Skip to content

Commit 6300c3b

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3633 from splunk/3886
Detections for 3886
2 parents 6433b52 + 7d43731 commit 6300c3b

11 files changed

+357
-12
lines changed

‎detections/application/esxi_firewall_disabled.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: ESXi Firewall Disabled
22
id: e321804c-8eb5-42f2-a843-36b289a6c6b2
3-
version: 1
4-
date: '2025-05-12'
3+
version: 2
4+
date: '2025-08-06'
55
author: Raven Tait, Splunk
66
status: production
77
type: TTP
@@ -47,6 +47,7 @@ tags:
4747
analytic_story:
4848
- ESXi Post Compromise
4949
- Black Basta Ransomware
50+
- China-Nexus Threat Activity
5051
asset_type: Infrastructure
5152
mitre_attack_id:
5253
- T1562.004

‎detections/application/esxi_malicious_vib_forced_install.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: ESXi Malicious VIB Forced Install
22
id: 5d4d2cd2-7b65-4474-97cf-e9b203bcd770
3-
version: 1
4-
date: '2025-05-09'
3+
version: 2
4+
date: '2025-08-06'
55
author: Raven Tait, Splunk
66
status: production
77
type: TTP
@@ -54,6 +54,7 @@ tags:
5454
analytic_story:
5555
- ESXi Post Compromise
5656
- Black Basta Ransomware
57+
- China-Nexus Threat Activity
5758
asset_type: Infrastructure
5859
mitre_attack_id:
5960
- T1505.006

‎detections/application/esxi_sensitive_files_accessed.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: ESXi Sensitive Files Accessed
22
id: 6fa0073d-6ca0-4f93-913d-fb420c9de15b
3-
version: 1
4-
date: '2025-05-19'
3+
version: 2
4+
date: '2025-08-06'
55
author: Raven Tait, Splunk
66
status: production
77
type: TTP
@@ -50,6 +50,7 @@ tags:
5050
analytic_story:
5151
- ESXi Post Compromise
5252
- Black Basta Ransomware
53+
- China-Nexus Threat Activity
5354
asset_type: Infrastructure
5455
mitre_attack_id:
5556
- T1003.008

‎detections/application/esxi_vib_acceptance_level_tampering.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: ESXi VIB Acceptance Level Tampering
22
id: d051d94f-c792-445e-b5d2-0b904f93ac09
3-
version: 1
4-
date: '2025-05-15'
3+
version: 2
4+
date: '2025-08-06'
55
author: Raven Tait, Splunk
66
status: production
77
type: TTP
@@ -49,6 +49,7 @@ tags:
4949
analytic_story:
5050
- ESXi Post Compromise
5151
- Black Basta Ransomware
52+
- China-Nexus Threat Activity
5253
asset_type: Infrastructure
5354
mitre_attack_id:
5455
- T1562

‎detections/application/esxi_vm_discovery.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: ESXi VM Discovery
22
id: 5643cdc9-a0be-4123-860b-f13da0bf4fcb
3-
version: 1
4-
date: '2025-05-15'
3+
version: 2
4+
date: '2025-08-06'
55
author: Raven Tait, Splunk
66
status: production
77
type: TTP
@@ -49,6 +49,7 @@ tags:
4949
analytic_story:
5050
- ESXi Post Compromise
5151
- Black Basta Ransomware
52+
- China-Nexus Threat Activity
5253
asset_type: Infrastructure
5354
mitre_attack_id:
5455
- T1673

