Merge pull request #2783 from splunk/warzone_rat2

warzone_rat2

detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml

@@ -0,0 +1,76 @@
+name: Windows Bypass UAC via Pkgmgr Tool
+id: cce58e2c-988a-4319-9390-0daa9eefa3cd
+version: 1
+date: '2023-07-26'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Sysmon Event ID 1
+description: The following analytic identifies a potentially suspicious execution of the 'pkgmgr' process involving the use of an XML input file for package management.
+  The 'pkgmgr' process, though deprecated in modern Windows systems, was historically used for managing packages. The presence of an XML input file raises concerns about the nature of the executed command and its potential impact on the system.
+  Due to the deprecated status of 'pkgmgr' and the involvement of an XML file, this activity warrants careful investigation. XML files are commonly used for configuration and data exchange, making it crucial to ascertain the intentions and legitimacy of the command.
+  To ensure system security, it is recommended to use up-to-date package management utilities, such as DISM or PowerShell's PackageManagement module, and exercise caution when executing commands involving potentially sensitive operations or files.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where  Processes.process_name = pkgmgr.exe Processes.process = "*.xml*" NOT(Processes.parent_process_path IN("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "*:\\Program Files*"))
+  by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_bypass_uac_via_pkgmgr_tool_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives may be present on recent Windows Operating
+  Systems. Filtering may be required based on process_name. In addition, look for
+  non-standard, unsigned, module loads into LSASS. If query is too noisy, modify by
+  adding Endpoint.processes process_name to query to identify the process making the
+  modification.
+references:
+- https://asec.ahnlab.com/en/17692/
+- https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/warzone#:~:text=Warzone%20RAT%20(AKA%20Ave%20Maria)%20is%20a%20remote%20access%20trojan,is%20as%20an%20information%20stealer.
+tags:
+  analytic_story:
+  - Warzone RAT
+  asset_type: Endpoint
+  confidence: 30
+  impact: 30
+  message: A pkgmgr.exe executed with package manager xml input file on $dest$
+  mitre_attack_id:
+  - T1548.002
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 9
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/warzone_rat/pkgmgr_uac_bypass/pkgmgr_create_file.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_mark_of_the_web_bypass.yml

@@ -0,0 +1,62 @@
+name: Windows Mark Of The Web Bypass
+id: 8ca13343-7405-4916-a2d1-ae34ce0c28ae
+version: 1
+date: '2023-08-14'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon Event ID 23
+description: The following analytic identifies a suspicious process that delete mark-of-the-web data stream. 
+  This technique has been observed in various instances of malware and adversarial activities aimed at circumventing 
+  security restrictions within the Windows Operating System, particularly pertaining to files downloaded from the internet. 
+  An example of this scenario is demonstrated by Ave Maria RAT, which attempts to delete this data stream as a means to evade such restrictions.
+search: '`sysmon` EventCode=23 TargetFilename = "*:Zone.Identifier" 
+  | stats  min(_time) as firstTime max(_time) as lastTime count by user EventCode Image TargetFilename ProcessID Computer | rename Computer as dest
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_mark_of_the_web_bypass_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting logs with the deleted target file name, 
+  process name and process id  from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: unknown
+references:
+- https://attack.mitre.org/techniques/T1553/005/
+- https://github.com/nmantani/PS-MOTW#remove-motwps1
+tags:
+  analytic_story:
+  - Warzone RAT
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: A mark-of-the-web data stream is deleted on $dest$
+  mitre_attack_id:
+  - T1553.005
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 49
+  required_fields:
+  - EventCode
+  - TargetFilename
+  - Computer
+  - user
+  - Image
+  - ProcessID
+  - _time
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.005/mark_of_the_web_bypass/possible-motw-deletion.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_modify_registry_maxconnectionperserver.yml

