Skip to content

Commit 6065615

Browse files
pyth0n1cpyth0n1c
authored
Merge branch 'develop' into updates-june
2 parents 437b5cf + 669fedc commit 6065615

File tree

37 files changed

+811
-374
lines changed

37 files changed

+811
-374
lines changed

‎detections/endpoint/cmd_carry_out_string_command_parameter.yml‎

Lines changed: 26 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: CMD Carry Out String Command Parameter
22
id: 54a6ed00-3256-11ec-b031-acde48001122
3-
version: 11
4-
date: '2025-05-06'
3+
version: 12
4+
date: '2025-05-26'
55
author: Teoderick Contreras, Bhavin Patel, Splunk
66
status: production
77
type: Hunting
@@ -17,14 +17,14 @@ data_source:
1717
- Windows Event Log Security 4688
1818
- CrowdStrike ProcessRollup2
1919
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
20-
as lastTime from datamodel=Endpoint.Processes where `process_cmd` AND Processes.process IN ("*/c*", "*/k*")
21-
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
22-
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
23-
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
24-
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
25-
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
26-
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
27-
| `cmd_carry_out_string_command_parameter_filter`'
20+
as lastTime from datamodel=Endpoint.Processes where `process_cmd` AND Processes.process
21+
IN ("*/c*", "*/k*") by Processes.action Processes.dest Processes.original_file_name
22+
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
23+
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
24+
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
25+
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
26+
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
27+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmd_carry_out_string_command_parameter_filter`'
2828
how_to_implement: The detection is based on data that originates from Endpoint Detection
2929
and Response (EDR) agents. These agents are designed to provide security-related
3030
telemetry from the endpoints where the agent is installed. To implement this search,
@@ -41,27 +41,28 @@ references:
4141
- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
4242
tags:
4343
analytic_story:
44-
- Data Destruction
45-
- DarkGate Malware
46-
- Chaos Ransomware
47-
- Hermetic Wiper
48-
- Warzone RAT
44+
- PlugX
4945
- Winter Vivern
46+
- Rhysida Ransomware
47+
- Malicious Inno Setup Loader
48+
- DarkGate Malware
5049
- ProxyNotShell
51-
- IcedID
52-
- Living Off The Land
53-
- NjRAT
5450
- Log4Shell CVE-2021-44228
55-
- CISA AA23-347A
56-
- AsyncRAT
57-
- Rhysida Ransomware
58-
- DarkCrystal RAT
59-
- Crypto Stealer
6051
- Azorult
52+
- Living Off The Land
6153
- Qakbot
62-
- RedLine Stealer
63-
- PlugX
54+
- Chaos Ransomware
55+
- IcedID
56+
- Data Destruction
57+
- Crypto Stealer
6458
- WhisperGate
59+
- NjRAT
60+
- AsyncRAT
61+
- CISA AA23-347A
62+
- Hermetic Wiper
63+
- RedLine Stealer
64+
- DarkCrystal RAT
65+
- Warzone RAT
6566
asset_type: Endpoint
6667
cve:
6768
- CVE-2021-44228

