Skip to content

Commit 0219194

Browse files
t-contrerast-contreras
committed
renamed_earth_erties
1 parent 4583864 commit 0219194

File tree

49 files changed

+556
-523
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

49 files changed

+556
-523
lines changed

‎detections/endpoint/any_powershell_downloadfile.yml

+8-8
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Any Powershell DownloadFile
22
id: 1a93b7ea-7af7-11eb-adb5-acde48001122
3-
version: '12'
4-
date: '2025-02-24'
3+
version: '13'
4+
date: '2025-03-19'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -71,18 +71,18 @@ rba:
7171
type: process_name
7272
tags:
7373
analytic_story:
74-
- Ingress Tool Transfer
74+
- Data Destruction
75+
- Malicious PowerShell
7576
- China-Nexus Threat Activity
76-
- Crypto Stealer
7777
- Hermetic Wiper
7878
- DarkCrystal RAT
79-
- Malicious PowerShell
80-
- Earth Estries
8179
- Phemedrone Stealer
82-
- Braodo Stealer
8380
- PXA Stealer
84-
- Data Destruction
8581
- Log4Shell CVE-2021-44228
82+
- Salt Typhoon
83+
- Braodo Stealer
84+
- Crypto Stealer
85+
- Ingress Tool Transfer
8686
asset_type: Endpoint
8787
cve:
8888
- CVE-2021-44228

‎detections/endpoint/detect_rare_executables.yml

+5-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Rare Executables
22
id: 44fddcb2-8d3b-454c-874e-7c6de5a4f7ac
3-
version: '8'
4-
date: '2025-02-07'
3+
version: '9'
4+
date: '2025-03-19'
55
author: Bhavin Patel, Splunk
66
status: production
77
type: Anomaly
@@ -58,12 +58,12 @@ rba:
5858
threat_objects: []
5959
tags:
6060
analytic_story:
61+
- China-Nexus Threat Activity
62+
- Unusual Processes
6163
- SnappyBee
64+
- Salt Typhoon
6265
- Rhysida Ransomware
63-
- China-Nexus Threat Activity
6466
- Crypto Stealer
65-
- Earth Estries
66-
- Unusual Processes
6767
asset_type: Endpoint
6868
mitre_attack_id:
6969
- T1204

‎detections/endpoint/detect_renamed_psexec.yml

+10-10
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Renamed PSExec
22
id: 683e6196-b8e8-11eb-9a79-acde48001122
3-
version: '12'
4-
date: '2025-02-24'
3+
version: '13'
4+
date: '2025-03-19'
55
author: Michael Haag, Splunk, Alex Oberkircher, Github Community
66
status: production
77
type: Hunting
@@ -39,18 +39,18 @@ references:
3939
- https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/
4040
tags:
4141
analytic_story:
42-
- China-Nexus Threat Activity
42+
- Sandworm Tools
43+
- SamSam Ransomware
4344
- BlackByte Ransomware
44-
- HAFNIUM Group
45-
- DHS Report TA18-074A
4645
- CISA AA22-320A
47-
- DarkSide Ransomware
48-
- Active Directory Lateral Movement
46+
- China-Nexus Threat Activity
47+
- Salt Typhoon
4948
- DarkGate Malware
50-
- Sandworm Tools
49+
- Active Directory Lateral Movement
50+
- HAFNIUM Group
51+
- DarkSide Ransomware
5152
- Rhysida Ransomware
52-
- Earth Estries
53-
- SamSam Ransomware
53+
- DHS Report TA18-074A
5454
asset_type: Endpoint
5555
mitre_attack_id:
5656
- T1569.002

‎detections/endpoint/detect_renamed_winrar.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Renamed WinRAR
22
id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122
3-
version: '10'
4-
date: '2025-02-24'
3+
version: '11'
4+
date: '2025-03-19'
55
author: Michael Haag, Splunk
66
status: production
77
type: Hunting
@@ -39,9 +39,9 @@ references:
3939
tags:
4040
analytic_story:
4141
- China-Nexus Threat Activity
42-
- CISA AA22-277A
4342
- Collection and Staging
44-
- Earth Estries
43+
- CISA AA22-277A
44+
- Salt Typhoon
4545
asset_type: Endpoint
4646
mitre_attack_id:
4747
- T1560.001

