Skip to content

Commit 2c9573e

Browse files
pyth0n1cpyth0n1c
authored
Merge branch 'develop' into fix_bad_attack_data_paths
2 parents 422a769 + fe42046 commit 2c9573e

20 files changed

Lines changed: 499 additions & 102 deletions

detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml renamed to detections/deprecated/certutil_download_with_urlcache_and_split_arguments.yml

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
name: CertUtil Download With URLCache and Split Arguments
22
id: 415b4306-8bfb-11eb-85c4-acde48001122
3-
version: 12
4-
date: '2025-04-16'
3+
version: 13
4+
date: '2025-04-24'
55
author: Michael Haag, Splunk
6-
status: production
6+
status: deprecated
77
type: TTP
8-
description: The following analytic detects the use of certutil.exe to download files
8+
description: This analytic has been deprecated in favor of "Windows CertUtil Download".
9+
The following analytic detects the use of certutil.exe to download files
910
using the `-urlcache` and `-f` arguments. It leverages Endpoint Detection and Response
1011
(EDR) data, focusing on command-line executions that include these specific arguments.
1112
This activity is significant because certutil.exe is typically used for certificate

detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml renamed to detections/deprecated/certutil_download_with_verifyctl_and_split_arguments.yml

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
name: CertUtil Download With VerifyCtl and Split Arguments
22
id: 801ad9e4-8bfb-11eb-8b31-acde48001122
3-
version: 12
4-
date: '2025-04-16'
3+
version: 13
4+
date: '2025-04-24'
55
author: Michael Haag, Splunk
6-
status: production
6+
status: deprecated
77
type: TTP
8-
description: The following analytic detects the use of `certutil.exe` to download
8+
description: This analytic has been deprecated in favor of "Windows CertUtil Download".
9+
The following analytic detects the use of `certutil.exe` to download
910
files using the `-VerifyCtl` and `-f` arguments. This behavior is identified by
1011
monitoring command-line executions for these specific arguments via Endpoint Detection
1112
and Response (EDR) telemetry. This activity is significant because `certutil.exe`

detections/endpoint/windows_certutil_download_with_url_argument.yml renamed to detections/deprecated/windows_certutil_download_with_url_argument.yml

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
name: Windows CertUtil Download With URL Argument
22
id: 4fc5ca00-4c7c-46b3-8772-c98a4b8bd944
3-
version: 5
4-
date: '2025-04-16'
3+
version: 6
4+
date: '2025-04-24'
55
author: Nasreddine Bencherchali, Splunk
6-
status: production
6+
status: deprecated
77
type: TTP
8-
description: The following analytic detects the use of `certutil.exe` to download
8+
description: This analytic has been deprecated in favor of "Windows CertUtil Download".
9+
The following analytic detects the use of `certutil.exe` to download
910
files using the `-URL` arguments. This behavior is identified by monitoring command-line
1011
executions for these specific arguments via Endpoint Detection and Response (EDR)
1112
telemetry. This activity is significant because `certutil.exe` is a legitimate tool

detections/endpoint/windows_remote_access_software_hunt.yml renamed to detections/deprecated/windows_remote_access_software_hunt.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
name: Windows Remote Access Software Hunt
22
id: 8bd22c9f-05a2-4db1-b131-29271f28cb0a
3-
version: 7
4-
date: '2025-04-18'
3+
version: 8
4+
date: '2025-04-30'
55
author: Michael Haag, Splunk
6-
status: production
6+
status: deprecated
77
type: Hunting
8-
description: The following analytic identifies the use of remote access software within
8+
description: This search is deprecated in favor of the new detection - Detect Remote Access Software Usage Process. The following analytic identifies the use of remote access software within
99
the environment. It leverages data from Endpoint Detection and Response (EDR) agents,
1010
focusing on process execution logs. This detection is significant as unauthorized
1111
remote access tools can be used by adversaries to maintain persistent access to

‎detections/endpoint/chcp_command_execution.yml‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
11
name: CHCP Command Execution
22
id: 21d236ec-eec1-11eb-b23e-acde48001122
3-
version: 6
4-
date: '2025-02-19'
3+
version: 7
4+
date: '2025-04-24'
55
author: Teoderick Contreras, Splunk
66
status: production
7-
type: TTP
8-
description: The following analytic detects the execution of the chcp.exe application,
7+
type: Anomaly
8+
description: The following analytic detects the execution of the chcp.com utility,
99
which is used to change the active code page of the console. This detection leverages
1010
data from Endpoint Detection and Response (EDR) agents, focusing on process creation
11-
events where chcp.exe is executed by cmd.exe with specific command-line arguments.
12-
This activity is significant because it can indicate the presence of malware, such
11+
events. This activity is significant because it can indicate the presence of malware, such
1312
as IcedID, which uses this technique to determine the locale region, language, or
1413
country of the compromised host. If confirmed malicious, this could lead to further
1514
system compromise and data exfiltration.
@@ -18,7 +17,6 @@ data_source:
1817
- CrowdStrike ProcessRollup2
1918
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
2019
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com
21-
Processes.parent_process_name = cmd.exe (Processes.parent_process=*/c* OR Processes.parent_process=*/k*)
2220
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
2321
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
2422
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
@@ -35,8 +33,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D
3533
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
3634
data model. Use the Splunk Common Information Model (CIM) to normalize the field
3735
names and speed up the data modeling process.
38-
known_false_positives: other tools or script may used this to change code page to
39-
UTF-* or others
36+
known_false_positives: other tools or script may used this to change code page to UTF-* or others
4037
references:
4138
- https://ss64.com/nt/chcp.html
4239
- https://twitter.com/tccontre18/status/1419941156633329665?s=20

