Submission Date: {{ page.submission_date }}

+

Update Date: {{ page.update_date }}

Information Domain: {{ page.information_domain }}

Data Subtypes: {{ page.subtypes }}

Analytic Type: {{ page.analytic_type }}

From d0c0b302cd3c73d7e3a689be77199e59973111c0 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 14 Feb 2022 13:39:20 -0700 Subject: [PATCH 192/342] Formatting fix --- docs/analytics/CAR-2021-01-009/index.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/analytics/CAR-2021-01-009/index.md b/docs/analytics/CAR-2021-01-009/index.md index eea30cd0..c020bd0a 100644 --- a/docs/analytics/CAR-2021-01-009/index.md +++ b/docs/analytics/CAR-2021-01-009/index.md @@ -1,7 +1,8 @@ --- title: "CAR-2021-01-009: Detecting Shadow Copy Deletion or Resize" layout: analytic -submission_date: 2020/12/11update_date: 2020/12/11 +submission_date: 2020/12/11 +update_date: 2020/12/11 information_domain: Host subtypes: Process analytic_type: TTP From 63a3211c2581e4ce207339713862217b0840cc84 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 14 Feb 2022 13:47:22 -0700 Subject: [PATCH 193/342] Fixed update_date table rendering --- scripts/analytic_template.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/scripts/analytic_template.md b/scripts/analytic_template.md index fb7c4173..822dd780 100644 --- a/scripts/analytic_template.md +++ b/scripts/analytic_template.md @@ -2,7 +2,9 @@ title: "{{analytic['id']}}: {{analytic['title']}}" layout: analytic submission_date: {{analytic['submission_date']}} -{%- if 'update_date' in analytic %}update_date: {{analytic['submission_date']}}{%- endif %} +{%- if 'update_date' in analytic %} +update_date: {{analytic['submission_date']}} +{%- endif %} information_domain: {{analytic['information_domain']}} subtypes: {{analytic['subtypes']|join(', ')}} analytic_type: {{analytic['analytic_types']|join(', ')}} From f0ce5c24c1f0992dd53364649f92cd462172f68f Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Mon, 14 Feb 2022 13:55:41 -0700 Subject: [PATCH 194/342] Fixed update_date --- docs/analytics/CAR-2021-01-009/index.md | 2 +- scripts/analytic_template.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/analytics/CAR-2021-01-009/index.md b/docs/analytics/CAR-2021-01-009/index.md index c020bd0a..99f5d959 100644 --- a/docs/analytics/CAR-2021-01-009/index.md +++ b/docs/analytics/CAR-2021-01-009/index.md @@ -2,7 +2,7 @@ title: "CAR-2021-01-009: Detecting Shadow Copy Deletion or Resize" layout: analytic submission_date: 2020/12/11 -update_date: 2020/12/11 +update_date: 2022/02/03 information_domain: Host subtypes: Process analytic_type: TTP diff --git a/scripts/analytic_template.md b/scripts/analytic_template.md index 822dd780..edd3372a 100644 --- a/scripts/analytic_template.md +++ b/scripts/analytic_template.md @@ -3,7 +3,7 @@ title: "{{analytic['id']}}: {{analytic['title']}}" layout: analytic submission_date: {{analytic['submission_date']}} {%- if 'update_date' in analytic %} -update_date: {{analytic['submission_date']}} +update_date: {{analytic['update_date']}} {%- endif %} information_domain: {{analytic['information_domain']}} subtypes: {{analytic['subtypes']|join(', ')}} From 39fb167af7432ba04b5e07caa7e1585ccca130ee Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 16 Feb 2022 09:12:09 -0700 Subject: [PATCH 195/342] Formatting fix --- docs/analytics/CAR-2021-12-002/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/analytics/CAR-2021-12-002/index.md b/docs/analytics/CAR-2021-12-002/index.md index d7d8dd84..e00dcabf 100644 --- a/docs/analytics/CAR-2021-12-002/index.md +++ b/docs/analytics/CAR-2021-12-002/index.md @@ -1,5 +1,5 @@ --- -title: "CAR-2021-12-002: Modification of Default Startup Folder in the Registry Key "Common Startup"" +title: "CAR-2021-12-002: Modification of Default Startup Folder in the Registry Key 'Common Startup'" layout: analytic submission_date: 2021/12/06 information_domain: Host From 067ac5309b769f0a1cd2c499e0920366c61e3ddc Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 16 Feb 2022 09:12:37 -0700 Subject: [PATCH 196/342] Formatting fix --- analytics/CAR-2021-12-002.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/analytics/CAR-2021-12-002.yaml b/analytics/CAR-2021-12-002.yaml index 00c0547f..1b9d8c15 100644 --- a/analytics/CAR-2021-12-002.yaml +++ b/analytics/CAR-2021-12-002.yaml @@ -1,4 +1,4 @@ -title: Modification of Default Startup Folder in the Registry Key "Common Startup" +title: Modification of Default Startup Folder in the Registry Key 'Common Startup' submission_date: 2021/12/06 information_domain: Host platforms: From 3f0c9f53889890e5c4071f17d34913c8c9d831cd Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Wed, 16 Feb 2022 14:51:31 -0700 Subject: [PATCH 197/342] Added d3fend mappings --- analytics/CAR-2021-11-001.yaml | 4 ++++ analytics/CAR-2021-11-002.yaml | 4 ++++ analytics/CAR-2021-12-001.yaml | 4 ++++ analytics/CAR-2021-12-002.yaml | 4 ++++ 4 files changed, 16 insertions(+) diff --git a/analytics/CAR-2021-11-001.yaml b/analytics/CAR-2021-11-001.yaml index b6d0feb1..ad67773a 100644 --- a/analytics/CAR-2021-11-001.yaml +++ b/analytics/CAR-2021-11-001.yaml @@ -64,3 +64,7 @@ unit_tests: data_model_references: - process/create/command_line - registry/add/key +d3fend_mappings: + - iri: d3f:ProcessSpawnAnalysis + id: D3-PSA + label: Process Spawn Analysis \ No newline at end of file diff --git a/analytics/CAR-2021-11-002.yaml b/analytics/CAR-2021-11-002.yaml index c73cb761..e3f63718 100644 --- a/analytics/CAR-2021-11-002.yaml +++ b/analytics/CAR-2021-11-002.yaml @@ -61,3 +61,7 @@ unit_tests: data_model_references: - process/create/command_line - registry/add/key +d3fend_mappings: + - iri: d3f:ProcessSpawnAnalysis + id: D3-PSA + label: Process Spawn Analysis diff --git a/analytics/CAR-2021-12-001.yaml b/analytics/CAR-2021-12-001.yaml index 056679ee..6713cb71 100644 --- a/analytics/CAR-2021-12-001.yaml +++ b/analytics/CAR-2021-12-001.yaml @@ -55,3 +55,7 @@ unit_tests: - SCHTASKS /CREATE /SC MINUTE /MO 1 /TN "PING_TASK" /TR "cmd /c ping 8.8.8.8" data_model_references: - process/create/command_line +d3fend_mappings: + - iri: d3f:ProcessSpawnAnalysis + id: D3-PSA + label: Process Spawn Analysis \ No newline at end of file diff --git a/analytics/CAR-2021-12-002.yaml b/analytics/CAR-2021-12-002.yaml index 00c0547f..f75a6f3d 100644 --- a/analytics/CAR-2021-12-002.yaml +++ b/analytics/CAR-2021-12-002.yaml @@ -60,3 +60,7 @@ unit_tests: data_model_references: - process/create/command_line - registry/add/key +d3fend_mappings: + - iri: d3f:ProcessSpawnAnalysis + id: D3-PSA + label: Process Spawn Analysis \ No newline at end of file From 450a9d99fedbb8b2f51f15c2dc58857ae9b50393 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 17 Feb 2022 07:38:37 -0700 Subject: [PATCH 198/342] Updated for d3fend mappings --- docs/analytics/CAR-2021-11-001/index.md | 6 ++++++ docs/analytics/CAR-2021-11-002/index.md | 6 ++++++ docs/analytics/CAR-2021-12-001/index.md | 6 ++++++ docs/analytics/CAR-2021-12-002/index.md | 6 ++++++ 4 files changed, 24 insertions(+) diff --git a/docs/analytics/CAR-2021-11-001/index.md b/docs/analytics/CAR-2021-11-001/index.md index 11aa0d78..f0c05873 100644 --- a/docs/analytics/CAR-2021-11-001/index.md +++ b/docs/analytics/CAR-2021-11-001/index.md @@ -20,6 +20,12 @@ Detection of creation of registry key HKEY_LOCAL_MACHINE\System\CurrentControlSe |[Modify Registry](https://attack.mitre.org/techniques/T1112/)|N/A|[Defense Evasion](https://attack.mitre.org/tactics/TA0005/)|Medium| +### D3FEND Techniques + +|ID|Name| +|---|---| +|D3-PSA | [Process Spawn Analysis](https://d3fend.mitre.org/technique/d3f:ProcessSpawnAnalysis)| + ### Data Model References diff --git a/docs/analytics/CAR-2021-11-002/index.md b/docs/analytics/CAR-2021-11-002/index.md index 845fdf8d..0c7f8e39 100644 --- a/docs/analytics/CAR-2021-11-002/index.md +++ b/docs/analytics/CAR-2021-11-002/index.md @@ -20,6 +20,12 @@ Detection of modification of the registry key values of `Notify`, `Userinit`, an |[Modify Registry](https://attack.mitre.org/techniques/T1112/)|N/A|[Defense Evasion](https://attack.mitre.org/tactics/TA0005/)|Medium| +### D3FEND Techniques + +|ID|Name| +|---|---| +|D3-PSA | [Process Spawn Analysis](https://d3fend.mitre.org/technique/d3f:ProcessSpawnAnalysis)| + ### Data Model References diff --git a/docs/analytics/CAR-2021-12-001/index.md b/docs/analytics/CAR-2021-12-001/index.md index d555a310..c62fc45e 100644 --- a/docs/analytics/CAR-2021-12-001/index.md +++ b/docs/analytics/CAR-2021-12-001/index.md @@ -19,6 +19,12 @@ Detection of the creation or modification of Scheduled Tasks with a suspicious s |[Scheduled Task/Job](https://attack.mitre.org/techniques/T1053/)|[Scheduled Task](https://attack.mitre.org/techniques/T1053/005/)|[Execution](https://attack.mitre.org/tactics/TA0002/), [Persistence](https://attack.mitre.org/tactics/TA0003/), [Privilege Escalation](https://attack.mitre.org/tactics/TA0004/)|Medium| +### D3FEND Techniques + +|ID|Name| +|---|---| +|D3-PSA | [Process Spawn Analysis](https://d3fend.mitre.org/technique/d3f:ProcessSpawnAnalysis)| + ### Data Model References diff --git a/docs/analytics/CAR-2021-12-002/index.md b/docs/analytics/CAR-2021-12-002/index.md index d7d8dd84..8a515154 100644 --- a/docs/analytics/CAR-2021-12-002/index.md +++ b/docs/analytics/CAR-2021-12-002/index.md @@ -20,6 +20,12 @@ Detection of the modification of the registry key `Common Startup` located in `H |[Modify Registry](https://attack.mitre.org/techniques/T1112/)|N/A|[Defense Evasion](https://attack.mitre.org/tactics/TA0005/)|Medium| +### D3FEND Techniques + +|ID|Name| +|---|---| +|D3-PSA | [Process Spawn Analysis](https://d3fend.mitre.org/technique/d3f:ProcessSpawnAnalysis)| + ### Data Model References From 5812c5a0a801e53c9ea178f3bac9a125ce0996a8 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 17 Feb 2022 07:52:06 -0700 Subject: [PATCH 199/342] Removed sensors; needs to be reworked --- scripts/analytic_template.md | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/scripts/analytic_template.md b/scripts/analytic_template.md index edd3372a..2e513a22 100644 --- a/scripts/analytic_template.md +++ b/scripts/analytic_template.md @@ -11,7 +11,7 @@ analytic_type: {{analytic['analytic_types']|join(', ')}} contributors: {{analytic['contributors']|join(', ')}} {% if 'platforms' in analytic %}applicable_platforms: {{analytic['platforms']|join(', ')}}{% else %}applicable_platforms: N/A{% endif %} --- - +