‎detections/endpoint/linux_gdrive_binary_activity.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: Linux Gdrive Binary Activity
2+
id: a42f8029-5472-4c33-8943-bb17bb07466a
3+
version: 1
4+
date: '2025-08-01'
5+
author: Raven Tait, Splunk
6+
status: production
7+
type: TTP
8+
description: The following analytic detects the execution of the 'gdrive' tool on a
9+
Linux host. This tool allows standard users to perform tasks associated with Google Drive
10+
via the command line. This is used by actors to stage tools as well as exfiltrate data.
11+
The detection leverages data from Endpoint Detection and Response
12+
(EDR) agents, focusing on process names and command-line executions. If confirmed malicious,
13+
this could lead to compromise of systems or sensitive data being stolen.
14+
data_source:
15+
- Sysmon for Linux EventID 1
16+
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
17+
as lastTime from datamodel=Endpoint.Processes where Processes.process_name="gdrive"
18+
Processes.process IN ("* download *", "* upload *", "* list*", "* update *",
19+
"* sync *", "* share *", "* account add*", "* drives *", "* files *") by Processes.action Processes.dest
20+
Processes.original_file_name Processes.parent_process Processes.parent_process_exec
21+
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
22+
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
23+
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
24+
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
25+
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
26+
| `linux_gdrive_binary_activity_filter`'
27+
how_to_implement: The detection is based on data that originates from Endpoint Detection
28+
and Response (EDR) agents. These agents are designed to provide security-related
29+
telemetry from the endpoints where the agent is installed. To implement this search,
30+
you must ingest logs that contain the process GUID, process name, and parent process.
31+
Additionally, you must ingest complete command-line executions. These logs must
32+
be processed using the appropriate Splunk Technology Add-ons that are specific to
33+
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
34+
data model. Use the Splunk Common Information Model (CIM) to normalize the field
35+
names and speed up the data modeling process.
36+
known_false_positives: Administrator or network operator can use this application
37+
for automation purposes. Please update the filter macros to remove false positives.
38+
references:
39+
- https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations
40+
drilldown_searches:
41+
- name: View the detection results for - "$dest$"
42+
search: '%original_detection_search% | search dest = "$dest$"'
43+
earliest_offset: $info_min_time$
44+
latest_offset: $info_max_time$
45+
- name: View risk events for the last 7 days for - "$dest$"
46+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
47+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
48+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
49+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
50+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
51+
| `security_content_ctime(lastTime)`'
52+
earliest_offset: $info_min_time$
53+
latest_offset: $info_max_time$
54+
rba:
55+
message: An instance of $process_name$ was identified
56+
attempting to interact with Google Drive on endpoint $dest$ by $user$.
57+
risk_objects:
58+
- field: dest
59+
type: system
60+
score: 49
61+
threat_objects: []
62+
tags:
63+
analytic_story:
64+
- China-Nexus Threat Activity
65+
asset_type: Endpoint
66+
mitre_attack_id:
67+
- T1567
68+
product:
69+
- Splunk Enterprise
70+
- Splunk Enterprise Security
71+
- Splunk Cloud
72+
security_domain: endpoint
73+
tests:
74+
- name: True Positive Test
75+
attack_data:
76+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567/gdrive/gdrive_linux.log
77+
sourcetype: sysmon:linux
78+
source: Syslog:Linux-Sysmon/Operational

‎detections/endpoint/linux_medusa_rootkit.yml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
name: Linux Medusa Rootkit
2+
id: 7add8520-71d5-43aa-b262-ee082b1f0238
3+
version: 1
4+
date: '2025-08-05'
5+
author: Raven Tait, Splunk
6+
status: production
7+
type: TTP
8+
description: This detection identifies file creation events associated with the installation of the Medusa
9+
rootkit, a userland LD_PRELOAD-based rootkit known for deploying shared objects, loader binaries, and
10+
configuration files into specific system directories. These files typically facilitate process hiding,
11+
credential theft, and backdoor access. Monitoring for such file creation patterns enables early
12+
detection of rootkit deployment before full compromise.
13+
data_source:
14+
- Sysmon for Linux EventID 11
15+
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
16+
as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/lib/libseconf",
17+
"*.backup_ld.so", "*.boot.sh", "*.logpam", "*sshpass.txt", "*sshpass2.txt", "*/lib/libdsx.so",
18+
"*rkload", "*/lib/libseconf/local.txt", "*/lib/locate/local.txt", "*/var/log/remote.txt",
19+
"*/lib/libseconf/.pts", "*/lib/locate /.pts", "*/libseconf/.ports")
20+
by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time
21+
Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path
22+
Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id
23+
Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` |
24+
`security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_medusa_rootkit_filter`'
25+
how_to_implement: The detection is based on data that originates from Endpoint Detection
26+
and Response (EDR) agents. These agents are designed to provide security-related
27+
telemetry from the endpoints where the agent is installed. To implement this search,
28+
you must ingest logs that contain the process GUID, process name, and parent process.
29+
Additionally, you must ingest complete command-line executions. These logs must
30+
be processed using the appropriate Splunk Technology Add-ons that are specific to
31+
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
32+
data model. Use the Splunk Common Information Model (CIM) to normalize the field
33+
names and speed up the data modeling process.
34+
known_false_positives: Little to no false positives in most environments. Tune as needed.
35+
references:
36+
- https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations
37+
drilldown_searches:
38+
- name: View the detection results for - "$dest$"
39+
search: '%original_detection_search% | search dest = "$dest$"'
40+
earliest_offset: $info_min_time$
41+
latest_offset: $info_max_time$
42+
- name: View risk events for the last 7 days for - "$dest$"
43+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
44+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
45+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
46+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
47+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
48+
| `security_content_ctime(lastTime)`'
49+
earliest_offset: $info_min_time$
50+
latest_offset: $info_max_time$
51+
rba:
52+
message: Medusa rootkit files were identified on endpoint $dest$.
53+
risk_objects:
54+
- field: dest
55+
type: system
56+
score: 62
57+
threat_objects: []
58+
tags:
59+
analytic_story:
60+
- China-Nexus Threat Activity
61+
- Medusa Rootkit
62+
asset_type: Endpoint
63+
mitre_attack_id:
64+
- T1014
65+
- T1589.001
66+
product:
67+
- Splunk Enterprise
68+
- Splunk Enterprise Security
69+
- Splunk Cloud
70+
security_domain: endpoint
71+
tests:
72+
- name: True Positive Test
73+
attack_data:
74+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1014/medusa_rootkit/sysmon_linux.log
75+
source: Syslog:Linux-Sysmon/Operational
76+
sourcetype: sysmon:linux

