Skip to content

Commit d7b400d

Browse files
tccontretccontre
committed
headless_bee
1 parent db1e11a commit d7b400d

4 files changed

+273
-0
lines changed

‎detections/endpoint/windows_anonymous_pipe_activity.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: Windows Anonymous Pipe Activity
2+
id: ee301e1e-cd81-4011-a911-e5f049b9e3d5
3+
version: 1
4+
date: '2025-02-11'
5+
author: Teoderick Contreras, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects the creation or connection of anonymous pipes for inter-process communication (IPC) within a Windows environment. Anonymous pipes are commonly used by legitimate system processes, services, and applications to transfer data between related processes. However, adversaries frequently abuse anonymous pipes to facilitate stealthy process injection, command-and-control (C2) communication, credential theft, or privilege escalation. This detection monitors for unusual anonymous pipe activity, particularly involving non-system processes, unsigned executables, or unexpected parent-child process relationships. While legitimate use cases exist—such as Windows services, software installers, or security tools—unusual or high-frequency anonymous pipe activity should be investigated for potential malware, persistence mechanisms, or lateral movement techniques.
9+
data_source:
10+
- __UPDATE__ zero or more data_sources
11+
search: '`sysmon` EventCode IN (17,18) PipeName="*Anonymous Pipe*" NOT( Image IN ("*\\Program Files\\*"))
12+
| stats min(_time) as firstTime max(_time) as lastTime count by dest user EventCode PipeName signature Image process_id process_guid EventType
13+
| rename Image as process_name
14+
| `security_content_ctime(firstTime)`
15+
| `security_content_ctime(lastTime)`
16+
| `windows_anonymous_pipe_activity_filter`'
17+
how_to_implement: To successfully implement this search, you need to be ingesting
18+
logs with the process name and pipename from your endpoints. If you are using Sysmon,
19+
you must have at least version 6.0.4 of the Sysmon TA. .
20+
known_false_positives: Automation tool might use anonymous pipe for task orchestration or process communication.
21+
references:
22+
- https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html
23+
drilldown_searches:
24+
- name: View the detection results for - "$dest$"
25+
search: '%original_detection_search% | search dest = "$dest$"'
26+
earliest_offset: $info_min_time$
27+
latest_offset: $info_max_time$
28+
- name: View risk events for the last 7 days for - "$dest$"
29+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
30+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
31+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
32+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
33+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
34+
| `security_content_ctime(lastTime)`'
35+
earliest_offset: $info_min_time$
36+
latest_offset: $info_max_time$
37+
rba:
38+
message: An anonymous Pipe Channel activity on [$dest$].
39+
risk_objects:
40+
- field: dest
41+
type: system
42+
score: 30
43+
- field: user
44+
type: user
45+
tags:
46+
analytic_story:
47+
- SnappyBee
48+
- Nexus APT Threat Activity
49+
- Earth Estries
50+
asset_type: Endpoint
51+
mitre_attack_id:
52+
- T1559
53+
product:
54+
- Splunk Enterprise
55+
- Splunk Enterprise Security
56+
- Splunk Cloud
57+
security_domain: endpoint
58+
tests:
59+
- name: True Positive Test
60+
attack_data:
61+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1559/anonymous_pipe/anonymouspipe.log
62+
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
63+
source: XmlWinEventLog