{{analytic['description']}} {% if 'references' in analytic %} #### References @@ -41,9 +41,6 @@ contributors: {{analytic['contributors']|join(', ')}} {% endfor %}{% endif %} {% if 'implementations' in analytic %} -### Applicable Sensors - - ### Implementations {% for impl in analytic['implementations'] %} {% if 'name' in impl %}#### {{impl['name']}} ({{impl['type']|capitalize}}{% if 'data_model' in impl %}, {{impl['data_model']}}{% endif %}) From 91d68311447bd04a45e706b4fc1634a19a816981 Mon Sep 17 00:00:00 2001 From: Ivan Kirillov Date: Thu, 17 Feb 2022 07:52:57 -0700 Subject: [PATCH 200/342] Regened for latest template tweaks --- docs/analytics/CAR-2013-01-002/index.md | 2 +- docs/analytics/CAR-2013-01-003/index.md | 5 +---- docs/analytics/CAR-2013-02-003/index.md | 5 +---- docs/analytics/CAR-2013-02-008/index.md | 5 +---- docs/analytics/CAR-2013-02-012/index.md | 2 +- docs/analytics/CAR-2013-03-001/index.md | 5 +---- docs/analytics/CAR-2013-04-002/index.md | 5 +---- docs/analytics/CAR-2013-05-002/index.md | 5 +---- docs/analytics/CAR-2013-05-003/index.md | 5 +---- docs/analytics/CAR-2013-05-004/index.md | 5 +---- docs/analytics/CAR-2013-05-005/index.md | 5 +---- docs/analytics/CAR-2013-05-009/index.md | 5 +---- docs/analytics/CAR-2013-07-001/index.md | 5 +---- docs/analytics/CAR-2013-07-002/index.md | 5 +---- docs/analytics/CAR-2013-07-005/index.md | 5 +---- docs/analytics/CAR-2013-08-001/index.md | 5 +---- docs/analytics/CAR-2013-09-003/index.md | 5 +---- docs/analytics/CAR-2013-09-005/index.md | 5 +---- docs/analytics/CAR-2013-10-001/index.md | 5 +---- docs/analytics/CAR-2013-10-002/index.md | 5 +---- docs/analytics/CAR-2014-02-001/index.md | 5 +---- docs/analytics/CAR-2014-03-001/index.md | 5 +---- docs/analytics/CAR-2014-03-005/index.md | 5 +---- docs/analytics/CAR-2014-03-006/index.md | 5 +---- docs/analytics/CAR-2014-04-003/index.md | 5 +---- docs/analytics/CAR-2014-05-001/index.md | 5 +---- docs/analytics/CAR-2014-05-002/index.md | 5 +---- docs/analytics/CAR-2014-07-001/index.md | 5 +---- docs/analytics/CAR-2014-11-002/index.md | 5 +---- docs/analytics/CAR-2014-11-003/index.md | 5 +---- docs/analytics/CAR-2014-11-004/index.md | 5 +---- docs/analytics/CAR-2014-11-005/index.md | 5 +---- docs/analytics/CAR-2014-11-006/index.md | 5 +---- docs/analytics/CAR-2014-11-007/index.md | 5 +---- docs/analytics/CAR-2014-11-008/index.md | 5 +---- docs/analytics/CAR-2014-12-001/index.md | 5 +---- docs/analytics/CAR-2015-04-001/index.md | 5 +---- docs/analytics/CAR-2015-04-002/index.md | 5 +---- docs/analytics/CAR-2015-07-001/index.md | 5 +---- docs/analytics/CAR-2016-03-001/index.md | 5 +---- docs/analytics/CAR-2016-03-002/index.md | 5 +---- docs/analytics/CAR-2016-04-002/index.md | 5 +---- docs/analytics/CAR-2016-04-003/index.md | 5 +---- docs/analytics/CAR-2016-04-004/index.md | 5 +---- docs/analytics/CAR-2016-04-005/index.md | 5 +---- docs/analytics/CAR-2019-04-001/index.md | 5 +---- docs/analytics/CAR-2019-04-002/index.md | 5 +---- docs/analytics/CAR-2019-04-003/index.md | 5 +---- docs/analytics/CAR-2019-04-004/index.md | 5 +---- docs/analytics/CAR-2019-07-001/index.md | 5 +---- docs/analytics/CAR-2019-07-002/index.md | 5 +---- docs/analytics/CAR-2019-08-001/index.md | 5 +---- docs/analytics/CAR-2019-08-002/index.md | 5 +---- docs/analytics/CAR-2020-04-001/index.md | 2 +- docs/analytics/CAR-2020-05-001/index.md | 5 +---- docs/analytics/CAR-2020-05-003/index.md | 5 +---- docs/analytics/CAR-2020-08-001/index.md | 5 +---- docs/analytics/CAR-2020-08-002/index.md | 5 +---- docs/analytics/CAR-2020-09-001/index.md | 5 +---- docs/analytics/CAR-2020-09-002/index.md | 5 +---- docs/analytics/CAR-2020-09-003/index.md | 5 +---- docs/analytics/CAR-2020-09-004/index.md | 5 +---- docs/analytics/CAR-2020-09-005/index.md | 5 +---- docs/analytics/CAR-2020-11-001/index.md | 5 +---- docs/analytics/CAR-2020-11-002/index.md | 5 +---- docs/analytics/CAR-2020-11-003/index.md | 5 +---- docs/analytics/CAR-2020-11-004/index.md | 5 +---- docs/analytics/CAR-2020-11-005/index.md | 5 +---- docs/analytics/CAR-2020-11-006/index.md | 5 +---- docs/analytics/CAR-2020-11-007/index.md | 5 +---- docs/analytics/CAR-2020-11-008/index.md | 5 +---- docs/analytics/CAR-2020-11-009/index.md | 5 +---- docs/analytics/CAR-2020-11-010/index.md | 5 +---- docs/analytics/CAR-2020-11-011/index.md | 5 +---- docs/analytics/CAR-2021-01-001/index.md | 5 +---- docs/analytics/CAR-2021-01-002/index.md | 5 +---- docs/analytics/CAR-2021-01-003/index.md | 5 +---- docs/analytics/CAR-2021-01-004/index.md | 5 +---- docs/analytics/CAR-2021-01-006/index.md | 5 +---- docs/analytics/CAR-2021-01-007/index.md | 5 +---- docs/analytics/CAR-2021-01-008/index.md | 5 +---- docs/analytics/CAR-2021-01-009/index.md | 5 +---- docs/analytics/CAR-2021-02-001/index.md | 5 +---- docs/analytics/CAR-2021-02-002/index.md | 5 +---- docs/analytics/CAR-2021-04-001/index.md | 5 +---- docs/analytics/CAR-2021-05-001/index.md | 5 +---- docs/analytics/CAR-2021-05-002/index.md | 5 +---- docs/analytics/CAR-2021-05-003/index.md | 5 +---- docs/analytics/CAR-2021-05-004/index.md | 5 +---- docs/analytics/CAR-2021-05-005/index.md | 5 +---- docs/analytics/CAR-2021-05-006/index.md | 5 +---- docs/analytics/CAR-2021-05-007/index.md | 5 +---- docs/analytics/CAR-2021-05-008/index.md | 5 +---- docs/analytics/CAR-2021-05-009/index.md | 5 +---- docs/analytics/CAR-2021-05-010/index.md | 5 +---- docs/analytics/CAR-2021-05-011/index.md | 5 +---- docs/analytics/CAR-2021-05-012/index.md | 5 +---- docs/analytics/CAR-2021-11-001/index.md | 5 +---- docs/analytics/CAR-2021-11-002/index.md | 5 +---- docs/analytics/CAR-2021-12-001/index.md | 5 +---- docs/analytics/CAR-2021-12-002/index.md | 5 +---- docs/analytics/index.md | 4 ++-- 102 files changed, 103 insertions(+), 397 deletions(-) diff --git a/docs/analytics/CAR-2013-01-002/index.md b/docs/analytics/CAR-2013-01-002/index.md index 326c8419..aad379aa 100644 --- a/docs/analytics/CAR-2013-01-002/index.md +++ b/docs/analytics/CAR-2013-01-002/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness, TTP contributors: MITRE applicable_platforms: Windows --- - +

