splunk/restore-deleted-to-deprecated
Restore deleted analytics to deprecated
2 parents eaa2880 + 63f0fb8 commit 1f5975b

File tree

65 files changed

+2727
-65
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

65 files changed

+2727
-65
lines changed

Diff for: ‎detections/deprecated/attempt_to_stop_security_service.yml

+96
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
name: Attempt To Stop Security Service
2+
id: c8e349c6-b97c-486e-8949-bd7bcd1f3910
3+
version: 9
4+
date: '2025-01-24'
5+
author: Rico Valdez, Splunk
6+
status: deprecated
7+
type: TTP
8+
description: The following analytic has been deprecated.
9+
The following analytic detects attempts to stop security-related services
10+
on an endpoint, which may indicate malicious activity. It leverages data from Endpoint
11+
Detection and Response (EDR) agents, specifically searching for processes involving
12+
the "sc.exe" command with the "stop" parameter. This activity is significant because
13+
disabling security services can undermine the organization's security posture, potentially
14+
leading to unauthorized access, data exfiltration, or further attacks like malware
15+
installation or privilege escalation. If confirmed malicious, this behavior could
16+
compromise the endpoint and the entire network, necessitating immediate investigation
17+
and response.
18+
data_source:
19+
- Sysmon EventID 1
20+
- Windows Event Log Security 4688
21+
- CrowdStrike ProcessRollup2
22+
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
23+
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
24+
where `process_net` OR Processes.process_name = sc.exe Processes.process="* stop
25+
*" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name
26+
Processes.process_name Processes.original_file_name Processes.process Processes.process_id
27+
Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
28+
| `security_content_ctime(lastTime)` |lookup security_services_lookup service as
29+
process OUTPUTNEW category, description | search category=security | `attempt_to_stop_security_service_filter`'
30+
how_to_implement: The detection is based on data that originates from Endpoint Detection
31+
and Response (EDR) agents. These agents are designed to provide security-related
32+
telemetry from the endpoints where the agent is installed. To implement this search,
33+
you must ingest logs that contain the process GUID, process name, and parent process.
34+
Additionally, you must ingest complete command-line executions. These logs must
35+
be processed using the appropriate Splunk Technology Add-ons that are specific to
36+
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
37+
data model. Use the Splunk Common Information Model (CIM) to normalize the field
38+
names and speed up the data modeling process.
39+
known_false_positives: None identified. Attempts to disable security-related services
40+
should be identified and understood.
41+
references:
42+
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
43+
- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
44+
drilldown_searches:
45+
- name: View the detection results for - "$user$" and "$dest$"
46+
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
47+
earliest_offset: $info_min_time$
48+
latest_offset: $info_max_time$
49+
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
50+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
51+
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
52+
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
53+
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
54+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
55+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
56+
earliest_offset: $info_min_time$
57+
latest_offset: $info_max_time$
58+
rba:
59+
message: An instance of $parent_process_name$ spawning $process_name$ was identified
60+
attempting to disable security services on endpoint $dest$ by user $user$.
61+
risk_objects:
62+
- field: user
63+
type: user
64+
score: 20
65+
- field: dest
66+
type: system
67+
score: 20
68+
threat_objects:
69+
- field: parent_process_name
70+
type: parent_process_name
71+
- field: process_name
72+
type: process_name
73+
tags:
74+
analytic_story:
75+
- WhisperGate
76+
- Graceful Wipe Out Attack
77+
- Disabling Security Tools
78+
- Data Destruction
79+
- Azorult
80+
- Trickbot
81+
asset_type: Endpoint
82+
mitre_attack_id:
83+
- T1562.001
84+
- T1562
85+
product:
86+
- Splunk Enterprise
87+
- Splunk Enterprise Security
88+
- Splunk Cloud
89+
security_domain: endpoint
90+
tests:
91+
- name: True Positive Test
92+
attack_data:
93+
- data:
94+
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_defend_service_stop/windows-sysmon.log
95+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
96+
sourcetype: XmlWinEventLog

Diff for: ‎detections/deprecated/change_default_file_association.yml

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
name: Change Default File Association
2+
id: 462d17d8-1f71-11ec-ad07-acde48001122
3+
version: 5
4+
date: '2025-01-24'
5+
author: Teoderick Contreras, Splunk
6+
status: deprecated
7+
type: TTP
8+
description: The following analytic has been deprecated.
9+
The following analytic detects suspicious registry modifications that
10+
change the default file association to execute a malicious payload. It leverages
11+
data from the Endpoint data model, specifically monitoring registry paths under
12+
"*\\shell\\open\\command\\*" and "*HKCR\\*". This activity is significant because
13+
altering default file associations can allow attackers to execute arbitrary scripts
14+
or payloads when a user opens a file, leading to potential code execution. If confirmed
15+
malicious, this technique can enable attackers to persist on the compromised host
16+
and execute further malicious commands, posing a severe threat to the environment.
17+
data_source:
18+
- Sysmon EventID 12
19+
- Sysmon EventID 13
20+
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
21+
max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
22+
="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest Registry.user
23+
Registry.registry_path Registry.registry_key_name Registry.registry_value_name |
24+
`security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
25+
| `change_default_file_association_filter`'
26+
how_to_implement: To successfully implement this search, you must be ingesting data
27+
that records registry activity from your hosts to populate the endpoint data model
28+
in the registry node. This is typically populated via endpoint detection-and-response
29+
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
30+
used for this search is typically generated via logs that report reads and writes
31+
to the registry.
32+
known_false_positives: unknown
33+
references:
34+
- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features
35+
drilldown_searches:
36+
- name: View the detection results for - "$dest$" and "$user$"
37+
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
38+
earliest_offset: $info_min_time$
39+
latest_offset: $info_max_time$
40+
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
41+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
42+
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
43+
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
44+
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
45+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
46+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
47+
earliest_offset: $info_min_time$
48+
latest_offset: $info_max_time$
49+
rba:
50+
message: Registry path $registry_path$ was modified, added, or deleted on $dest$.
51+
risk_objects:
52+
- field: dest
53+
type: system
54+
score: 80
55+
- field: user
56+
type: user
57+
score: 80
58+
threat_objects: []
59+
tags:
60+
analytic_story:
61+
- Hermetic Wiper
62+
- Windows Registry Abuse
63+
- Prestige Ransomware
64+
- Windows Privilege Escalation
65+
- Windows Persistence Techniques
66+
- Data Destruction
67+
asset_type: Endpoint
68+
mitre_attack_id:
69+
- T1546.001
70+
- T1546
71+
product:
72+
- Splunk Enterprise
73+
- Splunk Enterprise Security
74+
- Splunk Cloud
75+
security_domain: endpoint
76+
tests:
77+
- name: True Positive Test
78+
attack_data:
79+
- data:
80+
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log
81+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
82+
sourcetype: XmlWinEventLog

Diff for: ‎detections/deprecated/cmdline_tool_not_executed_in_cmd_shell.yml

+102
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
name: Cmdline Tool Not Executed In CMD Shell
2+
id: 6c3f7dd8-153c-11ec-ac2d-acde48001122
3+
version: 7
4+
date: '2025-01-24'
5+
author: Teoderick Contreras, Splunk
6+
status: deprecated
7+
type: TTP
8+
description: The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`,
9+
or similar tools are executed by a non-standard parent process, excluding CMD, PowerShell,
10+
or Explorer. This detection leverages Endpoint Detection and Response (EDR) telemetry
11+
to monitor process creation events. Such behavior is significant as it may indicate
12+
adversaries using injected processes to perform system discovery, a tactic observed
13+
in FIN7's JSSLoader. If confirmed malicious, this activity could allow attackers
14+
to gather critical host information, aiding in further exploitation or lateral movement
15+
within the network.
16+
data_source:
17+
- Sysmon EventID 1
18+
- Windows Event Log Security 4688
19+
- CrowdStrike ProcessRollup2
20+
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
21+
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "ipconfig.exe"
22+
OR Processes.process_name = "systeminfo.exe" OR Processes.process_name = "net.exe"
23+
OR Processes.process_name = "net1.exe" OR Processes.process_name = "arp.exe" OR
24+
Processes.process_name = "nslookup.exe" OR Processes.process_name = "route.exe"
25+
OR Processes.process_name = "netstat.exe" OR Processes.process_name = "whoami.exe")
26+
AND NOT (Processes.parent_process_name = "cmd.exe" OR Processes.parent_process_name
27+
= "powershell*" OR Processes.parent_process_name="pwsh.exe" OR Processes.parent_process_name
28+
= "explorer.exe") by Processes.parent_process_name Processes.parent_process Processes.process_name
29+
Processes.original_file_name Processes.process_id Processes.process Processes.dest
30+
Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
31+
| `security_content_ctime(lastTime)` | `cmdline_tool_not_executed_in_cmd_shell_filter`'
32+
how_to_implement: The detection is based on data that originates from Endpoint Detection
33+
and Response (EDR) agents. These agents are designed to provide security-related
34+
telemetry from the endpoints where the agent is installed. To implement this search,
35+
you must ingest logs that contain the process GUID, process name, and parent process.
36+
Additionally, you must ingest complete command-line executions. These logs must
37+
be processed using the appropriate Splunk Technology Add-ons that are specific to
38+
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
39+
data model. Use the Splunk Common Information Model (CIM) to normalize the field
40+
names and speed up the data modeling process.
41+
known_false_positives: A network operator or systems administrator may utilize an
42+
automated host discovery application that may generate false positives. Filter as
43+
needed.
44+
references:
45+
- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation
46+
- https://attack.mitre.org/groups/G0046/
47+
- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
48+
drilldown_searches:
49+
- name: View the detection results for - "$dest$" and "$user$"
50+
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
51+
earliest_offset: $info_min_time$
52+
latest_offset: $info_max_time$
53+
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
54+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
55+
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
56+
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
57+
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
58+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
59+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
60+
earliest_offset: $info_min_time$
61+
latest_offset: $info_max_time$
62+
rba:
63+
message: A non-standard parent process $parent_process_name$ spawned child process
64+
$process_name$ to execute command-line tool on $dest$.
65+
risk_objects:
66+
- field: dest
67+
type: system
68+
score: 56
69+
- field: user
70+
type: user
71+
score: 56
72+
threat_objects:
73+
- field: parent_process_name
74+
type: parent_process_name
75+
- field: process_name
76+
type: process_name
77+
tags:
78+
analytic_story:
79+
- Volt Typhoon
80+
- Rhysida Ransomware
81+
- FIN7
82+
- DarkGate Malware
83+
- Qakbot
84+
- CISA AA22-277A
85+
- CISA AA23-347A
86+
- Gozi Malware
87+
asset_type: Endpoint
88+
mitre_attack_id:
89+
- T1059
90+
- T1059.007
91+
product:
92+
- Splunk Enterprise
93+
- Splunk Enterprise Security
94+
- Splunk Cloud
95+
security_domain: endpoint
96+
tests:
97+
- name: True Positive Test
98+
attack_data:
99+
- data:
100+
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log
101+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
102+
sourcetype: XmlWinEventLog

