Skip to content

Commit bc334de

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3283 from nterl0k/nterl0k-t1200-sysmon-usb-use-execution
Nterl0k - T1200 - Are you down with USB ?
2 parents e9a9b6a + 425daf1 commit bc334de

File tree

3 files changed

+215
-0
lines changed

3 files changed

+215
-0
lines changed

‎detections/endpoint/windows_process_executed_from_removable_media.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: Windows Process Executed From Removable Media
2+
id: b483804a-4cc0-49a4-9f00-ac29ba844d08
3+
version: 1
4+
date: '2025-01-17'
5+
author: Steven Dick
6+
status: production
7+
type: Anomaly
8+
description: This analytic is used to identify when a removable media device is attached to a machine and then a process is executed from the same drive letter assigned to the removable media device. Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration.
9+
data_source:
10+
- Windows Security Event ID 4688
11+
- Sysmon Event ID 1
12+
- Sysmon Event ID 12
13+
- Sysmon Event ID 13
14+
- CrowdStrike ProcessRollup2
15+
search: |-
16+
| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_current_directory=* AND NOT Processes.process_current_directory IN ("C:\\*","*\\sysvol\\*") by Processes.dest Processes.user Processes.process_name Processes.parent_process_name Processes.process_current_directory
17+
| `drop_dm_object_name(Processes)`
18+
| rex field=process_current_directory "^(?<object_handle>[^\\\]+\\\)"
19+
| where isnotnull(object_handle)
20+
| `security_content_ctime(firstTime)`
21+
| `security_content_ctime(lastTime)`
22+
| join dest,object_handle
23+
[| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_value_data="*:\\*" AND Registry.registry_path="*USBSTOR*" AND Registry.registry_path IN ("HKLM\\SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices\\*","HKLM\\System\\CurrentControlSet\\Enum\\SWD\\WPDBUSENUM\\*") by Registry.dest,Registry.registry_value_data,Registry.registry_path
24+
| `drop_dm_object_name(Registry)`
25+
| eval object_handle = registry_value_data, object_name = replace(mvindex(split(mvindex(split(registry_path, "??"),1),"&amp;"),2),"PROD_","")
26+
]
27+
| `windows_process_executed_from_removable_media_filter`
28+
how_to_implement: To successfully implement this search, you must ingest endpoint logging that tracks changes to the HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\ registry keys as well as Process Execution commands. Ensure that the field from the event logs is being mapped to the proper fields in the Endpoint.Registry data model. This analytic joins the Process and Registry datamodels together based on the drive letter extract to the "object_handle" field from both datasets.
29+
known_false_positives: Legitimate USB activity will also be detected. Please verify and investigate as appropriate.
30+
references:
31+
- https://attack.mitre.org/techniques/T1200/
32+
- https://www.cisa.gov/news-events/news/using-caution-usb-drives
33+
- https://www.bleepingcomputer.com/news/security/fbi-hackers-use-badusb-to-target-defense-firms-with-ransomware/
34+
drilldown_searches:
35+
- name: View the detection results for - "$dest$" and "$user$"
36+
search: '%original_detection_search% | search dest = "$dest$" and user= "$user$"'
37+
earliest_offset: $info_min_time$
38+
latest_offset: $info_max_time$
39+
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
40+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$" , "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
41+
earliest_offset: $info_min_time$
42+
latest_offset: $info_max_time$
43+
- name: Investigate USB events on $dest$
44+
search: '| from datamodel:Endpoint.Processes | search dest=$dest$ process_current_directory=$object_handle$*'
45+
earliest_offset: $info_min_time$
46+
latest_offset: $info_max_time$
47+
rba:
48+
message: The process [$process_name$] was launched using files on a removable storage device named [$object_name$] by [$user$] on $dest$
49+
risk_objects:
50+
- field: user
51+
type: user
52+
score: 35
53+
- field: dest
54+
type: system
55+
score: 35
56+
threat_objects:
57+
- field: process_name
58+
type: process_name
59+
- field: object_name
60+
type: registry_value_name
61+
- field: object_handle
62+
type: registry_value_text
63+
tags:
64+
analytic_story:
65+
- Data Protection
66+
asset_type: Endpoint
67+
mitre_attack_id:
68+
- T1200
69+
- T1025
70+
- T1091
71+
product:
72+
- Splunk Enterprise
73+
- Splunk Enterprise Security
74+
- Splunk Cloud
75+
security_domain: endpoint
76+
tests:
77+
- name: True Positive Test
78+
attack_data:
79+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1200/sysmon_usb_use_execution/sysmon_usb_use_execution.log
80+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
81+
sourcetype: XmlWinEventLog