‎detections/endpoint/windows_create_test_registry.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: Windows Create Test Registry
2+
id: 80402396-d78a-4c6e-ade5-7697ea670adf
3+
version: 1
4+
date: '2025-02-11'
5+
author: Teoderick Contreras, Splunk
6+
status: production
7+
type: TTP
8+
description: The following analytic detects modifications to the Windows registry under `SOFTWARE\Microsoft\Test`, a location rarely used by legitimate applications in a production environment. Monitoring this key is crucial, as adversaries may create or alter values here for persistence, privilege escalation, or system manipulation. The detection leverages **Sysmon Event ID 13** (Registry Value Set) to identify unauthorized changes. Analysts should investigate processes associated with these modifications, particularly unsigned executables or suspicious command-line activity, as they may indicate malware or unauthorized software behavior.
9+
data_source:
10+
- Sysmon EventID 13
11+
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
12+
WHERE Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Test\\*"
13+
BY Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.dest Registry.user
14+
| `drop_dm_object_name(Registry)`
15+
| `security_content_ctime(firstTime)`
16+
| `security_content_ctime(lastTime)`
17+
| `windows_create_test_registry_filter`'
18+
how_to_implement: To successfully implement this search you need to be ingesting information
19+
on process that include the name of the process responsible for the changes from
20+
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
21+
that this registry was included in your config files ex. sysmon config to be monitored.
22+
known_false_positives: Administrators and third party software may create this registry entry.
23+
references:
24+
- https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html
25+
drilldown_searches:
26+
- name: View the detection results for - "$dest$"
27+
search: '%original_detection_search% | search dest = "$dest$"'
28+
earliest_offset: $info_min_time$
29+
latest_offset: $info_max_time$
30+
- name: View risk events for the last 7 days for - "$dest$"
31+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
32+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
33+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
34+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
35+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
36+
| `security_content_ctime(lastTime)`'
37+
earliest_offset: $info_min_time$
38+
latest_offset: $info_max_time$
39+
rba:
40+
message: a Test registry Entry [$registry_path$] was created on [$dest$].
41+
risk_objects:
42+
- field: dest
43+
type: system
44+
score: 60
45+
- field: user
46+
type: user
47+
score: 60
48+
tags:
49+
analytic_story:
50+
- SnappyBee
51+
- Nexus APT Threat Activity
52+
- Earth Estries
53+
asset_type: Endpoint
54+
mitre_attack_id:
55+
- T1112
56+
product:
57+
- Splunk Enterprise
58+
- Splunk Enterprise Security
59+
- Splunk Cloud
60+
security_domain: endpoint
61+
tests:
62+
- name: True Positive Test
63+
attack_data:
64+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/test_registry/test_reg.log
65+
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
66+
source: XmlWinEventLog

‎detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: Windows Svchost.exe Parent Process Anomaly
2+
id: 1d38e5e9-2ff8-4c47-872c-bf1657cefab5
3+
version: 1
4+
date: '2025-02-11'
5+
author: Teoderick Contreras, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects an anomaly where a svchost.exe process is spawned by a parent process other than the standard services.exe. In a typical Windows environment, svchost.exe is a system process that hosts Windows services and is expected to be a child of services.exe. A process deviation from this hierarchy may indicate suspicious behavior, such as malicious code attempting to masquerade as a legitimate system process or evade detection. It is essential to investigate the parent process and associated behavior for further signs of compromise or unauthorized activity.
9+
data_source:
10+
- Sysmon EventID 1
11+
- Windows Event Log Security 4688
12+
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name != "services.exe" AND Processes.process_name = "svchost.exe" AND Processes.process != unknown
13+
by Processes.parent_process_name Processes.parent_process_path Processes.parent_process Processes.process_path Processes.process Processes.original_file_name Processes.dest Processes.user
14+
| `drop_dm_object_name(Processes)`
15+
| `security_content_ctime(firstTime)`
16+
| `security_content_ctime(lastTime)`
17+
| `windows_svchost_exe_parent_process_anomaly_filter`'
18+
how_to_implement: The detection is based on data that originates from Endpoint Detection
19+
and Response (EDR) agents. These agents are designed to provide security-related
20+
telemetry from the endpoints where the agent is installed. To implement this search,
21+
you must ingest logs that contain the process GUID, process name, and parent process.
22+
Additionally, you must ingest complete command-line executions. These logs must
23+
be processed using the appropriate Splunk Technology Add-ons that are specific to
24+
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
25+
data model. Use the Splunk Common Information Model (CIM) to normalize the field
26+
names and speed up the data modeling process.
27+
known_false_positives: Windows Update or other Windows Installer processes may launch their own svchost.exe processes that are not directly spawned by services.exe in certain edge cases (e.g., during patches or updates).
28+
references:
29+
- https://attack.mitre.org/techniques/T1036/009/
30+
- https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html
31+
drilldown_searches:
32+
- name: View the detection results for - "$dest$"
33+
search: '%original_detection_search% | search dest = "$dest$"'
34+
earliest_offset: $info_min_time$
35+
latest_offset: $info_max_time$
36+
- name: View risk events for the last 7 days for - "$dest$"
37+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
38+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
39+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
40+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
41+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
42+
| `security_content_ctime(lastTime)`'
43+
earliest_offset: $info_min_time$
44+
latest_offset: $info_max_time$
45+
rba:
46+
message: A svchost.exe process was spawned by an unexpected parent process [$parent_process_name$] instead of services.exe on [$dest$].
47+
risk_objects:
48+
- field: dest
49+
type: system
50+
score: 50
51+
- field: user
52+
type: user
53+
score: 50
54+
tags:
55+
analytic_story:
56+
- SnappyBee
57+
- Nexus APT Threat Activity
58+
- Earth Estries
59+
asset_type: Endpoint
60+
mitre_attack_id:
61+
- T1036.009
62+
product:
63+
- Splunk Enterprise
64+
- Splunk Enterprise Security
65+
- Splunk Cloud
66+
security_domain: endpoint
67+
tests:
68+
- name: True Positive Test
69+
attack_data:
70+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1035.009/suspicious_spawn_svchost/susp_svchost_proc.log
71+
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
72+
source: XmlWinEventLog