‎detections/endpoint/cobalt_strike_named_pipes.yml‎

Lines changed: 28 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Cobalt Strike Named Pipes
22
id: 5876d429-0240-4709-8b93-ea8330b411b5
3-
version: 8
4-
date: '2025-05-02'
3+
version: 9
4+
date: '2025-06-17'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -16,12 +16,33 @@ description: The following analytic detects the use of default or publicly known
1616
data_source:
1717
- Sysmon EventID 17
1818
- Sysmon EventID 18
19-
search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\DserNamePipe*,
20-
\\srvsvc_*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*,
21-
\\winsock*, \\UIA_PIPE*) | stats count min(_time) as firstTime max(_time) as lastTime
19+
search: |
20+
`sysmon` (EventID=17 OR EventID=18)
21+
PipeName IN (
22+
"\\DserNamePipe*",
23+
"\\interprocess_*",
24+
"\\lsarpc_*",
25+
"\\mojo_*",
26+
"\\msagent_*",
27+
"\\MSSE-*",
28+
"\\netlogon_*",
29+
"\\ntsvcs*",
30+
"\\postex_*",
31+
"\\samr_*",
32+
"\\spoolss_*",
33+
"\\srvsvc_*",
34+
"\\status_*",
35+
"\\UIA_PIPE"*
36+
"\\win_svc*",
37+
"\\winsock*",
38+
"\\wkssvc_*",
39+
)
40+
| stats count min(_time) as firstTime max(_time) as lastTime
2241
by dest dvc pipe_name process_exec process_guid process_id process_name process_path
23-
signature signature_id user_id vendor_product Image PipeName | `security_content_ctime(firstTime)`
24-
| `security_content_ctime(lastTime)` | `cobalt_strike_named_pipes_filter`'
42+
signature signature_id user_id vendor_product Image PipeName
43+
| `security_content_ctime(firstTime)`
44+
| `security_content_ctime(lastTime)`
45+
| `cobalt_strike_named_pipes_filter`
2546
how_to_implement: To successfully implement this search, you need to be ingesting
2647
logs with the process name, parent process, and command-line executions from your
2748
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

‎detections/endpoint/detect_renamed_7_zip.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Renamed 7-Zip
22
id: 4057291a-b8cf-11eb-95fe-acde48001122
3-
version: 9
4-
date: '2025-05-02'
3+
version: 10
4+
date: '2025-06-02'
55
author: Michael Haag, Splunk
66
status: production
77
type: Hunting
@@ -43,6 +43,7 @@ references:
4343
tags:
4444
analytic_story:
4545
- Collection and Staging
46+
- Malicious Inno Setup Loader
4647
asset_type: Endpoint
4748
mitre_attack_id:
4849
- T1560.001

‎detections/endpoint/detect_renamed_winrar.yml‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Renamed WinRAR
22
id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122
3-
version: 12
4-
date: '2025-05-02'
3+
version: 13
4+
date: '2025-06-16'
55
author: Michael Haag, Splunk
66
status: production
77
type: Hunting
@@ -18,13 +18,15 @@ data_source:
1818
- CrowdStrike ProcessRollup2
1919
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
2020
as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=WinRAR.exe
21-
(Processes.process_name!=rar.exe OR Processes.process_name!=winrar.exe) by Processes.action
22-
Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
23-
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
24-
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
25-
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
26-
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
27-
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
21+
(Processes.process_name!=rar.exe AND Processes.process_name!=winrar.exe)
22+
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
23+
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
24+
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
25+
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
26+
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
27+
| `drop_dm_object_name(Processes)`
28+
| `security_content_ctime(firstTime)`
29+
| `security_content_ctime(lastTime)`
2830
| `detect_renamed_winrar_filter`'
2931
how_to_implement: The detection is based on data that originates from Endpoint Detection
3032
and Response (EDR) agents. These agents are designed to provide security-related