The Sysinternals tool [Autoruns](../sensors/autoruns) checks the registry and file system for known identify persistence mechanisms. It will output any tools identified, including built-in or added-on Microsoft functionality and third party software. Many of these locations are known by adversaries and used to obtain [Persistence](https://attack.mitre.org/tactics/TA0003). Running Autoruns periodically in an environment makes it possible to collect and monitor its output for differences, which may include the removal or addition of persistent tools. Depending on the persistence mechanism and location, legitimate software may be more likely to make changes than an adversary tool. Thus, this analytic may result in significant noise in a highly dynamic environment. While Autoruns is a convenient method to scan for programs using persistence mechanisms its scanning nature does not conform well to streaming based analytics. This analytic could be replaced with one that draws from sensors that collect registry and file information if streaming analytics are desired. Utilizes the Sysinternals autoruns tool (ignoring validated Microsoft entries). Primarily not a detection analytic by itself but through analysis of results by an analyst can be used for such. Building another analytic on top of this one identifying unusual entries would likely be a beneficial alternative. diff --git a/docs/analytics/CAR-2013-01-003/index.md b/docs/analytics/CAR-2013-01-003/index.md index c5f82f6d..0261bdbb 100644 --- a/docs/analytics/CAR-2013-01-003/index.md +++ b/docs/analytics/CAR-2013-01-003/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness contributors: MITRE applicable_platforms: N/A --- - +

[Server Message Block](https://en.wikipedia.org/wiki/Server_Message Block) (SMB) is used by Windows to allow for file, pipe, and printer sharing over port 445/tcp. It allows for enumerating, and reading from and writing to file shares for a remote computer. Although it is heavily used by Windows servers for legitimate purposes and by users for file and printer sharing, many adversaries also use SMB to achieve [Lateral Movement](https://attack.mitre.org/tactics/TA0008). Looking at this activity more closely to obtain an adequate sense of situational awareness may make it possible to detect adversaries moving between hosts in a way that deviates from normal activity. Because SMB traffic is heavy in many environments, this analytic may be difficult to turn into something that can be used to quickly detect an APT. In some cases, it may make more sense to run this analytic in a forensic fashion. Looking through and filtering its output after an intrusion has been discovered may be helpful in identifying the scope of compromise. ### Output Description @@ -41,9 +41,6 @@ The source, destination, content, and time of each event. -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2013-02-003/index.md b/docs/analytics/CAR-2013-02-003/index.md index 7a35f5ba..8a8c3601 100644 --- a/docs/analytics/CAR-2013-02-003/index.md +++ b/docs/analytics/CAR-2013-02-003/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness contributors: MITRE applicable_platforms: Windows --- - +

The Windows [Command Prompt](https://en.wikipedia.org/wiki/cmd.exe) (`cmd.exe`) is a utility that provides a command line interface to Windows operating systems. It provides the ability to run additional programs and also has several built-in commands such as `dir`, `copy`, `mkdir`, and `type`, as well as batch scripts (`.bat`). Typically, when a user runs a command prompt, the parent process is `explorer.exe` or another instance of the prompt. There may be automated programs, logon scripts, or administrative tools that launch instances of the command prompt in order to run scripts or other built-in commands. Spawning the process `cmd.exe` from certain parents may be more indicative of malice. For example, if Adobe Reader or Outlook launches a command shell, this may suggest that a malicious document has been loaded and should be investigated. Thus, by looking for abnormal parent processes of `cmd.exe`, it may be possible to detect adversaries. @@ -36,9 +36,6 @@ The Windows [Command Prompt](https://en.wikipedia.org/wiki/cmd.exe) (`cmd.exe`) -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2013-02-008/index.md b/docs/analytics/CAR-2013-02-008/index.md index 0733213b..023ce975 100644 --- a/docs/analytics/CAR-2013-02-008/index.md +++ b/docs/analytics/CAR-2013-02-008/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness contributors: MITRE applicable_platforms: Windows, Linux, macOS --- - +

Multiple users logged into a single machine at the same time, or even within the same hour, do not typically occur in networks we have observed. Logon events are Windows Event Code 4624 for Windows Vista and above, 518 for pre-Vista. Logoff events are 4634 for Windows Vista and above, 538 for pre-Vista. @@ -39,9 +39,6 @@ Logon types 2, 3, 9 and 10 are of interest. For more details see the Logon Types -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2013-02-012/index.md b/docs/analytics/CAR-2013-02-012/index.md index 59628a01..15553611 100644 --- a/docs/analytics/CAR-2013-02-012/index.md +++ b/docs/analytics/CAR-2013-02-012/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness contributors: MITRE applicable_platforms: Windows, Linux, macOS --- - +

Most users use only one or two machines during the normal course of business. User accounts that log in to multiple machines, especially over a short period of time, may be compromised. Remote logins among multiple machines may be an indicator of [Lateral Movement](https://attack.mitre.org/tactics/TA0008). Certain users will likely appear as being logged into several machines and may need to be "whitelisted." Such users would include network admins or user names that are common to many hosts. diff --git a/docs/analytics/CAR-2013-03-001/index.md b/docs/analytics/CAR-2013-03-001/index.md index 8536211b..9d01d6a1 100644 --- a/docs/analytics/CAR-2013-03-001/index.md +++ b/docs/analytics/CAR-2013-03-001/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

Registry modifications are often essential in establishing persistence via known Windows mechanisms. Many legitimate modifications are done graphically via `regedit.exe` or by using the corresponding channels, or even calling the Registry APIs directly. The built-in utility `reg.exe` provides a [command-line interface](https://en.wikipedia.org/wiki/Command-line_interface) to the registry, so that queries and modifications can be performed from a shell, such as `cmd.exe`. When a user is responsible for these actions, the parent of `cmd.exe` will likely be `explorer.exe`. Occasionally, power users and administrators write scripts that do this behavior as well, but likely from a different process tree. These background scripts must be learned so they can be tuned out accordingly. ### Output Description @@ -52,9 +52,6 @@ The sequence of processes that resulted in `reg.exe` being started from a shell. -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2013-04-002/index.md b/docs/analytics/CAR-2013-04-002/index.md index 0794384e..19767682 100644 --- a/docs/analytics/CAR-2013-04-002/index.md +++ b/docs/analytics/CAR-2013-04-002/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows, Linux, macOS --- - +

Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing. Commands of interest: @@ -93,9 +93,6 @@ The host on which the commands were executed, the time of execution, and what co -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2013-05-002/index.md b/docs/analytics/CAR-2013-05-002/index.md index 9797081f..e4ae3e07 100644 --- a/docs/analytics/CAR-2013-05-002/index.md +++ b/docs/analytics/CAR-2013-05-002/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

In Windows, files should never execute out of certain directory locations. Any of these locations may exist for a variety of reasons, and executables may be present in the directory but should not execute. As a result, some defenders make the mistake of ignoring these directories and assuming that a process will never run from one. There are known TTPs that have taken advantage of this fact to go undetected. This fact should inform defenders to monitor these directories more closely, knowing that they should never contain running processes. Monitors the directories @@ -42,9 +42,6 @@ Monitors the directories -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2013-05-003/index.md b/docs/analytics/CAR-2013-05-003/index.md index dd62828f..61a44567 100644 --- a/docs/analytics/CAR-2013-05-003/index.md +++ b/docs/analytics/CAR-2013-05-003/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness, TTP contributors: MITRE applicable_platforms: Windows, Linux, macOS --- - +

As described in [CAR-2013-01-003](../CAR-2013-01-003), SMB provides a means of remotely managing a file system. Adversaries often use SMB to move laterally to a host. SMB is commonly used to upload files. It may be used for staging in [Exfiltration](https://attack.mitre.org/tactics/TA0010) or as a [Lateral Movement](https://attack.mitre.org/tactics/TA0008) technique. Unlike SMB Reads, SMB Write requests typically require an additional level of access, resulting in less activity. Focusing on SMB Write activity narrows the field to find techniques that actively change remote hosts, instead of passively reading files. @@ -38,9 +38,6 @@ As described in [CAR-2013-01-003](../CAR-2013-01-003), SMB provides a means of r -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2013-05-004/index.md b/docs/analytics/CAR-2013-05-004/index.md index b42d36d7..d8abf449 100644 --- a/docs/analytics/CAR-2013-05-004/index.md +++ b/docs/analytics/CAR-2013-05-004/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

In order to gain [persistence](https://attack.mitre.org/tactics/TA0003/), [privilege escalation](https://attack.mitre.org/tactics/TA0004/), or [remote execution](https://attack.mitre.org/tactics/TA0002/), an adversary may use the Windows built-in command AT (at.exe) to [schedule a command](https://attack.mitre.org/techniques/T1053/002) to be run at a specified time, date, and even host. This method has been used by adversaries and administrators alike. Its use may lead to detection of compromised hosts and compromised users if it is used to move laterally. The built-in Windows tool schtasks.exe ([CAR-2013-08-001](../CAR-2013-08-001)) offers greater flexibility when creating, modifying, and enumerating tasks. For these reasons, schtasks.exe is more commonly used by administrators, tools/scripts, and power users. @@ -37,9 +37,6 @@ The built-in Windows tool schtasks.exe ([CAR-2013-08-001](../CAR-2013-08-001)) o -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2013-05-005/index.md b/docs/analytics/CAR-2013-05-005/index.md index 4f5033c6..b1a8263d 100644 --- a/docs/analytics/CAR-2013-05-005/index.md +++ b/docs/analytics/CAR-2013-05-005/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows, Linux, macOS --- - +

An adversary needs to gain access to other hosts to move throughout an environment. In many cases, this is a twofold process. First, a file is remotely written to a host via an SMB share (detected by [CAR-2013-05-003](../CAR-2013-05-003)). Then, a variety of [Execution](https://attack.mitre.org/tactics/TA0002) techniques can be used to remotely establish execution of the file or script. To detect this behavior, look for files that are written to a host over SMB and then later run directly as a process or in the command line arguments. SMB File Writes and Remote Execution may happen normally in an environment, but the combination of the two behaviors is less frequent and more likely to indicate adversarial activity. This can possibly extend to more copy protocols in order to widen its reach, or it could be tuned more finely to focus on specific program run locations (e.g. `%SYSTEMROOT%\system32`) to gain a higher detection rate. @@ -41,9 +41,6 @@ This can possibly extend to more copy protocols in order to widen its reach, or -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2013-05-009/index.md b/docs/analytics/CAR-2013-05-009/index.md index 78a6c04e..8e6fc0d4 100644 --- a/docs/analytics/CAR-2013-05-009/index.md +++ b/docs/analytics/CAR-2013-05-009/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows, Linux, macOS --- - +

Executables are generally not renamed, thus a given hash of an executable should only have ever one name. Identifying instances where multiple process names share the same hash may find cases where tools are copied by attackers to different folders or hosts to [avoid detection](https://attack.mitre.org/tactics/TA0005). Although this analytic was initially based on MD5 hashes, it is equally applicable to any hashing convention. @@ -43,9 +43,6 @@ A list of hashes and the different executables associated with each one -### Applicable Sensors - - ### Implementations #### Basic Query (Splunk, Sysmon native) diff --git a/docs/analytics/CAR-2013-07-001/index.md b/docs/analytics/CAR-2013-07-001/index.md index aff7bf87..60a6ae48 100644 --- a/docs/analytics/CAR-2013-07-001/index.md +++ b/docs/analytics/CAR-2013-07-001/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows, Linux, macOS --- - +

Malicious actors may rename built-in commands or external tools, such as those provided by SysInternals, to better [blend in](https://attack.mitre.org/tactics/TA0005) with the environment. In those cases, the file path name is arbitrary and may blend in well with the background. If the arguments are closely inspected, it may be possible to infer what tools are running and understand what an adversary is doing. When any legitimate software shares the same command lines, it must be whitelisted according to the expected parameters. Any tool of interest with commonly known command line usage can be detecting by command line analysis. Known substrings of command lines include @@ -50,9 +50,6 @@ Any tool of interest with commonly known command line usage can be detecting by -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2013-07-002/index.md b/docs/analytics/CAR-2013-07-002/index.md index 1edc770a..faa8f65c 100644 --- a/docs/analytics/CAR-2013-07-002/index.md +++ b/docs/analytics/CAR-2013-07-002/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness, TTP contributors: MITRE applicable_platforms: N/A --- - +

The [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) (RDP), built in to Microsoft operating systems, allows a user to remotely log in to the desktop of another host. It allows for interactive access of the running windows, and forwards key presses, mouse clicks, etc. Network administrators, power users, and end-users may use RDP for day-to-day operations. From an adversary's perspective, RDP provides a means to [laterally move](https://attack.mitre.org/tactics/TA0008) to a new host. Determining which RDP connections correspond to adversary activity can be a difficult problem in highly dynamic environments, but will be useful in identifying the scope of a compromise. Remote Desktop can be detected in several ways @@ -51,9 +51,6 @@ The time of the Connection, the source, the destination, and the user name used -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2013-07-005/index.md b/docs/analytics/CAR-2013-07-005/index.md index 79f9b56d..871358e0 100644 --- a/docs/analytics/CAR-2013-07-005/index.md +++ b/docs/analytics/CAR-2013-07-005/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows, Linux, macOS --- - +

Before [exfiltrating data](https://attack.mitre.org/tactics/TA0010) that an adversary has [collected](https://attack.mitre.org/tactics/TA0009), it is very likely that a [compressed archive](https://attack.mitre.org/techniques/T1560) will be created, so that transfer times are minimized and fewer files are transmitted. There is variety between the tools used to compress data, but the command line usage and context of archiving tools, such as ZIP, RAR, and 7ZIP, should be monitored. In addition to looking for RAR or 7z program names, command line usage of 7Zip or RAR can be detected with the flag usage of "`\* a \*`". This is helpful, as adversaries may change program names. @@ -37,9 +37,6 @@ In addition to looking for RAR or 7z program names, command line usage of 7Zip o -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2013-08-001/index.md b/docs/analytics/CAR-2013-08-001/index.md index 0e9d4191..4e59652f 100644 --- a/docs/analytics/CAR-2013-08-001/index.md +++ b/docs/analytics/CAR-2013-08-001/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

The Windows built-in tool `schtasks.exe` provides the creation, modification, and running of [scheduled tasks](https://attack.mitre.org/techniques/T1053) on a local or remote computer. It is provided as a more flexible alternative to `at.exe`, described in [CAR-2013-05-004](../CAR-2013-05-004). Although used by adversaries, the tool is also legitimately used by administrators, scripts, and software configurations. The scheduled tasks tool can be used to gain [Persistence](https://attack.mitre.org/tactics/TA0003) and can be used in combination with a [Lateral Movement](https://attack.mitre.org/tactics/TA0008) technique to remotely gain [execution](https://attack.mitre.org/tactics/TA0002). Additionally, the command has parameters to specify the user and password responsible for creating the task, as well as the user and password combination that the task will run as. The `/s` flag specifies the remote system on which the task should be scheduled, usually indicating [Lateral Movement](https://attack.mitre.org/tactics/TA0008). @@ -36,9 +36,6 @@ The Windows built-in tool `schtasks.exe` provides the creation, modification, an -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2013-09-003/index.md b/docs/analytics/CAR-2013-09-003/index.md index 583fb9c5..63b65680 100644 --- a/docs/analytics/CAR-2013-09-003/index.md +++ b/docs/analytics/CAR-2013-09-003/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness contributors: MITRE applicable_platforms: N/A --- - +

Account usage within SMB can be used to identify compromised credentials, and the hosts accessed with them. This analytic monitors SMB activity that deals with user activity rather than file activity. @@ -39,9 +39,6 @@ This analytic monitors SMB activity that deals with user activity rather than fi -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2013-09-005/index.md b/docs/analytics/CAR-2013-09-005/index.md index 51945b68..50633efa 100644 --- a/docs/analytics/CAR-2013-09-005/index.md +++ b/docs/analytics/CAR-2013-09-005/index.md @@ -8,7 +8,7 @@ analytic_type: Detection contributors: MITRE applicable_platforms: Windows --- - +

New executables that are started as a service are suspicious. This analytic looks for anomalous service executables. @@ -35,9 +35,6 @@ New executables that are started as a service are suspicious. This analytic look -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2013-10-001/index.md b/docs/analytics/CAR-2013-10-001/index.md index b91588ac..8c0e020a 100644 --- a/docs/analytics/CAR-2013-10-001/index.md +++ b/docs/analytics/CAR-2013-10-001/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness contributors: MITRE applicable_platforms: Windows, Linux, macOS --- - +

Monitoring logon and logoff events for hosts on the network is very important for situational awareness. This information can be used as an indicator of unusual activity as well as to corroborate activity seen elsewhere. Could be applied to a number of different types of monitoring depending on what information is desired. Some use cases include monitoring for all remote connections and building login timelines for users. @@ -37,9 +37,6 @@ The time of login events for distinct users on individual systems -### Applicable Sensors - - ### Implementations #### Account Logon with Filtering (Pseudocode) diff --git a/docs/analytics/CAR-2013-10-002/index.md b/docs/analytics/CAR-2013-10-002/index.md index 42061ac9..7cf719f6 100644 --- a/docs/analytics/CAR-2013-10-002/index.md +++ b/docs/analytics/CAR-2013-10-002/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

Microsoft Windows allows for processes to remotely create threads within other processes of the same privilege level. This functionality is provided via the Windows API [CreateRemoteThread](https://msdn.microsoft.com/en-us/library/windows/desktop/ms682437.aspx). Both Windows and third-party software use this ability for legitimate purposes. For example, the Windows process [csrss.exe](https://en.wikipedia.org/wiki/Client/Server_Runtime_Subsystem) creates threads in programs to send signals to registered callback routines. Both adversaries and host-based security software use this functionality to [inject DLLs](https://attack.mitre.org/techniques/T1055), but for very different purposes. An adversary is likely to inject into a program to [evade defenses](https://attack.mitre.org/tactics/TA0005) or [bypass User Account Control](https://attack.mitre.org/techniques/T1548/002), but a security program might do this to gain increased monitoring of API calls. One of the most common methods of [DLL Injection](https://attack.mitre.org/techniques/T1055) is through the Windows API [LoadLibrary](https://msdn.microsoft.com/en-us/library/windows/desktop/ms684175.aspx). - Allocate memory in the target program with [VirtualAllocEx](https://msdn.microsoft.com/en-us/library/windows/desktop/aa366890.aspx) @@ -43,9 +43,6 @@ This behavior can be detected by looking for thread creations across processes, -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2014-02-001/index.md b/docs/analytics/CAR-2014-02-001/index.md index e43f18ab..3708d644 100644 --- a/docs/analytics/CAR-2014-02-001/index.md +++ b/docs/analytics/CAR-2014-02-001/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness, TTP contributors: MITRE applicable_platforms: Windows --- - +

Adversaries may modify the binary file for an existing service to achieve [Persistence](https://attack.mitre.org/tactics/TA0003) while potentially [evading defenses](https://attack.mitre.org/tactics/TA0005). If a newly created or modified runs as a service, it may indicate APT activity. However, services are frequently installed by legitimate software. A well-tuned baseline is essential to differentiating between benign and malicious service modifications. ### Output Description @@ -44,9 +44,6 @@ The Service Name and approximate time in which changes occurred on each host -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2014-03-001/index.md b/docs/analytics/CAR-2014-03-001/index.md index ebd3cc30..7ac418cc 100644 --- a/docs/analytics/CAR-2014-03-001/index.md +++ b/docs/analytics/CAR-2014-03-001/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness contributors: MITRE applicable_platforms: Windows, Linux, macOS --- - +

An SMB write can be an indicator of lateral movement, especially when combined with other information such as execution of that written file. Named pipes are a subset of SMB write requests. Named pipes such as msftewds may not be alarming; however others, such as lsarpc, may. Monitoring SMB write requests still creates some noise, particulary with named pipes. As a result, SMB is now split between writing named pipes and writing other files. @@ -38,9 +38,6 @@ Monitoring SMB write requests still creates some noise, particulary with named p -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2014-03-005/index.md b/docs/analytics/CAR-2014-03-005/index.md index baa2f45c..e69641cc 100644 --- a/docs/analytics/CAR-2014-03-005/index.md +++ b/docs/analytics/CAR-2014-03-005/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

There are several ways to cause code to [execute](https://attack.mitre.org/tactics/TA0002) on a remote host. One of the most common methods is via the Windows [Service Control Manager](https://en.wikipedia.org/wiki/Service_Control_Manager) (SCM), which allows authorized users to remotely create and modify services. Several tools, such as [PsExec](https://attack.mitre.org/software/S0029), use this functionality. When a client remotely communicates with the Service Control Manager, there are two observable behaviors. First, the client connects to the [RPC Endpoint Mapper](../CAR-2014-05-001) over 135/tcp. This handles authentication, and tells the client what port the endpoint—in this case the SCM—is listening on. Then, the client connects directly to the listening port on `services.exe`. If the request is to start an existing service with a known command line, the the SCM process will run the corresponding command. @@ -42,9 +42,6 @@ This compound behavior can be detected by looking for `services.exe` receiving a -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2014-03-006/index.md b/docs/analytics/CAR-2014-03-006/index.md index 2f025f33..a37feb0d 100644 --- a/docs/analytics/CAR-2014-03-006/index.md +++ b/docs/analytics/CAR-2014-03-006/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

Adversaries may find it necessary to use [Dyanamic-link Libraries](https://msdn.microsoft.com/en-us/library/windows/desktop/ms682589.aspx) (DLLs) to [evade defenses](https://attack.mitre.org/tactics/TA0005). One way these DLLs can be "executed" is through the use of the built-in Windows utility [RunDLL32](https://attack.mitre.org/techniques/T1218.011), which allows a user to execute code in a DLL, providing the name and optional arguments to an exported entry point. Windows uses RunDll32 legitimately in its normal operation, but with a proper baseline and understanding of the environment, monitoring its usage could be fruitful. @@ -36,9 +36,6 @@ Adversaries may find it necessary to use [Dyanamic-link Libraries](https://msdn. -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2014-04-003/index.md b/docs/analytics/CAR-2014-04-003/index.md index c65486f8..047e86f3 100644 --- a/docs/analytics/CAR-2014-04-003/index.md +++ b/docs/analytics/CAR-2014-04-003/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

[PowerShell](https://attack.mitre.org/techniques/T1059/001/) is a scripting environment included with Windows that is used by both attackers and administrators. Execution of PowerShell scripts in most Windows versions is opaque and not typically secured by antivirus which makes using PowerShell an easy way to circumvent security measures. This analytic detects execution of PowerShell scripts. Powershell can be used to hide monitored command line execution such as: @@ -41,9 +41,6 @@ Powershell can be used to hide monitored command line execution such as: -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2014-05-001/index.md b/docs/analytics/CAR-2014-05-001/index.md index 0d4ab6ef..425de5dc 100644 --- a/docs/analytics/CAR-2014-05-001/index.md +++ b/docs/analytics/CAR-2014-05-001/index.md @@ -8,7 +8,7 @@ analytic_type: TTP, Situational Awareness contributors: MITRE applicable_platforms: Windows --- - +

Microsoft Windows uses its implementation of [Distributed Computing Environment/Remote Procedure Call](https://en.wikipedia.org/wiki/DCE/RPC) (DCE/RPC), which it calls [Microsoft RPC](https://en.wikipedia.org/wiki/Microsoft_RPC), to call certain APIs remotely. A Remote Procedure Call is initiated by communicating to the RPC Endpoint Mapper, which exists as the Windows service RpcEptMapper and listens on the port 135/tcp. The endpoint mapper resolves a requested endpoint/interface and responds to the client with the port that the service is listening on. Since the RPC endpoints are assigned ports when the services start, these ports are dynamically assigned from 49152 to 65535. The connection to the endpoint mapper then terminates and the client program can communicate directly with the requested service. @@ -48,9 +48,6 @@ Additional endpoints are detailed at [here](http://www.hsc.fr/ressources/article -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2014-05-002/index.md b/docs/analytics/CAR-2014-05-002/index.md index 6f54b05f..4774e240 100644 --- a/docs/analytics/CAR-2014-05-002/index.md +++ b/docs/analytics/CAR-2014-05-002/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

Windows runs the [Service Control Manager](https://en.wikipedia.org/wiki/Service_Control_Manager) (SCM) within the process `services.exe`. Windows launches services as independent processes or DLL loads within a [svchost.exe](https://en.wikipedia.org/wiki/svchost.exe) group. To be a legitimate service, a process (or DLL) must have the appropriate service entry point [SvcMain](https://msdn.microsoft.com/en-us/library/windows/desktop/ms687414.aspx). If an application does not have the entry point, then it will timeout (default is 30 seconds) and the process will be killed. To survive the timeout, [adversaries and red teams](https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf) can create services that direct to `cmd.exe` with the flag `/c`, followed by the desired command. The `/c` flag causes the command shell to run a command and immediately exit. As a result, the desired program will remain running and it will report an error starting the service. This analytic will catch that command prompt instance that is used to launch the actual malicious executable. Additionally, the children and descendants of services.exe will run as a SYSTEM user by default. Thus, services are a convenient way for an adversary to gain [Persistence](https://attack.mitre.org/tactics/TA0003) and [Privilege Escalation](https://attack.mitre.org/tactics/TA0004). @@ -38,9 +38,6 @@ To survive the timeout, [adversaries and red teams](https://www.operationblockbu -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2014-07-001/index.md b/docs/analytics/CAR-2014-07-001/index.md index 88b8ce2a..e0c9d4eb 100644 --- a/docs/analytics/CAR-2014-07-001/index.md +++ b/docs/analytics/CAR-2014-07-001/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

According to [ATT&CK](https://attack.mitre.org/), an adversary may [escalate privileges](https://attack.mitre.org/tactics/TA0004) by [intercepting the search path](https://attack.mitre.org/techniques/T1579/009) for legitimately installed services. As a result, Windows will launch the target executable instead of the desired binary and command line. This can be done when there are spaces in the binary path and the path is unquoted. Search path interception should never happen legitimately and will likely be the result of an adversary abusing a system misconfiguration. With a few regular expressions, it is possible to identify the execution of services with intercepted search paths. @@ -37,9 +37,6 @@ According to [ATT&CK](https://attack.mitre.org/), an adversary may [escalate pri -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2014-11-002/index.md b/docs/analytics/CAR-2014-11-002/index.md index 3127585a..5c7a8c01 100644 --- a/docs/analytics/CAR-2014-11-002/index.md +++ b/docs/analytics/CAR-2014-11-002/index.md @@ -8,7 +8,7 @@ analytic_type: Anomaly, TTP contributors: MITRE applicable_platforms: Windows --- - +

Many programs create command prompts as part of their normal operation including malware used by attackers. This analytic attempts to identify suspicious programs spawning `cmd.exe` by looking for programs that do not normally create `cmd.exe`. While this analytic does not take the user into account, doing so could generate further interesting results. @@ -44,9 +44,6 @@ The time and host the new process was started as well as its parent -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2014-11-003/index.md b/docs/analytics/CAR-2014-11-003/index.md index 6ee9616a..917b1158 100644 --- a/docs/analytics/CAR-2014-11-003/index.md +++ b/docs/analytics/CAR-2014-11-003/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

The Windows Registry location `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options` allows for parameters to be set for applications during execution. One feature used by malicious actors is the "Debugger" option. When a key has this value enabled, a Debugging command line can be specified. Windows will launch the Debugging command line, and pass the original command line in as an argument. Adversaries can set a Debugger for [Accessibility Applications](https://attack.mitre.org/techniques/T1546/008). The analytic looks for the original command line as an argument to the Debugger. When the strings "sethc.exe", "utilman.exe", "osk.exe", "narrator.exe", and "Magnify.exe" are detected in the arguments, but not as the main executable, it is very likely that a Debugger is set. This analytic could depend on the possibility of the known strings used as arguments for other applications used in the day-to-day environment. Although the chance of the string "sethc.exe" being used as an argument for another application is unlikely, it still is a possibility. @@ -38,9 +38,6 @@ This analytic could depend on the possibility of the known strings used as argum -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2014-11-004/index.md b/docs/analytics/CAR-2014-11-004/index.md index cbf59cf1..2ba04b40 100644 --- a/docs/analytics/CAR-2014-11-004/index.md +++ b/docs/analytics/CAR-2014-11-004/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

According to [ATT&CK](https://attack.mitre.org/), [PowerShell](https://attack.mitre.org/techniques/T1059/001) can be used over WinRM to remotely run commands on a host. When a remote PowerShell session starts, svchost.exe executes wsmprovhost.exe For this to work, certain registry keys must be set, and the WinRM service must be enabled. The PowerShell command `Enter-PSSession -ComputerName \` creates a remote PowerShell session. @@ -39,9 +39,6 @@ For this to work, certain registry keys must be set, and the WinRM service must -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2014-11-005/index.md b/docs/analytics/CAR-2014-11-005/index.md index 323ac847..49e6d432 100644 --- a/docs/analytics/CAR-2014-11-005/index.md +++ b/docs/analytics/CAR-2014-11-005/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