‎detections/endpoint/linux_service_file_created_in_systemd_directory.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Linux Service File Created In Systemd Directory
22
id: c7495048-61b6-11ec-9a37-acde48001122
3-
version: 7
4-
date: '2025-05-02'
3+
version: 8
4+
date: '2025-08-06'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
@@ -65,6 +65,7 @@ tags:
6565
- Linux Living Off The Land
6666
- Scheduled Tasks
6767
- Gomir
68+
- China-Nexus Threat Activity
6869
asset_type: Endpoint
6970
mitre_attack_id:
7071
- T1053.006

‎detections/endpoint/windows_gdrive_binary_activity.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: Windows Gdrive Binary Activity
2+
id: 9e7bd7c8-1c08-496e-9ffe-fd84ceb322e7
3+
version: 1
4+
date: '2025-08-01'
5+
author: Raven Tait, Splunk
6+
status: production
7+
type: TTP
8+
description: The following analytic detects the execution of the 'gdrive' tool on a
9+
Windows host. This tool allows standard users to perform tasks associated with Google Drive
10+
via the command line. This is used by actors to stage tools as well as exfiltrate data.
11+
The detection leverages data from Endpoint Detection and Response
12+
(EDR) agents, focusing on process names and command-line executions. If confirmed malicious,
13+
this could lead to compromise of systems or sensitive data being stolen.
14+
data_source:
15+
- Sysmon EventID 1
16+
- Windows Event Log Security 4688
17+
- CrowdStrike ProcessRollup2
18+
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
19+
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="gdrive.exe" OR
20+
Processes.original_file_name="*gdrive.exe") Processes.process IN ("* download *", "* upload *",
21+
"* list*", "* update *", "* sync *", "* share *", "* account add*", "* drives *", "* files *")
22+
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
23+
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
24+
Processes.parent_process_name Processes.parent_process_path Processes.process
25+
Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
26+
Processes.process_integrity_level Processes.process_name
27+
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
28+
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
29+
| `windows_gdrive_binary_activity_filter`'
30+
how_to_implement: The detection is based on data that originates from Endpoint Detection
31+
and Response (EDR) agents. These agents are designed to provide security-related
32+
telemetry from the endpoints where the agent is installed. To implement this search,
33+
you must ingest logs that contain the process GUID, process name, and parent process.
34+
Additionally, you must ingest complete command-line executions. These logs must
35+
be processed using the appropriate Splunk Technology Add-ons that are specific to
36+
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
37+
data model. Use the Splunk Common Information Model (CIM) to normalize the field
38+
names and speed up the data modeling process.
39+
known_false_positives: Administrator or network operator can use this application
40+
for automation purposes. Please update the filter macros to remove false positives.
41+
references:
42+
- https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations
43+
drilldown_searches:
44+
- name: View the detection results for - "$dest$"
45+
search: '%original_detection_search% | search dest = "$dest$"'
46+
earliest_offset: $info_min_time$
47+
latest_offset: $info_max_time$
48+
- name: View risk events for the last 7 days for - "$dest$"
49+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
50+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
51+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
52+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
53+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
54+
| `security_content_ctime(lastTime)`'
55+
earliest_offset: $info_min_time$
56+
latest_offset: $info_max_time$
57+
rba:
58+
message: An instance of $process_name$ was identified
59+
attempting to interact with Google Drive on endpoint $dest$ by $user$.
60+
risk_objects:
61+
- field: dest
62+
type: system
63+
score: 49
64+
threat_objects: []
65+
tags:
66+
analytic_story:
67+
- China-Nexus Threat Activity
68+
asset_type: Endpoint
69+
mitre_attack_id:
70+
- T1567
71+
product:
72+
- Splunk Enterprise
73+
- Splunk Enterprise Security
74+
- Splunk Cloud
75+
security_domain: endpoint
76+
tests:
77+
- name: True Positive Test
78+
attack_data:
79+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567/gdrive/gdrive_windows.log
80+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
81+
sourcetype: XmlWinEventLog

0 commit comments

Comments
 (0)