‎detections/endpoint/excessive_usage_of_cacls_app.yml‎

Lines changed: 43 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,56 @@
11
name: Excessive Usage Of Cacls App
22
id: 0bdf6092-af17-11eb-939a-acde48001122
3-
version: 8
4-
date: '2025-05-02'
3+
version: 9
4+
date: '2025-06-17'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
8-
description: The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe`,
9-
or `icacls.exe` to change file or folder permissions. It leverages data from Endpoint
10-
Detection and Response (EDR) agents, focusing on process names and command-line
11-
executions. This activity is significant as it may indicate an adversary attempting
12-
to restrict access to malware components or artifacts on a compromised system. If
13-
confirmed malicious, this behavior could prevent users from deleting or accessing
8+
description: |
9+
The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe`,
10+
or `icacls.exe` to change file or folder permissions.
11+
It looks for 10 or more execution of the aforementioned processes in the span of 1 minute.
12+
It leverages data from Endpoint Detection and Response (EDR) agents,
13+
focusing on process names and command-line executions.
14+
This activity is significant as it may indicate an adversary attempting
15+
to restrict access to malware components or artifacts on a compromised system.
16+
If confirmed malicious, this behavior could prevent users from deleting or accessing
1417
critical files, aiding in the persistence and concealment of malicious activities.
1518
data_source:
1619
- Sysmon EventID 1
1720
- Windows Event Log Security 4688
1821
- CrowdStrike ProcessRollup2
19-
search: '| tstats `security_content_summariesonly` values(Processes.dest) as dest
20-
values(Processes.user) as user min(_time) as firstTime max(_time) as lastTime values(Processes.action)
21-
as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process_exec)
22-
as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid
23-
values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path)
24-
as parent_process_path values(Processes.process) as process values(Processes.process_exec)
25-
as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash)
26-
as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level)
27-
as process_integrity_level values(Processes.process_name) as process_name values(Processes.process_path)
28-
as process_path values(Processes.user_id) as user_id values(Processes.vendor_product)
29-
as vendor_product count from datamodel=Endpoint.Processes where Processes.process_name
30-
= "cacls.exe" OR Processes.process_name = "icacls.exe" OR Processes.process_name
31-
= "XCACLS.exe" by Processes.parent_process_name Processes.parent_process Processes.dest
32-
Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)`
33-
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_cacls_app_filter`'
34-
how_to_implement: The detection is based on data that originates from Endpoint Detection
22+
search: |
23+
| tstats `security_content_summariesonly`
24+
min(_time) as firstTime
25+
max(_time) as lastTime
26+
values(Processes.dest) as dest
27+
values(Processes.user) as user
28+
values(Processes.action) as action
29+
values(Processes.original_file_name) as original_file_name
30+
values(Processes.parent_process_exec) as parent_process_exec
31+
values(Processes.parent_process_guid) as parent_process_guid
32+
values(Processes.parent_process_id) as parent_process_id
33+
values(Processes.parent_process_path) as parent_process_path
34+
values(Processes.process) as process
35+
values(Processes.process_exec) as process_exec
36+
values(Processes.process_guid) as process_guid
37+
values(Processes.process_hash) as process_hash
38+
values(Processes.process_id) as process_id
39+
values(Processes.process_integrity_level) as process_integrity_level
40+
values(Processes.process_name) as process_name
41+
values(Processes.process_path) as process_path
42+
values(Processes.user_id) as user_id
43+
values(Processes.vendor_product) as vendor_product count
44+
from datamodel=Endpoint.Processes where
45+
Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe")
46+
by Processes.parent_process_name Processes.parent_process Processes.dest Processes.user _time span=1m
47+
| where count >=10
48+
| `drop_dm_object_name(Processes)`
49+
| `security_content_ctime(firstTime)`
50+
| `security_content_ctime(lastTime)`
51+
| `excessive_usage_of_cacls_app_filter`
52+
how_to_implement: |
53+
The detection is based on data that originates from Endpoint Detection
3554
and Response (EDR) agents. These agents are designed to provide security-related
3655
telemetry from the endpoints where the agent is installed. To implement this search,
3756
you must ingest logs that contain the process GUID, process name, and parent process.

‎detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Hiding Files And Directories With Attrib exe
22
id: 6e5a3ae4-90a3-462d-9aa6-0119f638c0f1
3-
version: 12
4-
date: '2025-05-02'
3+
version: 13
4+
date: '2025-05-26'
55
author: Bhavin Patel, Splunk
66
status: production
77
type: TTP
@@ -64,8 +64,9 @@ rba:
6464
threat_objects: []
6565
tags:
6666
analytic_story:
67-
- Azorult
6867
- Windows Persistence Techniques
68+
- Malicious Inno Setup Loader
69+
- Azorult
6970
- Compromised Windows Host
7071
- Windows Defense Evasion Tactics
7172
- Crypto Stealer