An adversary can remotely [manipulate the registry](https://attack.mitre.org/techniques/T1112) of another machine if the RemoteRegistry service is enabled and valid credentials are obtained. While the registry is remotely accessed, it can be used to prepare a [Lateral Movement](https://attack.mitre.org/tactics/TA0008) technique, [discover](https://attack.mitre.org/tactics/TA0007) the configuration of a host, achieve [Persistence](https://attack.mitre.org/tactics/TA0003), or anything that aids an adversary in achieving the mission. Like most ATT&CK techniques, this behavior can be used legitimately, and the reliability of an analytic depends on the proper identification of the pre-existing legitimate behaviors. Although this behavior is disabled in many Windows configurations, it is possible to [remotely enable](https://attack.mitre.org/techniques/T1569/002) the RemoteRegistry service, which can be detected with [CAR-2014-03-005](../CAR-2014-03-005). Remote access to the registry can be achieved via @@ -44,9 +44,6 @@ All of these behaviors call into the Windows API, which uses the NamedPipe `WINR -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2014-11-006/index.md b/docs/analytics/CAR-2014-11-006/index.md index 4ee530b3..783d529e 100644 --- a/docs/analytics/CAR-2014-11-006/index.md +++ b/docs/analytics/CAR-2014-11-006/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness contributors: MITRE applicable_platforms: Windows --- - +

When a [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) connection is opened, the client sends HTTP requests to port 5985 for HTTP or 5986 for HTTPS on the target host. Each HTTP(S) request to the URI "/wsman" is called, and other information is set in the headers. Depending on the operation, the HTTP method may vary (i.e., GET, POST, etc.). This analytic would detect Remote PowerShell, as well as other communications that rely on WinRM. Additionally, it outputs the executable on the client host, the connection information, and the hostname of the target host. @@ -35,9 +35,6 @@ When a [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006 -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2014-11-007/index.md b/docs/analytics/CAR-2014-11-007/index.md index aaa842a9..1b37f562 100644 --- a/docs/analytics/CAR-2014-11-007/index.md +++ b/docs/analytics/CAR-2014-11-007/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

As described in ATT&CK, an adversary can use [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) (WMI) to view or manipulate objects on a remote host. It can be used to remotely edit configuration, start services, query files, and anything that can be done with a WMI class. When remote WMI requests are over RPC ([CAR-2014-05-001](../CAR-2014-05-001)), it connects to a DCOM interface within the RPC group netsvcs. To detect this activity, a sensor is needed at the network level that can decode RPC traffic or on the host where the communication can be detected more natively, such as [Event Tracing for Windows](https://msdn.microsoft.com/en-us/library/windows/desktop/bb968803.aspx). Using wireshark/tshark decoders, the WMI interfaces can be extracted so that WMI activity over RPC can be detected. Although the description details how to detect remote WMI precisely, a decent estimate has been to look for the string RPCSS within the initial RPC connection on 135/tcp. It returns a superset of this activity, and will trigger on all DCOM-related services running within RPC, which is likely to also be activity that should be detected between hosts. @@ -42,9 +42,6 @@ Identifies the connection in which WMI traffic is seen, as well as the process(e -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2014-11-008/index.md b/docs/analytics/CAR-2014-11-008/index.md index e44646ad..6f4d4188 100644 --- a/docs/analytics/CAR-2014-11-008/index.md +++ b/docs/analytics/CAR-2014-11-008/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

An adversary can use [accessibility features](https://attack.mitre.org/techniques/T1546/008) (Ease of Access), such as StickyKeys or Utilman, to launch a command shell from the logon screen and gain SYSTEM access. Since an adversary does not have physical access to the machine, this technique must be run within [Remote Desktop](https://attack.mitre.org/techniques/T1021/001). To prevent an adversary from getting to the login screen without first authenticating, Network-Level Authentication (NLA) must be enabled. If a debugger is set up for one of the accessibility features, then it will intercept the process launch of the feature and instead execute a new command line. This analytic looks for instances of `cmd.exe` or `powershell.exe` launched directly from the logon process, `winlogon.exe`. It should be used in tandem with [CAR-2014-11-003](../CAR-2014-11-003), which detects the accessibility programs in the command line. Several accessibility programs can be run using the Ease of Access center @@ -44,9 +44,6 @@ Several accessibility programs can be run using the Ease of Access center -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2014-12-001/index.md b/docs/analytics/CAR-2014-12-001/index.md index 3d8b2021..4058fd4a 100644 --- a/docs/analytics/CAR-2014-12-001/index.md +++ b/docs/analytics/CAR-2014-12-001/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

Adversaries can use [Windows Management Instrumentation (WMI)](https://attack.mitre.org/techniques/T1047) to move laterally by launching executables remotely. For adversaries to achieve this, they must open a WMI connection to a remote host. This RPC activity is currently detected by [CAR-2014-11-007](../CAR-2014-11-007). After the WMI connection has been initialized, a process can be remotely launched using the command: `wmic /node:"" process call create ""`, which is detected via [CAR-2016-03-002](../CAR-2016-03-002). This leaves artifacts at both a network (RPC) and process (command line) level. When wmic.exe (or the schtasks API) is used to remotely create processes, Windows uses RPC (135/tcp) to communicate with the the remote machine. @@ -67,9 +67,6 @@ Identifies the process that initiated the RPC request (such as wmic.exe or power -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2015-04-001/index.md b/docs/analytics/CAR-2015-04-001/index.md index 828257b8..ca5deaf5 100644 --- a/docs/analytics/CAR-2015-04-001/index.md +++ b/docs/analytics/CAR-2015-04-001/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

When AT.exe is used to remotely [schedule tasks](https://attack.mitre.org/techniques/T1053), Windows uses named pipes over [SMB](https://en.wikipedia.org/wiki/Server_Message_Block) to communicate with the API on the remote machine. After authentication over SMB, the Named Pipe "ATSVC" is opened, over which the JobAdd function is called. On the remote host, the job files are created by the Task Scheduler and follow the convention `C:\Windows\System32\AT`. Unlike [CAR-2013-05-004](../CAR-2013-05-004), this analytic specifically focuses on uses of AT that can be detected between hosts, indicating remotely gained [execution](https://attack.mitre.org/tactics/TA0002). This pipe activity could be discovered with a network decoder, such as that in wireshark, that can inspect SMB traffic to identify the use of pipes. It could also be detected by looking for raw packet capture streams or from a custom sensor on the host that hooks the appropriate API functions. If no network or API level of visibility is possible, this traffic may inferred by looking at SMB connections over 445/tcp followed by the creation of files matching the pattern `C:\Windows\System32\AT\`. @@ -37,9 +37,6 @@ This pipe activity could be discovered with a network decoder, such as that in w -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2015-04-002/index.md b/docs/analytics/CAR-2015-04-002/index.md index df76e821..fb341a20 100644 --- a/docs/analytics/CAR-2015-04-002/index.md +++ b/docs/analytics/CAR-2015-04-002/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

An adversary can [move laterally](https://attack.mitre.org/tactics/TA0008) using the `schtasks` command to remotely [schedule tasks/jobs](https://attack.mitre.org/techniques/T1053). Although these events can be detected with command line analytics [CAR-2013-08-001](../CAR-2013-08-001), it is possible for an adversary to use the API directly, via the Task Scheduler GUI or with a scripting language such as [PowerShell](https://attack.mitre.org/techniques/T1059/001). In this cases, an additional source of data becomes necessary to detect adversarial behavior. When scheduled tasks are created remotely, Windows uses RPC (135/tcp) to communicate with the Task Scheduler on the remote machine. Once an RPC connection is established ([CAR-2014-05-001](../CAR-2014-05-001)), the client communicates with the Scheduled Tasks endpoint, which runs within the service group netsvcs. With packet capture and the right packet decoders or byte-stream based signatures, remote invocations of these functions can be identified. Certain strings can be identifiers of the schtasks, by looking up the interface UUID of ITaskSchedulerService in different formats @@ -45,9 +45,6 @@ This identifier is present three times during the RPC request phase. Any sensor -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2015-07-001/index.md b/docs/analytics/CAR-2015-07-001/index.md index 461be1e6..24371e7c 100644 --- a/docs/analytics/CAR-2015-07-001/index.md +++ b/docs/analytics/CAR-2015-07-001/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness contributors: MITRE applicable_platforms: Windows, Linux, macOS --- - +