‎detections/endpoint/windows_usbstor_registry_key_modification.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
name: Windows USBSTOR Registry Key Modification
2+
id: a345980a-417d-4ed3-9fb4-cac30c9405a0
3+
version: 1
4+
date: '2025-01-17'
5+
author: Steven Dick
6+
status: production
7+
type: Anomaly
8+
description: This analytic is used to identify when a USB removable media device is attached to a Windows host. In this scenario we are querying the Endpoint Registry data model to look for modifications to the HKLM\System\CurrentControlSet\Enum\USBSTOR\ key. Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration.
9+
data_source:
10+
- Sysmon Event ID 12
11+
- Sysmon Event ID 13
12+
search: |-
13+
| tstats `security_content_summariesonly` values(Registry.registry_value_data) as registry_value_data, values(Registry.registry_value_name) as registry_value_name, min(_time) as firstTime, max(_time) as lastTime, count from datamodel=Endpoint.Registry where Registry.registry_path IN ("HKLM\\System\\CurrentControlSet\\Enum\\USBSTOR\\*") AND Registry.registry_value_name ="FriendlyName" by Registry.dest,Registry.registry_value_data,Registry.registry_path
14+
| `drop_dm_object_name(Registry)`
15+
| eval object_name = registry_value_data, object_handle = split(mvindex(split(registry_path, "\\"),6),"&amp;"), object_handle = mvindex(mvfilter(NOT len(object_handle)=1),0)
16+
| `security_content_ctime(firstTime)`
17+
| `security_content_ctime(lastTime)`
18+
| `windows_usbstor_registry_key_modification_filter`
19+
how_to_implement: To successfully implement this search, you must ingest endpoint logging that tracks changes to the HKLM\System\CurrentControlSet\Enum\USBSTOR\ registry keys. Ensure that the field from the event logs is being mapped to the proper fields in the Endpoint.Registry data model.
20+
known_false_positives: Legitimate USB activity will also be detected. Please verify and investigate as appropriate.
21+
references:
22+
- https://attack.mitre.org/techniques/T1200/
23+
- https://www.cisa.gov/news-events/news/using-caution-usb-drives
24+
- https://www.bleepingcomputer.com/news/security/fbi-hackers-use-badusb-to-target-defense-firms-with-ransomware/
25+
drilldown_searches:
26+
- name: View the detection results for - "$dest$"
27+
search: '%original_detection_search% | search dest = "$dest$"'
28+
earliest_offset: $info_min_time$
29+
latest_offset: $info_max_time$
30+
- name: View risk events for the last 7 days for - "$dest$"
31+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
32+
earliest_offset: $info_min_time$
33+
latest_offset: $info_max_time$
34+
- name: Investigate USB events on $dest$
35+
search: '| from datamodel:Endpoint.Registry | search dest=$dest$ registry_path IN ("HKLM\\System\\CurrentControlSet\\Enum\\USBSTOR\\*")'
36+
earliest_offset: $info_min_time$
37+
latest_offset: $info_max_time$
38+
rba:
39+
message: A removable storage device named [$object_name$] with drive letter [$object_handle$] was attached to $dest$
40+
risk_objects:
41+
- field: dest
42+
type: system
43+
score: 10
44+
threat_objects:
45+
- field: object_name
46+
type: registry_value_name
47+
- field: object_handle
48+
type: registry_value_text
49+
tags:
50+
analytic_story:
51+
- Data Protection
52+
asset_type: Endpoint
53+
mitre_attack_id:
54+
- T1200
55+
- T1025
56+
- T1091
57+
product:
58+
- Splunk Enterprise
59+
- Splunk Enterprise Security
60+
- Splunk Cloud
61+
security_domain: endpoint
62+
tests:
63+
- name: True Positive Test
64+
attack_data:
65+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1200/sysmon_usb_use_execution/sysmon_usb_use_execution.log
66+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
67+
sourcetype: XmlWinEventLog

