Skip to content

Commit 56c4d19

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3291 from splunk/analytics_enhancement
analytics_enhancement
2 parents 9dc252d + 0468dff commit 56c4d19

14 files changed

+404
-36
lines changed

‎detections/endpoint/known_services_killed_by_ransomware.yml‎ renamed to ‎detections/deprecated/known_services_killed_by_ransomware.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
name: Known Services Killed by Ransomware
22
id: 3070f8e0-c528-11eb-b2a0-acde48001122
3-
version: 7
4-
date: '2024-12-10'
3+
version: 8
4+
date: '2025-02-07'
55
author: Teoderick Contreras, Splunk
6-
status: production
6+
status: deprecated
77
type: TTP
8-
description: The following analytic detects the suspicious termination of known services
8+
description: This analytic has been deprecated in favor of a new analytic - Windows Security And Backup Services Stop. The following analytic detects the suspicious termination of known services
99
commonly targeted by ransomware before file encryption. It leverages Windows System
1010
Event Logs (EventCode 7036) to identify when critical services such as Volume Shadow
1111
Copy, backup, and antivirus services are stopped. This activity is significant because
@@ -75,4 +75,4 @@ tests:
7575
- data:
7676
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/known_services_killed_by_ransomware/windows-xml.log
7777
source: XmlWinEventLog:System
78-
sourcetype: XmlWinEventLog
78+
sourcetype: XmlWinEventLog

‎detections/endpoint/suspicious_driver_loaded_path.yml‎ renamed to ‎detections/deprecated/suspicious_driver_loaded_path.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
name: Suspicious Driver Loaded Path
22
id: f880acd4-a8f1-11eb-a53b-acde48001122
3-
version: 4
4-
date: '2024-11-13'
3+
version: 6
4+
date: '2025-02-06'
55
author: Teoderick Contreras, Splunk
6-
status: production
6+
status: deprecated
77
type: TTP
8-
description: The following analytic detects the loading of drivers from suspicious
8+
description: This search has been deprecated in favour of - Windows Suspicious Driver Loaded Path. The following analytic detects the loading of drivers from suspicious
99
paths, which is a technique often used by malicious software such as coin miners
1010
(e.g., xmrig). It leverages Sysmon EventCode 6 to identify drivers loaded from non-standard
1111
directories. This activity is significant because legitimate drivers typically reside

‎detections/endpoint/suspicious_process_file_path.yml‎ renamed to ‎detections/deprecated/suspicious_process_file_path.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
name: Suspicious Process File Path
22
id: 9be25988-ad82-11eb-a14f-acde48001122
3-
version: 6
4-
date: '2024-12-10'
3+
version: 7
4+
date: '2025-02-10'
55
author: Teoderick Contreras, Splunk
6-
status: production
6+
status: deprecated
77
type: TTP
8-
description: The following analytic identifies processes running from file paths not
8+
description: This search has been deprecated in favour of - Windows Suspicious Process File Path. The following analytic identifies processes running from file paths not
99
typically associated with legitimate software. It leverages data from Endpoint Detection
1010
and Response (EDR) agents, focusing on specific process paths within the Endpoint
1111
data model. This activity is significant because adversaries often use unconventional
@@ -117,4 +117,4 @@ tests:
117117
- data:
118118
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
119119
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
120-
sourcetype: XmlWinEventLog
120+
sourcetype: XmlWinEventLog

‎detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
name: Linux Auditd File Permissions Modification Via Chattr
22
id: f2d1110d-b01c-4a58-9975-90a9edeb083a
3-
version: 3
4-
date: '2025-01-16'
3+
version: 4
4+
date: '2025-02-03'
55
author: Teoderick Contreras, Splunk
66
status: production
7-
type: TTP
7+
type: Anomaly
88
description: The following analytic detects suspicious file permissions modifications using the chattr command, which may indicate an attacker attempting to manipulate file attributes to evade detection or prevent alteration. The chattr command can be used to make files immutable or restrict deletion, which can be leveraged to protect malicious files or disrupt system operations. By monitoring for unusual or unauthorized chattr usage, this analytic helps identify potential tampering with critical files, enabling security teams to quickly respond to and mitigate threats associated with unauthorized file attribute changes.
99
data_source:
1010
- Linux Auditd Execve
@@ -28,7 +28,7 @@ rba:
2828
risk_objects:
2929
- field: dest
3030
type: system
31-
score: 49
31+
score: 30
3232
threat_objects: []
3333
tags:
3434
analytic_story:

‎detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
name: Linux Auditd Find Credentials From Password Managers
22
id: 784241aa-85a5-4782-a503-d071bd3446f9
3-
version: 3
4-
date: '2025-01-16'
3+
version: 4
4+
date: '2025-02-03'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: TTP
88
description: The following analytic detects suspicious attempts to find credentials stored in password managers, which may indicate an attacker's effort to retrieve sensitive login information. Password managers are often targeted by adversaries seeking to access stored passwords for further compromise or lateral movement within a network. By monitoring for unusual or unauthorized access to password manager files or processes, this analytic helps identify potential credential theft attempts, enabling security teams to respond quickly to protect critical accounts and prevent further unauthorized access.
99
data_source:
1010
- Linux Auditd Execve
11-
search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.kdbx%") OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, "%KeePass\.enforced%") OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR LIKE (process_exec, "%.agilekeychain%")OR LIKE (process_exec, "%.dashlane%")OR LIKE (process_exec, "%.rfx%")OR LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, "%.spdb%")OR LIKE (process_exec, "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR LIKE (process_exec, "%enpass%")OR LIKE (process_exec, "%vault%")OR LIKE (process_exec, "%.kdb%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_managers_filter`'
11+
search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.kdbx%") OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, "%.enforced%") OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR LIKE (process_exec, "%.agilekeychain%")OR LIKE (process_exec, "%.dashlane%")OR LIKE (process_exec, "%.rfx%")OR LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, "%.spdb%")OR LIKE (process_exec, "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR LIKE (process_exec, "%enpass%")OR LIKE (process_exec, "%vault%")OR LIKE (process_exec, "%.kdb%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_managers_filter`'
1212
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
1313
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
1414
references:

‎detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
name: Linux Auditd Hidden Files And Directories Creation
22
id: 555cc358-bf16-4e05-9b3a-0f89c73b7261
3-
version: 4
4-
date: '2025-01-16'
3+
version: 5
4+
date: '2025-02-03'
55
author: Teoderick Contreras, Splunk
66
status: production
7-
type: TTP
7+
type: Anomaly
88
description: The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. Hidden files and directories are often used to evade detection by security tools and administrators, providing a stealthy means for storing malware, logs, or sensitive information. By monitoring for unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively.
99
data_source:
1010
- Linux Auditd Execve
@@ -28,7 +28,7 @@ rba:
2828
risk_objects:
2929
- field: dest
3030
type: system
31-
score: 64
31+
score: 30
3232
threat_objects: []
3333
tags:
3434
analytic_story:

‎detections/endpoint/linux_auditd_service_started.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
name: Linux Auditd Service Started
22
id: b5eed06d-5c97-4092-a3a1-fa4b7e77c71a
3-
version: 3
4-
date: '2024-11-13'
3+
version: 4
4+
date: '2025-02-03'
55
author: Teoderick Contreras, Splunk
66
status: production
7-
type: TTP
7+
type: Anomaly
88
description: The following analytic detects the suspicious service started. This behavior
99
is critical for a SOC to monitor because it may indicate attempts to gain unauthorized
1010
access or maintain control over a system. Such actions could be signs of malicious
@@ -53,7 +53,7 @@ rba:
5353
risk_objects:
5454
- field: dest
5555
type: system
56-
score: 64
56+
score: 40
5757
threat_objects: []
5858
tags:
5959
analytic_story:

‎detections/endpoint/permission_modification_using_takeown_app.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
name: Permission Modification using Takeown App
22
id: fa7ca5c6-c9d8-11eb-bce9-acde48001122
3-
version: 4
4-
date: '2024-11-13'
3+
version: 5
4+
date: '2025-01-27'
55
author: Teoderick Contreras, Splunk
66
status: production
7-
type: TTP
7+
type: Anomaly
88
description: The following analytic detects the modification of file or directory
99
permissions using the takeown.exe Windows application. It leverages data from Endpoint
1010
Detection and Response (EDR) agents, focusing on process execution logs that include
@@ -56,7 +56,7 @@ rba:
5656
risk_objects:
5757
- field: dest
5858
type: system
59-
score: 56
59+
score: 30
6060
threat_objects:
6161
- field: process_name
6262
type: process_name