@@ -0,0 +1,65 @@
+name: Windows Modify Registry MaxConnectionPerServer
+id: 064cd09f-1ff4-4823-97e0-45c2f5b087ec
+version: 1
+date: '2023-07-26'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Sysmon EventID 12
+- Sysmon EventID 13
+- Sysmon EventID 14
+description: The following analytic identifies a suspicious registry modification of Windows max connection per server configuration. 
+  This particular technique has been observed in various threat actors, adversaries, and even in malware such as the Warzone (Ave Maria) RAT.
+  By altering the max connection per server setting in the Windows registry, attackers can potentially increase the number of concurrent connections 
+  allowed to a remote server. This modification could be exploited for various malicious purposes, including facilitating distributed denial-of-service (DDoS) attacks or enabling more effective lateral movement within a compromised network.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server*")  Registry.registry_value_data = "0x0000000a" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_modify_registry_maxconnectionperserver_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: Administrators may enable or disable this feature that may
+  cause some false positive.
+references:
+- https://asec.ahnlab.com/en/17692/
+- https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/warzone#:~:text=Warzone%20RAT%20(AKA%20Ave%20Maria)%20is%20a%20remote%20access%20trojan,is%20as%20an%20information%20stealer.
+tags:
+  analytic_story:
+  - Warzone RAT
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: A registry modification in max connection per server configuration in $dest$
+  mitre_attack_id:
+  - T1112
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 25
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  - Registry.registry_value_data
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/warzone_rat/maxconnectionperserver/registry_event.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_unsigned_dll_side_loading.yml

@@ -0,0 +1,68 @@
+name: Windows Unsigned DLL Side-Loading
+id: 5a83ce44-8e0f-4786-a775-8249a525c879
+version: 1
+date: '2023-07-26'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Sysmon Event ID 7
+description: This analysis focuses on detecting potentially malicious unsigned DLLs created in either the c:\windows\system32 or c:\windows\syswow64 folders. 
+  This particular technique was observed in the context of the Warzone (Ave Maria) RAT, where it employed a method known as DLL hijacking (dll-side-loading) 
+  by dropping the "dismcore.dll" to achieve privilege escalation.
+  DLL hijacking is a stealthy attack technique used by cybercriminals to exploit the way Windows searches and loads DLLs. By placing a malicious DLL with the 
+  same name as one that a legitimate application is expected to load, the attacker can gain unauthorized access and execute malicious code.
+  In the case of Warzone RAT (Ave Maria), the dropped "dismcore.dll" was intended to deceive the system into loading the rogue DLL instead of the legitimate version, 
+  thereby granting the malware elevated privileges and enabling further compromise of the target system.
+  Detecting such suspicious DLLs is crucial in preventing privilege escalation attacks and other potential security breaches. Regular security assessments, thorough monitoring, 
+  and implementing security best practices are essential in safeguarding systems from such threats.
+search: '`sysmon` EventCode=7 Signed=false OriginalFileName = "-" SignatureStatus="unavailable" ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*") 
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded Signed SignatureStatus OriginalFileName process_name Computer EventCode ProcessId Hashes IMPHASH | rename Computer as dest
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_unsigned_dll_side_loading_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. 
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: It is possible some Administrative utilities will load dismcore.dll outside of normal system paths, filter as needed.
+references:
+- https://asec.ahnlab.com/en/17692/
+- https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/warzone#:~:text=Warzone%20RAT%20(AKA%20Ave%20Maria)%20is%20a%20remote%20access%20trojan,is%20as%20an%20information%20stealer.
+tags:
+  analytic_story:
+  - Warzone RAT
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: An unsigned dll module was loaded on $dest$
+  mitre_attack_id:
+  - T1574.002
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 49
+  required_fields:
+  - _time
+  - Image 
+  - ImageLoaded 
+  - Signed 
+  - SignatureStatus 
+  - OriginalFileName 
+  - process_name 
+  - Computer 
+  - EventCode 
+  - ProcessId 
+  - Hashes 
+  - IMPHASH 
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/warzone_rat/unsigned_dll_loaded/loaded_unsigned_dll.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog