Skip to content

Commit 669fedc

Browse files
pyth0n1cpyth0n1c
authored
Merge pull request #3537 from splunk/innoloader
innoloader
2 parents 799b276 + 5ccd548 commit 669fedc

27 files changed

+597
-243
lines changed

‎detections/endpoint/cmd_carry_out_string_command_parameter.yml‎

Lines changed: 26 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: CMD Carry Out String Command Parameter
22
id: 54a6ed00-3256-11ec-b031-acde48001122
3-
version: 11
4-
date: '2025-05-06'
3+
version: 12
4+
date: '2025-05-26'
55
author: Teoderick Contreras, Bhavin Patel, Splunk
66
status: production
77
type: Hunting
@@ -17,14 +17,14 @@ data_source:
1717
- Windows Event Log Security 4688
1818
- CrowdStrike ProcessRollup2
1919
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
20-
as lastTime from datamodel=Endpoint.Processes where `process_cmd` AND Processes.process IN ("*/c*", "*/k*")
21-
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
22-
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
23-
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
24-
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
25-
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
26-
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
27-
| `cmd_carry_out_string_command_parameter_filter`'
20+
as lastTime from datamodel=Endpoint.Processes where `process_cmd` AND Processes.process
21+
IN ("*/c*", "*/k*") by Processes.action Processes.dest Processes.original_file_name
22+
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
23+
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
24+
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
25+
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
26+
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
27+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmd_carry_out_string_command_parameter_filter`'
2828
how_to_implement: The detection is based on data that originates from Endpoint Detection
2929
and Response (EDR) agents. These agents are designed to provide security-related
3030
telemetry from the endpoints where the agent is installed. To implement this search,
@@ -41,27 +41,28 @@ references:
4141
- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
4242
tags:
4343
analytic_story:
44-
- Data Destruction
45-
- DarkGate Malware
46-
- Chaos Ransomware
47-
- Hermetic Wiper
48-
- Warzone RAT
44+
- PlugX
4945
- Winter Vivern
46+
- Rhysida Ransomware
47+
- Malicious Inno Setup Loader
48+
- DarkGate Malware
5049
- ProxyNotShell
51-
- IcedID
52-
- Living Off The Land
53-
- NjRAT
5450
- Log4Shell CVE-2021-44228
55-
- CISA AA23-347A
56-
- AsyncRAT
57-
- Rhysida Ransomware
58-
- DarkCrystal RAT
59-
- Crypto Stealer
6051
- Azorult
52+
- Living Off The Land
6153
- Qakbot
62-
- RedLine Stealer
63-
- PlugX
54+
- Chaos Ransomware
55+
- IcedID
56+
- Data Destruction
57+
- Crypto Stealer
6458
- WhisperGate
59+
- NjRAT
60+
- AsyncRAT
61+
- CISA AA23-347A
62+
- Hermetic Wiper
63+
- RedLine Stealer
64+
- DarkCrystal RAT
65+
- Warzone RAT
6566
asset_type: Endpoint
6667
cve:
6768
- CVE-2021-44228

‎detections/endpoint/detect_renamed_7_zip.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Renamed 7-Zip
22
id: 4057291a-b8cf-11eb-95fe-acde48001122
3-
version: 9
4-
date: '2025-05-02'
3+
version: 10
4+
date: '2025-06-02'
55
author: Michael Haag, Splunk
66
status: production
77
type: Hunting
@@ -43,6 +43,7 @@ references:
4343
tags:
4444
analytic_story:
4545
- Collection and Staging
46+
- Malicious Inno Setup Loader
4647
asset_type: Endpoint
4748
mitre_attack_id:
4849
- T1560.001

‎detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Hiding Files And Directories With Attrib exe
22
id: 6e5a3ae4-90a3-462d-9aa6-0119f638c0f1
3-
version: 12
4-
date: '2025-05-02'
3+
version: 13
4+
date: '2025-05-26'
55
author: Bhavin Patel, Splunk
66
status: production
77
type: TTP
@@ -64,8 +64,9 @@ rba:
6464
threat_objects: []
6565
tags:
6666
analytic_story:
67-
- Azorult
6867
- Windows Persistence Techniques
68+
- Malicious Inno Setup Loader
69+
- Azorult
6970
- Compromised Windows Host
7071
- Windows Defense Evasion Tactics
7172
- Crypto Stealer