‎detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: Windows Unusual SysWOW64 Process Run System32 Executable
2+
id: e4602172-db86-4315-86df-da66fb40bcde
3+
version: 1
4+
date: '2025-02-11'
5+
author: Teoderick Contreras, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects an unusual process execution pattern where a process running from C:\Windows\SysWOW64\ attempts to execute a binary from C:\Windows\System32\. In a typical Windows environment, 32-bit processes under SysWOW64 should primarily interact with 32-bit binaries within the same directory. However, an execution flow where a 32-bit process spawns a 64-bit binary from System32 can indicate potential process injection, privilege escalation, evasion techniques, or unauthorized execution hijacking.
9+
data_source:
10+
- Sysmon EventID 1
11+
- Windows Event Log Security 4688
12+
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
13+
where Processes.process_path = "*\\Windows\\SysWOW64\\*" AND Processes.process = "*windows\\system32\\*"
14+
by Processes.parent_process_name Processes.process_path Processes.process Processes.original_file_name Processes.dest Processes.user
15+
| `drop_dm_object_name(Processes)`
16+
| `security_content_ctime(firstTime)`
17+
| `security_content_ctime(lastTime)`
18+
| `windows_unusual_syswow64_process_run_system32_executable_filter`'
19+
how_to_implement: The detection is based on data that originates from Endpoint Detection
20+
and Response (EDR) agents. These agents are designed to provide security-related
21+
telemetry from the endpoints where the agent is installed. To implement this search,
22+
you must ingest logs that contain the process GUID, process name, and parent process.
23+
Additionally, you must ingest complete command-line executions. These logs must
24+
be processed using the appropriate Splunk Technology Add-ons that are specific to
25+
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
26+
data model. Use the Splunk Common Information Model (CIM) to normalize the field
27+
names and speed up the data modeling process.
28+
known_false_positives: some legitimate system processes, software updaters, or compatibility tools may trigger this behavior, occurrences involving unknown, unsigned, or unusual parent processes should be investigated for potential malware activity, persistence mechanisms, or execution flow hijacking.
29+
references:
30+
- https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html
31+
drilldown_searches:
32+
- name: View the detection results for - "$dest$"
33+
search: '%original_detection_search% | search dest = "$dest$"'
34+
earliest_offset: $info_min_time$
35+
latest_offset: $info_max_time$
36+
- name: View risk events for the last 7 days for - "$dest$"
37+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
38+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
39+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
40+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
41+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
42+
| `security_content_ctime(lastTime)`'
43+
earliest_offset: $info_min_time$
44+
latest_offset: $info_max_time$
45+
rba:
46+
message: a 32 bit process execute 64 bit executable on [$dest$].
47+
risk_objects:
48+
- field: dest
49+
type: system
50+
score: 40
51+
- field: process_path
52+
type: process_name
53+
score: 40
54+
tags:
55+
analytic_story:
56+
- Nexus APT Threat Activity
57+
- DarkGate Malware
58+
- Earth Estries
59+
asset_type: Endpoint
60+
mitre_attack_id:
61+
- T1036.009
62+
product:
63+
- Splunk Enterprise
64+
- Splunk Enterprise Security
65+
- Splunk Cloud
66+
security_domain: endpoint
67+
tests:
68+
- name: True Positive Test
69+
attack_data:
70+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.009/32bit_process_execute_64bit/32bit_spawn_64bit.log
71+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
72+
sourcetype: XmlWinEventLog

0 commit comments

Comments
 (0)