‎detections/endpoint/icacls_deny_command.yml‎

Lines changed: 21 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
name: Icacls Deny Command
22
id: cf8d753e-a8fe-11eb-8f58-acde48001122
3-
version: 8
4-
date: '2025-05-02'
3+
version: 9
4+
date: '2025-06-17'
55
author: Teoderick Contreras, Splunk
66
status: production
7-
type: TTP
8-
description: The following analytic detects instances where an adversary modifies
7+
type: Anomaly
8+
description: |
9+
The following analytic detects instances where an adversary modifies
910
security permissions of a file or directory using commands like "icacls.exe", "cacls.exe",
1011
or "xcacls.exe" with deny options. It leverages data from Endpoint Detection and
1112
Response (EDR) agents, focusing on process names and command-line executions. This
@@ -17,17 +18,22 @@ data_source:
1718
- Sysmon EventID 1
1819
- Windows Event Log Security 4688
1920
- CrowdStrike ProcessRollup2
20-
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
21-
as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe",
22-
"cacls.exe", "xcacls.exe") AND Processes.process IN ("*/deny*", "*/D*") by Processes.action
23-
Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
24-
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
25-
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
26-
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
27-
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
28-
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
29-
| `icacls_deny_command_filter`'
30-
how_to_implement: The detection is based on data that originates from Endpoint Detection
21+
search: |
22+
| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
23+
as lastTime from datamodel=Endpoint.Processes where
24+
Processes.process_name IN ( "icacls.exe", "cacls.exe", "xcacls.exe") AND
25+
Processes.process IN ("*/deny*", "*/d:*", "*/d ")
26+
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
27+
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
28+
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
29+
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
30+
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
31+
| `drop_dm_object_name(Processes)`
32+
| `security_content_ctime(firstTime)`
33+
| `security_content_ctime(lastTime)`
34+
| `icacls_deny_command_filter`
35+
how_to_implement: |
36+
The detection is based on data that originates from Endpoint Detection
3137
and Response (EDR) agents. These agents are designed to provide security-related
3238
telemetry from the endpoints where the agent is installed. To implement this search,
3339
you must ingest logs that contain the process GUID, process name, and parent process.

‎detections/endpoint/icacls_grant_command.yml‎

Lines changed: 20 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
name: ICACLS Grant Command
22
id: b1b1e316-accc-11eb-a9b4-acde48001122
3-
version: 7
4-
date: '2025-05-02'
3+
version: 8
4+
date: '2025-06-17'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
8-
description: The following analytic detects the use of the ICACLS command to grant
8+
description: |
9+
The following analytic detects the use of the ICACLS command to grant
910
additional access permissions to files or directories. It leverages data from Endpoint
1011
Detection and Response (EDR) agents, focusing on specific process names and command-line
1112
arguments. This activity is significant because it is commonly used by Advanced
@@ -17,17 +18,22 @@ data_source:
1718
- Sysmon EventID 1
1819
- Windows Event Log Security 4688
1920
- CrowdStrike ProcessRollup2
20-
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
21-
as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe",
22-
"cacls.exe", "xcacls.exe") AND Processes.process IN ("*/grant*", "*/G*") by Processes.action
23-
Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
24-
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
25-
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
26-
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
27-
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
28-
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
29-
| `icacls_grant_command_filter`'
30-
how_to_implement: The detection is based on data that originates from Endpoint Detection
21+
search: |
22+
| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
23+
as lastTime from datamodel=Endpoint.Processes where
24+
Processes.process_name IN ( "icacls.exe", "cacls.exe", "xcacls.exe") AND
25+
Processes.process IN ("*/grant*", "*/g:*", "*/g *")
26+
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
27+
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
28+
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
29+
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
30+
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
31+
| `drop_dm_object_name(Processes)`
32+
| `security_content_ctime(firstTime)`
33+
| `security_content_ctime(lastTime)`
34+
| `icacls_grant_command_filter`
35+
how_to_implement: |
36+
The detection is based on data that originates from Endpoint Detection
3137
and Response (EDR) agents. These agents are designed to provide security-related
3238
telemetry from the endpoints where the agent is installed. To implement this search,
3339
you must ingest logs that contain the process GUID, process name, and parent process.

0 commit comments

Comments
 (0)