‎detections/endpoint/check_elevated_cmd_using_whoami.yml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,15 @@
11
name: Check Elevated CMD using whoami
22
id: a9079b18-1633-11ec-859c-acde48001122
3-
version: 6
4-
date: '2024-11-13'
3+
version: 7
4+
date: '2025-04-24'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: TTP
8-
description: The following analytic identifies the execution of the 'whoami' command
9-
with specific parameters to check for elevated privileges. It leverages data from
8+
description: The following analytic identifies the execution of the "whoami" command
9+
with the "/group" flag, where the results are passed to the "find" command in order
10+
to look for a the string "12288". This string represents the SID of the group
11+
"Mandatory Label\High Mandatory Level" effectively checking if the current process
12+
is running as a "High" integrity process or with Administrator privileges. It leverages data from
1013
Endpoint Detection and Response (EDR) agents, focusing on process and command-line
1114
telemetry. This activity is significant because it is commonly used by attackers,
1215
such as FIN7, to perform reconnaissance on a compromised host. If confirmed malicious,
@@ -35,7 +38,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D
3538
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
3639
data model. Use the Splunk Common Information Model (CIM) to normalize the field
3740
names and speed up the data modeling process.
38-
known_false_positives: unknown
41+
known_false_positives: The combination of these commands is unlikely to occur in a production environment. Any matches should be investigated.
3942
references: []
4043
drilldown_searches:
4144
- name: View the detection results for - "$dest$" and "$user$"

‎detections/endpoint/detect_remote_access_software_usage_process.yml‎

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,38 @@
11
name: Detect Remote Access Software Usage Process
22
id: ffd5e001-2e34-48f4-97a2-26dc4bb08178
3-
version: 8
4-
date: '2025-04-18'
5-
author: Steven Dick
3+
version: 9
4+
date: '2025-04-30'
5+
author: Steven Dick, Sebastian Wurl, Splunk Community
66
status: production
77
type: Anomaly
88
description: The following analytic detects the execution of known remote access software
99
within the environment. It leverages data from Endpoint Detection and Response (EDR)
1010
agents, focusing on process names and parent processes mapped to the Endpoint data
11-
model. This activity is significant as adversaries often use remote access tools
12-
like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access.
11+
model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access.
1312
If confirmed malicious, this could allow attackers to control systems remotely,
1413
exfiltrate data, or deploy additional malware, posing a severe threat to the organization's
1514
security.
1615
data_source:
1716
- Sysmon EventID 1
1817
- Windows Event Log Security 4688
1918
- CrowdStrike ProcessRollup2
20-
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
21-
as lastTime values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes
22-
where Processes.dest!=unknown Processes.process!=unknown by Processes.action Processes.dest
23-
Processes.original_file_name Processes.parent_process Processes.parent_process_exec
24-
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
25-
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
26-
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
27-
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
28-
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)`
29-
| lookup remote_access_software remote_utility AS process_name OUTPUT isutility,
30-
description as signature, comment_reference as desc, category | search isutility
31-
= True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_process_filter`'
19+
search: |
20+
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.parent_process) as parent_process
21+
from datamodel=Endpoint.Processes
22+
where
23+
[| inputlookup remote_access_software where isutility=TRUE
24+
| rename remote_utility AS Processes.process_name
25+
| fields Processes.process_name]
26+
AND Processes.dest!="unknown"
27+
AND Processes.user!="unknown"
28+
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
29+
| `security_content_ctime(firstTime)`
30+
| `security_content_ctime(lastTime)`
31+
| `drop_dm_object_name(Processes)`
32+
| lookup remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category
33+
| search isutility = TRUE
34+
| `remote_access_software_usage_exceptions`
35+
| `detect_remote_access_software_usage_process_filter`
3236
how_to_implement: The detection is based on data that originates from Endpoint Detection
3337
and Response (EDR) agents. These agents are designed to provide security-related
3438
telemetry from the endpoints where the agent is installed. To implement this search,
@@ -107,3 +111,6 @@ tests:
107111
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_sysmon.log
108112
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
109113
sourcetype: XmlWinEventLog
114+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/atomic_red_team/windows-sysmon.log
115+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
116+
sourcetype: XmlWinEventLog

