Skip to content

Commit 2a2182e

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3030 from nterl0k/nterl0k-rmm_must_die_update_1
Nterl0k - RMM Must Die - Update
2 parents 4bbaf7b + a980709 commit 2a2182e

10 files changed

+91
-32
lines changed

‎detections/endpoint/detect_remote_access_software_usage_file.yml

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Remote Access Software Usage File
22
id: 3bf5541a-6a45-4fdc-b01d-59b899fff961
3-
version: 2
4-
date: '2024-05-13'
3+
version: 3
4+
date: '2024-07-09'
55
author: Steven Dick
66
status: production
77
type: Anomaly
@@ -20,17 +20,23 @@ search: '| tstats `security_content_summariesonly` count, min(_time) as firstTim
2020
by Filesystem.dest, Filesystem.user, Filesystem.file_name | `security_content_ctime(firstTime)`
2121
| `security_content_ctime(lastTime)` | `drop_dm_object_name(Filesystem)` | lookup
2222
remote_access_software remote_utility AS file_name OUTPUT isutility, description
23-
as signature, comment_reference as desc, category | search isutility = TRUE | `detect_remote_access_software_usage_file_filter`'
23+
as signature, comment_reference as desc, category | search isutility = TRUE
24+
| `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_file_filter`'
2425
how_to_implement: The detection is based on data that originates from Endpoint Detection
2526
and Response (EDR) agents. These agents are designed to provide security-related
2627
telemetry from the endpoints where the agent is installed. To implement this search,
2728
you must ingest logs that contain the file path, file name, and the user that created
2829
the file. These logs must be processed using the appropriate Splunk Technology Add-ons
2930
that are specific to the EDR product. The logs must also be mapped to the `Filesystem`
3031
node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM)
31-
to normalize the field names and speed up the data modeling process.
32+
to normalize the field names and speed up the data modeling process. The "exceptions"
33+
macro leverages both an Assets and Identities lookup, as well as a KVStore collection
34+
called "remote_software_exceptions" that lets you track and maintain device-based
35+
exceptions for this set of detections.
3236
known_false_positives: Known or approved applications used by the organization or
33-
usage of built-in functions.
37+
usage of built-in functions. Known false positives can be added to the
38+
remote_access_software_usage_exception.csv lookup to globally suppress these
39+
situations across all remote access content
3440
references:
3541
- https://attack.mitre.org/techniques/T1219/
3642
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
@@ -72,6 +78,7 @@ tags:
7278
- Filesystem.file_name
7379
risk_score: 25
7480
security_domain: endpoint
81+
manual_test: This detection uses A&I lookups from Enterprise Security.
7582
tests:
7683
- name: True Positive Test
7784
attack_data:

‎detections/endpoint/detect_remote_access_software_usage_fileinfo.yml

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Remote Access Software Usage FileInfo
22
id: ccad96d7-a48c-4f13-8b9c-9f6a31cba454
3-
version: 2
4-
date: '2024-05-29'
3+
version: 3
4+
date: '2024-07-09'
55
author: Steven Dick
66
status: production
77
type: Anomaly
@@ -20,12 +20,15 @@ search: '`sysmon` EventCode=1 | stats count min(_time) as firstTime max(_time) a
2020
lastTime, values(Company) as Company values(Product) as Product by dest, user, parent_process_name,
2121
process_name, process | lookup remote_access_software remote_utility_fileinfo AS
2222
Product OUTPUT isutility, description as signature, comment_reference as desc, category
23-
| search isutility = True | `detect_remote_access_software_usage_fileinfo_filter`'
23+
| search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_fileinfo_filter`'
2424
how_to_implement: This analytic relies on Sysmon to be properly installed and utilized
2525
in the environment. Ensure that proper logging is setup for Sysmon and data is being
26-
ingested into Splunk.
26+
ingested into Splunk. The "exceptions" macro leverages both an Assets and Identities
27+
lookup, as well as a KVStore collection named "remote_software_exceptions"
28+
that lets you track and maintain device-based exceptions for this set of detections.
2729
known_false_positives: Known or approved applications used by the organization or
28-
usage of built-in functions.
30+
usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv
31+
lookup to globally suppress these situations across all remote access content
2932
references:
3033
- https://attack.mitre.org/techniques/T1219/
3134
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
@@ -67,7 +70,8 @@ tags:
6770
- process_name
6871
- process
6972
risk_score: 25
70-
security_domain: endpoint
73+
security_domain: endpoint
74+
manual_test: This detection uses A&I lookups from Enterprise Security.
7175
tests:
7276
- name: True Positive Test
7377
attack_data:

‎detections/endpoint/detect_remote_access_software_usage_process.yml

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Remote Access Software Usage Process
22
id: ffd5e001-2e34-48f4-97a2-26dc4bb08178
3-
version: 2
4-
date: '2024-05-23'
3+
version: 3
4+
date: '2024-07-09'
55
author: Steven Dick
66
status: production
77
type: Anomaly
@@ -23,7 +23,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
2323
Processes.process_name Processes.process | `security_content_ctime(firstTime)` |
2424
`security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | lookup remote_access_software
2525
remote_utility AS process_name OUTPUT isutility, description as signature, comment_reference
26-
as desc, category | search isutility = True | `detect_remote_access_software_usage_process_filter`'
26+
as desc, category | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_process_filter`'
2727
how_to_implement: The detection is based on data that originates from Endpoint Detection
2828
and Response (EDR) agents. These agents are designed to provide security-related
2929
telemetry from the endpoints where the agent is installed. To implement this search,
@@ -32,10 +32,15 @@ how_to_implement: The detection is based on data that originates from Endpoint D
3232
be processed using the appropriate Splunk Technology Add-ons that are specific to
3333
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
3434
data model. Use the Splunk Common Information Model (CIM) to normalize the field
35-
names and speed up the data modeling process.
35+
names and speed up the data modeling process. The "exceptions" macro leverages
36+
both an Assets and Identities lookup, as well as a KVStore collection called
37+
"remote_software_exceptions" that lets you track and maintain device-
38+
based exceptions for this set of detections.
3639
known_false_positives: It is possible that legitimate remote access software is used
3740
within the environment. Ensure that the lookup is reviewed and updated with any
38-
additional remote access software that is used within the environment.
41+
additional remote access software that is used within the environment.
42+
Known false positives can be added to the remote_access_software_usage_exception.csv
43+
lookup to globally suppress these situations across all remote access content
3944
references:
4045
- https://attack.mitre.org/techniques/T1219/
4146
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
@@ -80,6 +85,7 @@ tags:
8085
- Processes.parent_process_name
8186
risk_score: 25
8287
security_domain: endpoint
88+
manual_test: This detection uses A&I lookups from Enterprise Security.
8389
tests:
8490
- name: True Positive Test
8591
attack_data:

‎detections/network/detect_remote_access_software_usage_dns.yml

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Remote Access Software Usage DNS
22
id: a16b797d-e309-41bd-8ba0-5067dae2e4be
33
version: 3
4-
date: '2024-05-27'
4+
date: '2024-07-09'
55
author: Steven Dick
66
status: production
77
type: Anomaly
@@ -13,9 +13,20 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
1313
DNS.query | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` |
1414
`security_content_ctime(lastTime)` | lookup remote_access_software remote_domain
1515
AS query OUTPUT isutility, description as signature, comment_reference as desc,
16-
category | eval dest = query | search isutility = True | `detect_remote_access_software_usage_dns_filter`'
17-
how_to_implement: To implement this search, you must ingest logs that contain the DNS query and the source of the query. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the DNS logs. The logs must also be mapped to the `Network_Resolution` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. Once the analytic is tuned for your environment, modify the risk scores to be more appropriate.
18-
known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and legitimate remote access software is removed from it to not cause false positives.
16+
category | eval dest = query | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_dns_filter`'
17+
how_to_implement: To implement this search, you must ingest logs that contain the
18+
DNS query and the source of the query. These logs must be processed using the appropriate
19+
Splunk Technology Add-ons that are specific to the DNS logs. The logs must also
20+
be mapped to the `Network_Resolution` data model. Use the Splunk Common Information
21+
Model (CIM) to normalize the field names and speed up the data modeling process. The
22+
"exceptions" macro leverages both an Assets and Identities lookup,
23+
as well as a KVStore collection called "remote_software_exceptions" that lets
24+
you track and maintain device-based exceptions for this set of detections.
25+
known_false_positives: It is possible that legitimate remote access software is used
26+
within the environment. Ensure that the lookup is reviewed and updated with any
27+
additional remote access software that is used within the environment.
28+
Known false positives can be added to the remote_access_software_usage_exception.csv
29+
lookup to globally suppress these situations across all remote access content
1930
references:
2031
- https://attack.mitre.org/techniques/T1219/
2132
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
@@ -51,6 +62,7 @@ tags:
5162
- DNS.answer
5263
risk_score: 4
5364
security_domain: endpoint
65+
manual_test: This detection uses A&I lookups from Enterprise Security.
5466
tests:
5567
- name: True Positive Test
5668
attack_data:

‎detections/network/detect_remote_access_software_usage_traffic.yml

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Remote Access Software Usage Traffic
22
id: 885ea672-07ee-475a-879e-60d28aa5dd42
3-
version: 2
4-
date: '2024-05-29'
3+
version: 3
4+
date: '2024-07-09'
55
author: Steven Dick
66
status: production
77
type: Anomaly
@@ -20,14 +20,19 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
2020
datamodel=Network_Traffic by All_Traffic.src All_Traffic.dest, All_Traffic.app |
2121
`drop_dm_object_name("All_Traffic")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
2222
| lookup remote_access_software remote_appid AS app OUTPUT isutility, description
23-
as signature, comment_reference as desc, category | search isutility = True | `detect_remote_access_software_usage_traffic_filter`'
23+
as signature, comment_reference as desc, category | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_traffic_filter`'
2424
how_to_implement: The following analytic was developed with Palo Alto traffic logs.
2525
Ensure that the logs are being ingested into Splunk and mapped to the Network_Traffic
2626
data model. Use the Splunk Common Information Model (CIM) to normalize the field
27-
names and speed up the data modeling process.
27+
names and speed up the data modeling process. The "exceptions" macro leverages
28+
both an Assets and Identities lookup, as well as a KVStore collection called
29+
"remote_software_exceptions" that lets you track and maintain device-
30+
based exceptions for this set of detections.
2831
known_false_positives: It is possible that legitimate remote access software is used
2932
within the environment. Ensure that the lookup is reviewed and updated with any
3033
additional remote access software that is used within the environment.
34+
Known false positives can be added to the remote_access_software_usage_exception.csv
35+
lookup to globally suppress these situations across all remote access content
3136
references:
3237
- https://attack.mitre.org/techniques/T1219/
3338
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
@@ -63,6 +68,7 @@ tags:
6368
- user
6469
risk_score: 25
6570
security_domain: network
71+
manual_test: This detection uses A&I lookups from Enterprise Security.
6672
tests:
6773
- name: True Positive Test
6874
attack_data:

‎detections/web/detect_remote_access_software_usage_url.yml

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Remote Access Software Usage URL
22
id: 9296f515-073c-43a5-88ec-eda5a4626654
3-
version: 2
4-
date: '2024-05-09'
3+
version: 3
4+
date: '2024-07-09'
55
author: Steven Dick
66
status: production
77
type: Anomaly
@@ -20,15 +20,20 @@ search: '| tstats count min(_time) as firstTime max(_time) as lastTime latest(We
2020
Web.src Web.category Web.url_domain | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
2121
| `drop_dm_object_name("Web")` | lookup remote_access_software remote_domain AS
2222
url_domain OUTPUT isutility, description as signature, comment_reference as desc,
23-
category | search isutility = True | `detect_remote_access_software_usage_url_filter`'
23+
category | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_url_filter`'
2424
how_to_implement: The detection is based on data that originates from network logs.
2525
These logs must be processed using the appropriate Splunk Technology Add-ons that
2626
are specific to the network logs. The logs must also be mapped to the `Web` data
2727
model. Use the Splunk Common Information Model (CIM) to normalize the field names
28-
and speed up the data modeling process.
28+
and speed up the data modeling process. The "exceptions" macro leverages
29+
both an Assets and Identities lookup, as well as a KVStore collection called
30+
"remote_software_exceptions" that lets you track and maintain device-
31+
based exceptions for this set of detections.
2932
known_false_positives: It is possible that legitimate remote access software is used
3033
within the environment. Ensure that the lookup is reviewed and updated with any
31-
additional remote access software that is used within the environment.
34+
additional remote access software that is used within the environment.
35+
Known false positives can be added to the remote_access_software_usage_exception.csv
36+
lookup to globally suppress these situations across all remote access content
3237
references:
3338
- https://attack.mitre.org/techniques/T1219/
3439
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
@@ -70,6 +75,7 @@ tags:
7075
- Web.url_domain
7176
risk_score: 25
7277
security_domain: network
78+
manual_test: This detection uses A&I lookups from Enterprise Security.
7379
tests:
7480
- name: True Positive Test
7581
attack_data:

‎lookups/remote_access_software.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
description: A list of Remote Access Software
2-
filename: remote_access_software.csv
2+
filename: remote_access_software20240726.csv
33
name: remote_access_software
44
default_match: 'false'
55
match_type: WILDCARD(remote_utility),WILDCARD(remote_domain),WILDCARD(remote_utility_fileinfo)
66
min_matches: 1
77
max_matches: 1
8-
case_sensitive_match: 'false'
8+
case_sensitive_match: 'false'

‎lookups/remote_access_software.csv renamed to ‎lookups/remote_access_software20240726.csv

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
description,remote_domain,remote_utility,remote_utility_fileinfo,remote_appid,isutility,category,comment_reference,last_update
22
247ithelp.com (ConnectWise),*.247ithelp.com,Remote Workforce Client.exe,,,TRUE,RMM,Simlar / replaced by ScreenConnect,2/8/2024
3+
Absolute (Computrace),*search.namequery.com,rpcnet.exe,Absolute Software*,absolute-manage,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024
4+
Absolute (Computrace),*server.absolute.com,ctes.exe,Absolute Persistence*,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024
5+
Absolute (Computrace),,ctespersitence.exe,CTES*,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024
6+
Absolute (Computrace),,cteshostsvc.exe,,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024
7+
Absolute (Computrace),,rpcld.exe,,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024
38
Access Remote PC,,rpcgrab.exe,,,TRUE,RMM,,2/7/2024
49
Access Remote PC,,rpcsetup.exe,,,TRUE,RMM,,2/7/2024
510
Acronic Cyber Protect (Remotix),cloud.acronis.com,AcronisCyberProtectConnectQuickAssist*.exe,Acronis Cyber Protect Connect Quick Assist,remotix,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024
@@ -566,4 +571,4 @@ Zoho Assist,*.zohoassist.jp,ZMAgent.exe,,,TRUE,RMM,https://www.zoho.com/assist/k
566571
Zoho Assist,*.zohoassist.com.cn,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
567572
Zoho Assist,downloads.zohodl.com.cn,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
568573
Zoho Assist,downloads.zohocdn.com,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
569-
Zoho Assist,gateway.zohoassist.com,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
574+
Zoho Assist,gateway.zohoassist.com,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024

‎lookups/remote_access_software_exceptions.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
description: A list used to provide global exceptions to remote access monitoring content.
2+
collection: remote_access_software_exceptions
3+
name: remote_access_software_exceptions
4+
fields_list: _key, asset, software, exception_date, exception_ttl_days, exception, comment

‎macros/remote_access_software_usage_exceptions.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
definition: 'eval exception_asset = CASE(isnotnull(src),src,isnotnull(dest),dest)
2+
| lookup update=true asset_lookup_by_str asset as exception_asset OUTPUTNEW asset as asset_temp_field
3+
| eval asset_temp_field = CASE(isnull(asset_temp_field),exception_asset,true(),asset_temp_field )
4+
| lookup remote_access_software_exceptions asset as asset_temp_field software as signature OUTPUT exception as rmm_exception, exception_date as rmm_exception_date, exception_ttl_days as rmm_exception_ttl_days, comment as rmm_exception_comment
5+
| eval rmm_exception = mvdedup(mvfilter(NOT match(rmm_exception,"false"))), rmm_exception_date = mvdedup(mvfilter(NOT match(rmm_exception_date,"false"))), rmm_exception_ttl_days = mvdedup(mvfilter(NOT match(rmm_exception_ttl_days,"false"))), rmm_exception_comment = mvdedup(mvfilter(NOT match(rmm_exception_comment,"false"))), rmm_exception_end_date = relative_time(strptime(rmm_exception_date, "%Y-%m-%d"), "+"+rmm_exception_ttl_days+"d"), rmm_exception_end = CASE((now() >= rmm_exception_end_date),"TRUE",(now() < rmm_exception_end_date),"FALSE",(match(rmm_exception,"(?i)true") AND isnull(rmm_exception_ttl_days)),"UNLIMITED")
6+
| search NOT (rmm_exception = TRUE AND rmm_exception_end IN ("FALSE","UNLIMITED"))
7+
| fields - asset_temp_field,exception_asset'
8+
description: Macro used with remote access monitoring content to define exception lookup and usage. Returns filtered results based on contents of remote_access_software_usage_exception.csv
9+
name: remote_access_software_usage_exceptions

0 commit comments

Comments
 (0)