‎detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

+40-39
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Executables Or Script Creation In Suspicious Path
22
id: a7e3f0f0-ae42-11eb-b245-acde48001122
3-
version: '12'
4-
date: '2025-02-28'
3+
version: '13'
4+
date: '2025-03-19'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
@@ -15,14 +15,15 @@ description: The following analytic identifies the creation of executables or sc
1515
a significant security threat.
1616
data_source:
1717
- Sysmon EventID 11
18-
search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
19-
where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif")
20-
AND Filesystem.file_path IN ("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*",
18+
search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as
19+
file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
20+
where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe",
21+
"*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") AND Filesystem.file_path IN ("*\\windows\\fonts\\*",
22+
"*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*",
23+
"*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*",
2124
"*\\Windows\\repair\\*", "*\\PerfLogs\\*") AND NOT(Filesystem.file_path IN("*\\temp\\*"))
2225
by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user
23-
| `drop_dm_object_name(Filesystem)`
24-
| `security_content_ctime(firstTime)`
25-
| `security_content_ctime(lastTime)`
26+
| `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
2627
| `executables_or_script_creation_in_suspicious_path_filter`'
2728
how_to_implement: To successfully implement this search you need to be ingesting information
2829
on process that include the name of the Filesystem responsible for the changes from
@@ -60,48 +61,48 @@ rba:
6061
type: file_name
6162
tags:
6263
analytic_story:
63-
- BlackByte Ransomware
64-
- Brute Ratel C4
65-
- Trickbot
64+
- SystemBC
6665
- Snake Keylogger
67-
- Graceful Wipe Out Attack
68-
- PlugX
69-
- Handala Wiper
70-
- Earth Estries
71-
- Warzone RAT
72-
- ValleyRAT
73-
- NjRAT
66+
- China-Nexus Threat Activity
67+
- Remcos
7468
- LockBit Ransomware
75-
- Double Zero Destructor
76-
- Swift Slicer
77-
- DarkCrystal RAT
7869
- AsyncRAT
79-
- Volt Typhoon
80-
- Chaos Ransomware
81-
- Hermetic Wiper
70+
- DarkCrystal RAT
8271
- Derusbi
83-
- XMRig
84-
- AgentTesla
8572
- WinDealer RAT
86-
- RedLine Stealer
87-
- Remcos
88-
- Rhysida Ransomware
89-
- China-Nexus Threat Activity
73+
- DarkGate Malware
9074
- Crypto Stealer
75+
- ValleyRAT
76+
- AcidPour
77+
- PlugX
78+
- Data Destruction
9179
- Qakbot
92-
- IcedID
80+
- CISA AA23-347A
81+
- Hermetic Wiper
82+
- Volt Typhoon
83+
- Double Zero Destructor
84+
- NjRAT
85+
- Trickbot
86+
- AgentTesla
9387
- Meduza Stealer
94-
- AcidPour
88+
- SnappyBee
89+
- Azorult
90+
- WhisperGate
91+
- Warzone RAT
92+
- Swift Slicer
93+
- Rhysida Ransomware
94+
- Brute Ratel C4
95+
- BlackByte Ransomware
96+
- Graceful Wipe Out Attack
97+
- Chaos Ransomware
98+
- Handala Wiper
99+
- RedLine Stealer
100+
- Salt Typhoon
101+
- XMRig
95102
- MoonPeak
96-
- CISA AA23-347A
97-
- DarkGate Malware
98103
- Industroyer2
99-
- Azorult
100-
- Data Destruction
101104
- Amadey
102-
- SnappyBee
103-
- WhisperGate
104-
- SystemBC
105+
- IcedID
105106
asset_type: Endpoint
106107
mitre_attack_id:
107108
- T1036