‎detections/endpoint/detection_of_tools_built_by_nirsoft.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
name: Detection of tools built by NirSoft
22
id: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0
3-
version: 7
4-
date: '2024-11-13'
3+
version: 8
4+
date: '2025-04-24'
55
author: Bhavin Patel, Splunk
66
status: experimental
7-
type: TTP
7+
type: Anomaly
88
description: The following analytic identifies the execution of tools built by NirSoft
99
by detecting specific command-line arguments such as "/stext" and "/scomma". It
1010
leverages data from Endpoint Detection and Response (EDR) agents, focusing on process
@@ -37,10 +37,10 @@ how_to_implement: The detection is based on data that originates from Endpoint D
3737
data model. Use the Splunk Common Information Model (CIM) to normalize the field
3838
names and speed up the data modeling process.
3939
known_false_positives: While legitimate, these NirSoft tools are prone to abuse. You
40-
should verfiy that the tool was used for a legitimate purpose.
40+
should verify that the tool was used for a legitimate purpose.
4141
references: []
4242
rba:
43-
message: NirSoft tools detected on $dest$
43+
message: NirSoft tool detected on $dest$
4444
risk_objects:
4545
- field: user
4646
type: user

‎detections/endpoint/suspicious_wevtutil_usage.yml‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Suspicious wevtutil Usage
22
id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f
3-
version: 12
4-
date: '2025-04-16'
3+
version: 13
4+
date: '2025-04-24'
55
author: David Dorsey, Michael Haag, Teoderick Contreras, Splunk
66
status: production
77
type: TTP
@@ -19,9 +19,7 @@ data_source:
1919
- CrowdStrike ProcessRollup2
2020
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
2121
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
22-
where Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*",
23-
"* -cl *") Processes.process IN ("*System*", "*Security*", "*Setup*", "*Application*",
24-
"*trace*", "*powershell*") by Processes.action Processes.dest Processes.original_file_name
22+
where Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*") Processes.process IN ("*System*", "*Security*", "*Setup*", "*Application*", "*trace*", "*powershell*", "Sysmon") by Processes.action Processes.dest Processes.original_file_name
2523
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
2624
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
2725
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash

‎detections/endpoint/system_processes_run_from_unexpected_locations.yml‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
name: System Processes Run From Unexpected Locations
22
id: a34aae96-ccf8-4aef-952c-3ea21444444d
3-
version: 11
4-
date: '2025-02-10'
5-
author: David Dorsey, Michael Haag, Splunk
3+
version: 12
4+
date: '2025-04-24'
5+
author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk
66
status: production
77
type: Anomaly
88
description: The following analytic identifies system processes running from unexpected
9-
locations outside `C:\Windows\System32\` or `C:\Windows\SysWOW64`. It leverages
9+
locations outside of paths such as `C:\Windows\System32\` or `C:\Windows\SysWOW64`. It leverages
1010
data from Endpoint Detection and Response (EDR) agents, focusing on process paths,
1111
names, and hashes. This activity is significant as it may indicate a malicious process
1212
attempting to masquerade as a legitimate system process. If confirmed malicious,
@@ -17,15 +17,17 @@ data_source:
1717
- Windows Event Log Security 4688
1818
- CrowdStrike ProcessRollup2
1919
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
20-
as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*"
21-
Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.action Processes.dest
20+
as lastTime FROM datamodel=Endpoint.Processes where NOT Processes.process_path IN ("C:\\$WINDOWS.~BT\\*", "C:\\$WinREAgent\\*", "C:\\Windows\\SoftwareDistribution\\*", "C:\\Windows\\System32\\*", "C:\\Windows\\SystemTemp\\*", "C:\\Windows\\SysWOW64\\*", "C:\\Windows\\uus\\*", "C:\\Windows\\WinSxS\\*") by Processes.action Processes.dest
2221
Processes.original_file_name Processes.parent_process Processes.parent_process_exec
2322
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
2423
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
2524
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
2625
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
27-
| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
28-
`is_windows_system_file_macro` | `system_processes_run_from_unexpected_locations_filter`'
26+
| `drop_dm_object_name("Processes")`
27+
| `security_content_ctime(firstTime)`
28+
| `security_content_ctime(lastTime)`
29+
| `is_windows_system_file_macro`
30+
| `system_processes_run_from_unexpected_locations_filter`'
2931
how_to_implement: The detection is based on data that originates from Endpoint Detection
3032
and Response (EDR) agents. These agents are designed to provide security-related
3133
telemetry from the endpoints where the agent is installed. To implement this search,

0 commit comments

Comments
 (0)