‎detections/endpoint/lolbas_with_network_traffic.yml‎

Lines changed: 42 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,11 @@
11
name: LOLBAS With Network Traffic
22
id: 2820f032-19eb-497e-8642-25b04a880359
3-
version: 10
4-
date: '2025-05-19'
3+
version: 11
4+
date: '2025-05-26'
55
author: Steven Dick
66
status: production
77
type: TTP
8-
description:
9-
The following analytic identifies the use of Living Off the Land Binaries
8+
description: The following analytic identifies the use of Living Off the Land Binaries
109
and Scripts (LOLBAS) with network traffic. It leverages data from the Network Traffic
1110
data model to detect when native Windows binaries, often abused by adversaries,
1211
initiate network connections. This activity is significant as LOLBAS are frequently
@@ -15,9 +14,8 @@ description:
1514
to execute arbitrary code, escalate privileges, or maintain persistence within the
1615
environment, posing a severe threat to organizational security.
1716
data_source:
18-
- Sysmon EventID 3
19-
search:
20-
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
17+
- Sysmon EventID 3
18+
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
2119
as lastTime from datamodel=Network_Traffic.All_Traffic where (All_Traffic.app IN
2220
("*Regsvcs.exe", "*\\Ftp.exe", "*OfflineScannerShell.exe", "*Rasautou.exe", "*Schtasks.exe",
2321
"*Xwizard.exe", "*Pnputil.exe", "*Atbroker.exe", "*Pcwrun.exe", "*Ttdinject.exe",
@@ -36,61 +34,59 @@ search:
3634
All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product
3735
| `drop_dm_object_name(All_Traffic)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
3836
| rex field=app ".*\\\(?<process_name>.*)$" | `lolbas_with_network_traffic_filter`'
39-
how_to_implement:
40-
To successfully implement this detection you must ingest events
37+
how_to_implement: To successfully implement this detection you must ingest events
4138
into the Network traffic data model that contain the source, destination, and communicating
4239
process in the app field. Relevant processes must also be ingested in the Endpoint
4340
data model with matching process_id field. Sysmon EID1 and EID3 are good examples
4441
of this type this data type.
45-
known_false_positives:
46-
Legitimate usage of internal automation or scripting, especially
42+
known_false_positives: Legitimate usage of internal automation or scripting, especially
4743
powershell.exe or pwsh.exe, internal to internal or logon scripts. It may be necessary
4844
to omit internal IP ranges if extremely noisy. ie NOT dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","170.98.0.0/16","0:0:0:0:0:0:0:1")
4945
references:
50-
- https://lolbas-project.github.io/#
51-
- https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/
46+
- https://lolbas-project.github.io/#
47+
- https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/
5248
drilldown_searches:
53-
- name: View the detection results for - "$src$"
54-
search: '%original_detection_search% | search src = "$src$"'
55-
earliest_offset: $info_min_time$
56-
latest_offset: $info_max_time$
57-
- name: View risk events for the last 7 days for - "$src$"
58-
search:
59-
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$")
60-
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
61-
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
62-
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
63-
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
64-
| `security_content_ctime(lastTime)`'
65-
earliest_offset: $info_min_time$
66-
latest_offset: $info_max_time$
49+
- name: View the detection results for - "$src$"
50+
search: '%original_detection_search% | search src = "$src$"'
51+
earliest_offset: $info_min_time$
52+
latest_offset: $info_max_time$
53+
- name: View risk events for the last 7 days for - "$src$"
54+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$")
55+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
56+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
57+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
58+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
59+
| `security_content_ctime(lastTime)`'
60+
earliest_offset: $info_min_time$
61+
latest_offset: $info_max_time$
6762
rba:
6863
message: The LOLBAS $process_name$ on device $src$ was seen communicating with $dest$.
6964
risk_objects:
70-
- field: src
71-
type: system
72-
score: 25
65+
- field: src
66+
type: system
67+
score: 25
7368
threat_objects:
74-
- field: dest_ip
75-
type: ip_address
69+
- field: dest_ip
70+
type: ip_address
7671
tags:
7772
analytic_story:
78-
- Living Off The Land
79-
- Water Gamayun
80-
- Fake CAPTCHA Campaigns
73+
- Fake CAPTCHA Campaigns
74+
- Living Off The Land
75+
- Malicious Inno Setup Loader
76+
- Water Gamayun
8177
asset_type: Endpoint
8278
mitre_attack_id:
83-
- T1105
84-
- T1567
85-
- T1218
79+
- T1105
80+
- T1567
81+
- T1218
8682
product:
87-
- Splunk Enterprise
88-
- Splunk Enterprise Security
89-
- Splunk Cloud
83+
- Splunk Enterprise
84+
- Splunk Enterprise Security
85+
- Splunk Cloud
9086
security_domain: network
9187
tests:
92-
- name: True Positive Test
93-
attack_data:
94-
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log
95-
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
96-
sourcetype: XmlWinEventLog
88+
- name: True Positive Test
89+
attack_data:
90+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log
91+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
92+
sourcetype: XmlWinEventLog

‎detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Non Chrome Process Accessing Chrome Default Dir
22
id: 81263de4-160a-11ec-944f-acde48001122
3-
version: 10
4-
date: '2025-05-02'
3+
version: 11
4+
date: '2025-05-25'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
@@ -15,10 +15,11 @@ description: The following analytic detects a non-Chrome process accessing files
1515
and further compromise of the affected system.
1616
data_source:
1717
- Windows Event Log Security 4663
18-
search: '`wineventlog_security` EventCode=4663 NOT (ProcessName IN ("*\\chrome.exe",
19-
"*\\explorer.exe", "*sql*")) ObjectName="*\\Google\\Chrome\\User Data\\Default*"
20-
| stats count min(_time) as firstTime max(_time) as lastTime by ObjectName ObjectType
21-
ProcessName AccessMask EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
18+
search: '`wineventlog_security` EventCode=4663
19+
NOT (ProcessName IN ("*\\chrome.exe", "*\\explorer.exe", "*sql*", "*\\dllhost.exe")) ObjectName="*\\Google\\Chrome\\User Data\\Default*"
20+
| stats count min(_time) as firstTime max(_time) as lastTime by ObjectName ObjectType ProcessName AccessMask EventCode dest
21+
| `security_content_ctime(firstTime)`
22+
| `security_content_ctime(lastTime)`
2223
| `non_chrome_process_accessing_chrome_default_dir_filter`'
2324
how_to_implement: To successfully implement this search, you must ingest Windows Security
2425
Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
@@ -63,6 +64,7 @@ tags:
6364
- 3CX Supply Chain Attack
6465
- DarkGate Malware
6566
- NjRAT
67+
- Malicious Inno Setup Loader
6668
asset_type: Endpoint
6769
mitre_attack_id:
6870
- T1555.003

‎detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Non Firefox Process Access Firefox Profile Dir
22
id: e6fc13b0-1609-11ec-b533-acde48001122
3-
version: 9
4-
date: '2025-05-02'
3+
version: '10'
4+
date: '2025-05-26'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
@@ -48,21 +48,22 @@ rba:
4848
threat_objects: []
4949
tags:
5050
analytic_story:
51-
- AgentTesla
51+
- NjRAT
5252
- Snake Keylogger
53-
- CISA AA23-347A
53+
- AgentTesla
54+
- DarkGate Malware
5455
- China-Nexus Threat Activity
55-
- Remcos
56-
- FIN7
56+
- 3CX Supply Chain Attack
57+
- Malicious Inno Setup Loader
58+
- CISA AA23-347A
5759
- Phemedrone Stealer
58-
- SnappyBee
5960
- Azorult
61+
- Remcos
6062
- RedLine Stealer
61-
- Warzone RAT
6263
- Salt Typhoon
63-
- 3CX Supply Chain Attack
64-
- DarkGate Malware
65-
- NjRAT
64+
- Warzone RAT
65+
- SnappyBee
66+
- FIN7
6667
asset_type: Endpoint
6768
mitre_attack_id:
6869
- T1555.003

‎detections/endpoint/recon_using_wmi_class.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Recon Using WMI Class
22
id: 018c1972-ca07-11eb-9473-acde48001122
3-
version: 7
4-
date: '2025-05-02'
3+
version: '8'
4+
date: '2025-05-26'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
@@ -65,12 +65,13 @@ rba:
6565
tags:
6666
analytic_story:
6767
- AsyncRAT
68-
- Qakbot
69-
- Industroyer2
70-
- Hermetic Wiper
7168
- LockBit Ransomware
7269
- Malicious PowerShell
70+
- Malicious Inno Setup Loader
71+
- Hermetic Wiper
7372
- Data Destruction
73+
- Qakbot
74+
- Industroyer2
7475
- MoonPeak
7576
asset_type: Endpoint
7677
mitre_attack_id:

‎detections/endpoint/suspicious_scheduled_task_from_public_directory.yml‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Suspicious Scheduled Task from Public Directory
22
id: 7feb7972-7ac3-11eb-bac8-acde48001122
3-
version: '12'
4-
date: '2025-05-06'
3+
version: '13'
4+
date: '2025-05-26'
55
author: Michael Haag, Splunk
66
status: production
77
type: Anomaly
@@ -69,21 +69,22 @@ rba:
6969
threat_objects: []
7070
tags:
7171
analytic_story:
72-
- CISA AA24-241A
73-
- CISA AA23-347A
74-
- Medusa Ransomware
72+
- DarkCrystal RAT
7573
- China-Nexus Threat Activity
76-
- Scheduled Tasks
7774
- Windows Persistence Techniques
78-
- Living Off The Land
7975
- Ryuk Ransomware
76+
- Medusa Ransomware
77+
- Malicious Inno Setup Loader
78+
- CISA AA23-347A
79+
- Azorult
80+
- Living Off The Land
81+
- Crypto Stealer
8082
- Salt Typhoon
83+
- XWorm
84+
- CISA AA24-241A
85+
- Scheduled Tasks
8186
- Ransomware
82-
- DarkCrystal RAT
83-
- Azorult
8487
- MoonPeak
85-
- XWorm
86-
- Crypto Stealer
8788
asset_type: Endpoint
8889
mitre_attack_id:
8990
- T1053.005

0 commit comments

Comments
 (0)