Diff for: ‎detections/deprecated/create_local_admin_accounts_using_net_exe.yml

+94
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
name: Create local admin accounts using net exe
2+
id: b89919ed-fe5f-492c-b139-151bb162040e
3+
version: 15
4+
date: '2025-01-24'
5+
author: Bhavin Patel, Splunk
6+
status: deprecated
7+
type: TTP
8+
description: The following analytic has been deprecated.
9+
The following analytic detects the creation of local administrator accounts
10+
using the net.exe command. It leverages Endpoint Detection and Response (EDR) data
11+
to identify processes named net.exe or net1.exe with the "/add" parameter and keywords
12+
related to administrator accounts. This activity is significant as it may indicate
13+
an attacker attempting to gain persistent access or escalate privileges. If confirmed
14+
malicious, this could lead to unauthorized access, data theft, or further system
15+
compromise. Review the process details, user context, and related artifacts to determine
16+
the legitimacy of the activity.
17+
data_source:
18+
- Sysmon EventID 1
19+
- Windows Event Log Security 4688
20+
- CrowdStrike ProcessRollup2
21+
search: '| tstats `security_content_summariesonly` count values(Processes.user) as
22+
user values(Processes.parent_process) as parent_process values(parent_process_name)
23+
as parent_process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
24+
where `process_net` AND Processes.process=*/add* AND (Processes.process=*administrators*
25+
OR Processes.process=*administratoren* OR Processes.process=*administrateurs* OR
26+
Processes.process=*administrador* OR Processes.process=*amministratori* OR Processes.process=*administratorer*
27+
OR Processes.process=*Rendszergazda* OR Processes.process=*Администратор* OR Processes.process=*Administratör*)
28+
by Processes.process Processes.process_name Processes.parent_process_name Processes.dest
29+
Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
30+
| `security_content_ctime(lastTime)` | `create_local_admin_accounts_using_net_exe_filter`'
31+
how_to_implement: The detection is based on data that originates from Endpoint Detection
32+
and Response (EDR) agents. These agents are designed to provide security-related
33+
telemetry from the endpoints where the agent is installed. To implement this search,
34+
you must ingest logs that contain the process GUID, process name, and parent process.
35+
Additionally, you must ingest complete command-line executions. These logs must
36+
be processed using the appropriate Splunk Technology Add-ons that are specific to
37+
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
38+
data model. Use the Splunk Common Information Model (CIM) to normalize the field
39+
names and speed up the data modeling process.
40+
known_false_positives: Administrators often leverage net.exe to create admin accounts.
41+
references: []
42+
drilldown_searches:
43+
- name: View the detection results for - "$user$" and "$dest$"
44+
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
45+
earliest_offset: $info_min_time$
46+
latest_offset: $info_max_time$
47+
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
48+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
49+
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
50+
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
51+
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
52+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
53+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
54+
earliest_offset: $info_min_time$
55+
latest_offset: $info_max_time$
56+
rba:
57+
message: An instance of $parent_process_name$ spawning $process_name$ was identified
58+
on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators
59+
group.
60+
risk_objects:
61+
- field: user
62+
type: user
63+
score: 30
64+
- field: dest
65+
type: system
66+
score: 30
67+
threat_objects:
68+
- field: parent_process_name
69+
type: parent_process_name
70+
- field: process_name
71+
type: process_name
72+
tags:
73+
analytic_story:
74+
- DHS Report TA18-074A
75+
- Azorult
76+
- CISA AA22-257A
77+
- DarkGate Malware
78+
- CISA AA24-241A
79+
asset_type: Endpoint
80+
mitre_attack_id:
81+
- T1136.001
82+
- T1136
83+
product:
84+
- Splunk Enterprise
85+
- Splunk Enterprise Security
86+
- Splunk Cloud
87+
security_domain: endpoint
88+
tests:
89+
- name: True Positive Test
90+
attack_data:
91+
- data:
92+
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log
93+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
94+
sourcetype: XmlWinEventLog

0 commit comments

Comments
 (0)