‎detections/endpoint/executables_or_script_creation_in_temp_path.yml

+42-43
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Executables Or Script Creation In Temp Path
22
id: e0422b71-2c05-4f32-8754-01fb415f49c9
3-
version: 11
4-
date: '2025-02-11'
3+
version: '12'
4+
date: '2025-03-19'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
@@ -15,14 +15,13 @@ description: The following analytic identifies the creation of executables or sc
1515
a significant security threat.
1616
data_source:
1717
- Sysmon EventID 11
18-
search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
19-
where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif")
20-
AND Filesystem.file_path IN ("*\\AppData\\Local\\Temp\\*", "*:\\Windows\\Temp\\*", "*:\\Temp*")
21-
by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user
22-
| `drop_dm_object_name(Filesystem)`
23-
| `security_content_ctime(firstTime)`
24-
| `security_content_ctime(lastTime)`
25-
| `executables_or_script_creation_in_temp_path_filter`'
18+
search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as
19+
file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
20+
where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe",
21+
"*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") AND Filesystem.file_path IN ("*\\AppData\\Local\\Temp\\*",
22+
"*:\\Windows\\Temp\\*", "*:\\Temp*") by Filesystem.file_create_time Filesystem.process_id
23+
Filesystem.file_name Filesystem.user | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)`
24+
| `security_content_ctime(lastTime)` | `executables_or_script_creation_in_temp_path_filter`'
2625
how_to_implement: To successfully implement this search you need to be ingesting information
2726
on process that include the name of the Filesystem responsible for the changes from
2827
your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
@@ -48,8 +47,8 @@ drilldown_searches:
4847
earliest_offset: $info_min_time$
4948
latest_offset: $info_max_time$
5049
rba:
51-
message: Potentially suspicious executable or script with file name $file_name$, $file_path$
52-
and process_id $process_id$ was created in temporary folder by $user$
50+
message: Potentially suspicious executable or script with file name $file_name$,
51+
$file_path$ and process_id $process_id$ was created in temporary folder by $user$
5352
risk_objects:
5453
- field: user
5554
type: user
@@ -59,47 +58,47 @@ rba:
5958
type: file_name
6059
tags:
6160
analytic_story:
62-
- Chaos Ransomware
63-
- Trickbot
6461
- Snake Keylogger
65-
- CISA AA23-347A
66-
- Industroyer2
67-
- WinDealer RAT
68-
- Qakbot
69-
- Warzone RAT
70-
- IcedID
71-
- ValleyRAT
72-
- Azorult
73-
- Handala Wiper
62+
- China-Nexus Threat Activity
63+
- Remcos
7464
- LockBit Ransomware
75-
- Meduza Stealer
76-
- Brute Ratel C4
7765
- AsyncRAT
78-
- AcidPour
66+
- DarkCrystal RAT
7967
- Derusbi
68+
- WinDealer RAT
8069
- DarkGate Malware
81-
- Graceful Wipe Out Attack
82-
- NjRAT
83-
- WhisperGate
84-
- Data Destruction
85-
- BlackByte Ransomware
86-
- AgentTesla
87-
- Swift Slicer
70+
- AcidPour
71+
- ValleyRAT
8872
- Crypto Stealer
73+
- PlugX
74+
- Data Destruction
75+
- Qakbot
76+
- CISA AA23-347A
8977
- Hermetic Wiper
90-
- MoonPeak
78+
- Volt Typhoon
9179
- Double Zero Destructor
92-
- XMRig
93-
- PlugX
94-
- Amadey
95-
- DarkCrystal RAT
96-
- Remcos
97-
- China-Nexus Threat Activity
98-
- Earth Estries
80+
- NjRAT
81+
- Trickbot
82+
- Meduza Stealer
83+
- AgentTesla
84+
- SnappyBee
85+
- Azorult
86+
- WhisperGate
87+
- Warzone RAT
88+
- Swift Slicer
9989
- Rhysida Ransomware
90+
- Brute Ratel C4
91+
- BlackByte Ransomware
92+
- Graceful Wipe Out Attack
93+
- Chaos Ransomware
94+
- Handala Wiper
10095
- RedLine Stealer
101-
- Volt Typhoon
102-
- SnappyBee
96+
- Salt Typhoon
97+
- XMRig
98+
- MoonPeak
99+
- Industroyer2
100+
- Amadey
101+
- IcedID
103102
asset_type: Endpoint
104103
mitre_attack_id:
105104
- T1036

0 commit comments

Comments
 (0)