‎detections/endpoint/windows_wpdbusenum_registry_key_modification.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
name: Windows WPDBusEnum Registry Key Modification
2+
id: 52b48e8b-eb6e-48b0-b8f1-73273f6b134e
3+
version: 1
4+
date: '2025-01-17'
5+
author: Steven Dick
6+
status: production
7+
type: Anomaly
8+
description: This analytic is used to identify when a USB removable media device is attached to a Windows host. In this scenario we are querying the Endpoint Registry data model to look for modifications to the Windows Portable Device keys HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\ . Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration.
9+
data_source:
10+
- Sysmon Event ID 12
11+
- Sysmon Event ID 13
12+
search: |-
13+
| tstats `security_content_summariesonly` latest(Registry.registry_path) as registry_path, values(Registry.registry_value_name) as registry_value_name, min(_time) as firstTime, max(_time) as lastTime, count from datamodel=Endpoint.Registry where Registry.registry_path IN ("HKLM\\SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices\\*","HKLM\\System\\CurrentControlSet\\Enum\\SWD\\WPDBUSENUM\\*") AND Registry.registry_value_name ="FriendlyName" AND Registry.registry_path="*USBSTOR*" by Registry.dest,Registry.registry_value_data
14+
| `drop_dm_object_name(Registry)`
15+
| eval object_handle = registry_value_data, object_name = replace(mvindex(split(mvindex(split(registry_path, "??"),1),"&amp;"),2),"PROD_","")
16+
| `security_content_ctime(firstTime)`
17+
| `security_content_ctime(lastTime)`
18+
| `windows_wpdbusenum_registry_key_modification_filter`
19+
how_to_implement: To successfully implement this search, you must ingest endpoint logging that tracks changes to the HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\ registry keys. Ensure that the field from the event logs is being mapped to the proper fields in the Endpoint.Registry data model.
20+
known_false_positives: Legitimate USB activity will also be detected. Please verify and investigate as appropriate.
21+
references:
22+
- https://attack.mitre.org/techniques/T1200/
23+
- https://www.cisa.gov/news-events/news/using-caution-usb-drives
24+
- https://www.bleepingcomputer.com/news/security/fbi-hackers-use-badusb-to-target-defense-firms-with-ransomware/
25+
drilldown_searches:
26+
- name: View the detection results for - "$dest$"
27+
search: '%original_detection_search% | search dest = "$dest$"'
28+
earliest_offset: $info_min_time$
29+
latest_offset: $info_max_time$
30+
- name: View risk events for the last 7 days for - "$dest$"
31+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
32+
earliest_offset: $info_min_time$
33+
latest_offset: $info_max_time$
34+
- name: Investigate USB events on $dest$
35+
search: '| from datamodel:Endpoint.Registry | search dest=$dest$ registry_path IN ("HKLM\\SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices\\*","HKLM\\System\\CurrentControlSet\\Enum\\SWD\\WPDBUSENUM\\*")'
36+
earliest_offset: $info_min_time$
37+
latest_offset: $info_max_time$
38+
rba:
39+
message: A removable storage device named [$object_name$] with drive letter [$object_handle$] was attached to $dest$
40+
risk_objects:
41+
- field: dest
42+
type: system
43+
score: 10
44+
threat_objects:
45+
- field: object_name
46+
type: registry_value_name
47+
- field: object_handle
48+
type: registry_value_text
49+
tags:
50+
analytic_story:
51+
- Data Protection
52+
asset_type: Endpoint
53+
mitre_attack_id:
54+
- T1200
55+
- T1025
56+
- T1091
57+
product:
58+
- Splunk Enterprise
59+
- Splunk Enterprise Security
60+
- Splunk Cloud
61+
security_domain: endpoint
62+
tests:
63+
- name: True Positive Test
64+
attack_data:
65+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1200/sysmon_usb_use_execution/sysmon_usb_use_execution.log
66+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
67+
sourcetype: XmlWinEventLog

0 commit comments

Comments
 (0)