‎detections/endpoint/windows_driver_load_non_standard_path.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows Driver Load Non-Standard Path
22
id: 9216ef3d-066a-4958-8f27-c84589465e62
3-
version: 5
4-
date: '2024-11-13'
3+
version: 6
4+
date: '2025-01-27'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -17,7 +17,7 @@ data_source:
1717
- Windows Event Log System 7045
1818
search: >-
1919
`wineventlog_system` EventCode=7045 ServiceType="kernel mode driver"
20-
| regex ImagePath!="(?i)^(\w:\\\\Windows\\\\|\w:\\\\Program\sFile|\\\\systemroot\\\\|%SystemRoot%|system32\\\\)"
20+
| regex ImagePath!="(?i)^(\w:\\\\Windows\\\\|\w:\\\\Program\sFile|\\\\systemroot\\\\|%SystemRoot%|system32\\\\|\\\\ProgramData\\\\Microsoft\\\\Windows\sDefender\\\\Definition\sUpdates\\\\)"
2121
| stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode
2222
ImagePath ServiceName ServiceType | rename Computer as dest | `security_content_ctime(firstTime)` |
2323
`security_content_ctime(lastTime)` | `windows_driver_load_non_standard_path_filter`

‎detections/endpoint/windows_process_execution_in_temp_dir.yml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: Windows Process Execution in Temp Dir
2+
id: f6fbe929-4187-4ba4-901e-8a34be838443
3+
version: 1
4+
date: '2025-01-27'
5+
author: Teoderick Contreras, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic identifies processes running from %temp% directory file paths.
9+
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process paths within the Endpoint
10+
data model. This activity is significant because adversaries often use unconventional file paths to execute malicious code without requiring administrative privileges. If confirmed malicious, this behavior could indicate an attempt to bypass security controls, leading to unauthorized software execution, potential system compromise, and further malicious activities within the environment.
11+
data_source:
12+
- Sysmon EventID 1
13+
- Windows Event Log Security 4688
14+
- CrowdStrike ProcessRollup2
15+
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
16+
where Processes.process_path IN("*\\temp\\*")
17+
by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user
18+
| `drop_dm_object_name(Processes)`
19+
| `security_content_ctime(firstTime)`
20+
| `security_content_ctime(lastTime)`
21+
| `windows_process_execution_in_temp_dir_filter`'
22+
how_to_implement: The detection is based on data that originates from Endpoint Detection
23+
and Response (EDR) agents. These agents are designed to provide security-related
24+
telemetry from the endpoints where the agent is installed. To implement this search,
25+
you must ingest logs that contain the process GUID, process name, and parent process.
26+
Additionally, you must ingest complete command-line executions. These logs must
27+
be processed using the appropriate Splunk Technology Add-ons that are specific to
28+
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
29+
data model. Use the Splunk Common Information Model (CIM) to normalize the field
30+
names and speed up the data modeling process.
31+
known_false_positives: Administrators may allow execution of specific binaries in
32+
non-standard paths. Filter as needed.
33+
references:
34+
- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/
35+
- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
36+
- https://twitter.com/pr0xylife/status/1590394227758104576
37+
- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
38+
- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
39+
drilldown_searches:
40+
- name: View the detection results for - "$dest$"
41+
search: '%original_detection_search% | search dest = "$dest$"'
42+
earliest_offset: $info_min_time$
43+
latest_offset: $info_max_time$
44+
- name: View risk events for the last 7 days for - "$dest$"
45+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
46+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
47+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
48+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
49+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
50+
| `security_content_ctime(lastTime)`'
51+
earliest_offset: $info_min_time$
52+
latest_offset: $info_max_time$
53+
rba:
54+
message: Suspicious process $process_name$ running from temp directory-
55+
$process_path$ on host- $dest$
56+
risk_objects:
57+
- field: dest
58+
type: system
59+
score: 30
60+
threat_objects:
61+
- field: process_path
62+
type: process_name
63+
tags:
64+
analytic_story:
65+
- Ryuk Ransomware
66+
- Trickbot
67+
- Qakbot
68+
- AgentTesla
69+
- Remcos
70+
- NjRAT
71+
- Ransomware
72+
asset_type: Endpoint
73+
mitre_attack_id:
74+
- T1543
75+
- T1036
76+
- T1036.005
77+
product:
78+
- Splunk Enterprise
79+
- Splunk Enterprise Security
80+
- Splunk Cloud
81+
security_domain: endpoint
82+
tests:
83+
- name: True Positive Test
84+
attack_data:
85+
- data:
86+
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/process_temp_path/process_temp_path.log
87+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
88+
sourcetype: XmlWinEventLog

0 commit comments

Comments
 (0)