Once a credential dumper like [mimikatz](https://attack.mitre.org/software/S0002) runs, every user logged on since boot is potentially compromised, because the credentials were accessed via the memory of `lsass.exe`. When such an event occurs, this analytic will give the forensic context to identify compromised users. Those users could potentially be used in later events for additional logons. The time field indicates the first and last time a system reported a user logged into a given system. This means that activity could be intermittent between the times given and should not be considered a duration. @@ -31,9 +31,6 @@ A list of hostnames and the users that had been logged into the system at some p -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2016-03-001/index.md b/docs/analytics/CAR-2016-03-001/index.md index f8811073..f58cdb2e 100644 --- a/docs/analytics/CAR-2016-03-001/index.md +++ b/docs/analytics/CAR-2016-03-001/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows, Linux, macOS --- - +

When entering on a host for the first time, an adversary may try to [discover](https://attack.mitre.org/tactics/TA0007) information about the host. There are several built-in Windows commands that can be used to learn about the software configurations, active users, administrators, and networking configuration. These commands should be monitored to identify when an adversary is learning information about the system and environment. The information returned may impact choices an adversary can make when [establishing persistence](https://attack.mitre.org/tactics/TA0003), [escalating privileges](https://attack.mitre.org/tactics/TA0004), or [moving laterally](https://attack.mitre.org/tactics/TA0008). Because these commands are built in, they may be run frequently by power users or even by normal users. Thus, an analytic looking at this information should have well-defined white- or blacklists, and should consider looking at an anomaly detection approach, so that this information can be learned dynamically. @@ -59,9 +59,6 @@ Within the built-in Windows Commands: -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2016-03-002/index.md b/docs/analytics/CAR-2016-03-002/index.md index e4f282be..9cd3fac9 100644 --- a/docs/analytics/CAR-2016-03-002/index.md +++ b/docs/analytics/CAR-2016-03-002/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

Adversaries may use [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) (WMI) to move laterally, by launching executables remotely.The analytic [CAR-2014-12-001](../CAR-2014-12-001) describes how to detect these processes with network traffic monitoring and process monitoring on the target host. However, if the command line utility `wmic.exe` is used on the source host, then it can additionally be detected on an analytic. The command line on the source host is constructed into something like `wmic.exe /node:"\" process call create "\"`. It is possible to also connect via IP address, in which case the string `"\"` would instead look like `IP Address`. Although this analytic was created after [CAR-2014-12-001](../CAR-2014-12-001), it is a much simpler (although more limited) approach. Processes can be created remotely via WMI in a few other ways, such as more direct API access or the built-in utility [PowerShell](https://attack.mitre.org/T1059/001). @@ -38,9 +38,6 @@ Although this analytic was created after [CAR-2014-12-001](../CAR-2014-12-001), -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2016-04-002/index.md b/docs/analytics/CAR-2016-04-002/index.md index f6e285ef..70417feb 100644 --- a/docs/analytics/CAR-2016-04-002/index.md +++ b/docs/analytics/CAR-2016-04-002/index.md @@ -8,7 +8,7 @@ analytic_type: Anomaly contributors: MITRE/NSA applicable_platforms: Windows, Linux, macOS --- - +

It is unlikely that event log data would be cleared during normal operations, and it is likely that malicious attackers may try to cover their tracks by clearing an event log. When an event log gets cleared, it is suspicious. Alerting when a "Clear Event Log" is generated could point to this intruder technique. Centrally collecting events has the added benefit of making it much harder for attackers to cover their tracks. Event Forwarding permits sources to forward multiple copies of a collected event to multiple collectors, thus enabling redundant event collection. Using a redundant event collection model can minimize the single point of failure risk. @@ -29,9 +29,6 @@ It is unlikely that event log data would be cleared during normal operations, an -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2016-04-003/index.md b/docs/analytics/CAR-2016-04-003/index.md index 96595fbc..ea1ed9b3 100644 --- a/docs/analytics/CAR-2016-04-003/index.md +++ b/docs/analytics/CAR-2016-04-003/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness contributors: MITRE/NSA applicable_platforms: Windows --- - +

Spyware and malware remain a serious problem and Microsoft developed security services, Windows Defender and Windows Firewall, to combat this threat. In the event Windows Defender or Windows Firewall is turned off, administrators should correct the issue immediately to prevent the possibility of infection or further infection and investigate to determine if caused by crash or user manipulation. Stopping services events are Windows Event Code 7036. @@ -31,9 +31,6 @@ Stopping services events are Windows Event Code 7036. -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2016-04-004/index.md b/docs/analytics/CAR-2016-04-004/index.md index 1d078fad..87162383 100644 --- a/docs/analytics/CAR-2016-04-004/index.md +++ b/docs/analytics/CAR-2016-04-004/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness contributors: MITRE/NSA applicable_platforms: Windows --- - +

The successful use of [Pass The Hash](https://attack.mitre.org/techniques/T1550/002/) for lateral movement between workstations would trigger event ID 4624, with an event level of Information, from the security log. This behavior would be a LogonType of 3 using NTLM authentication where it is not a domain logon and not the ANONYMOUS LOGON account. @@ -29,9 +29,6 @@ The successful use of [Pass The Hash](https://attack.mitre.org/techniques/T1550/ -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2016-04-005/index.md b/docs/analytics/CAR-2016-04-005/index.md index 81944773..1950f251 100644 --- a/docs/analytics/CAR-2016-04-005/index.md +++ b/docs/analytics/CAR-2016-04-005/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness contributors: MITRE/NSA applicable_platforms: Windows --- - +

A remote desktop logon, through [RDP](https://attack.mitre.org/techniques/T1021/001), may be typical of a system administrator or IT support, but only from select workstations. Monitoring remote desktop logons and comparing to known/approved originating systems can detect lateral movement of an adversary. @@ -29,9 +29,6 @@ A remote desktop logon, through [RDP](https://attack.mitre.org/techniques/T1021/ -### Applicable Sensors - - ### Implementations #### Pseudocode diff --git a/docs/analytics/CAR-2019-04-001/index.md b/docs/analytics/CAR-2019-04-001/index.md index 60f50fdf..c94f5997 100644 --- a/docs/analytics/CAR-2019-04-001/index.md +++ b/docs/analytics/CAR-2019-04-001/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

Bypassing user account control (UAC Bypass) is generally done by piggybacking on a system process that has auto-escalate privileges. This analytic looks to detect those cases as described by the open-source [UACME](https://github.com/hfiref0x/UACME) tool. @@ -39,9 +39,6 @@ Bypassing user account control (UAC Bypass) is generally done by piggybacking on -### Applicable Sensors - - ### Implementations #### Splunk, Sysmon native diff --git a/docs/analytics/CAR-2019-04-002/index.md b/docs/analytics/CAR-2019-04-002/index.md index d3a239ca..2f5fbde5 100644 --- a/docs/analytics/CAR-2019-04-002/index.md +++ b/docs/analytics/CAR-2019-04-002/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness contributors: MITRE applicable_platforms: Windows --- - +

Regsvr32 can be used to execute arbitrary code in the context of a Windows signed binary, which can be used to bypass application whitelisting. This analytic looks for suspicious usage of the tool. It's not likely that you'll get millions of hits, but it does occur during normal activity so some form of baselining would be necessary for this to be an alerting analytic. Alternatively, it can be used for hunt by looking for new or anomalous DLLs manually. @@ -39,9 +39,6 @@ Regsvr32 can be used to execute arbitrary code in the context of a Windows signe -### Applicable Sensors - - ### Implementations #### Main Pattern (Splunk, Sysmon native) diff --git a/docs/analytics/CAR-2019-04-003/index.md b/docs/analytics/CAR-2019-04-003/index.md index 8f178e67..8bcba0ec 100644 --- a/docs/analytics/CAR-2019-04-003/index.md +++ b/docs/analytics/CAR-2019-04-003/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

Squiblydoo is a specific usage of regsvr32.dll to load a COM scriptlet directly from the internet and execute it in a way that bypasses application whitelisting. It can be seen by looking for regsvr32.exe executions that load the scrobj.dll (which execute the COM scriptlet) or, if that is too noisy, those that also load content directly via HTTP or HTTPS. Squiblydoo was first written up by Casey Smith at Red Canary, though that blog post is no longer accessible. @@ -41,9 +41,6 @@ As usual, credit to Roberto Rodriguez and the [ThreatHunter Playbook](https://gi -### Applicable Sensors - - ### Implementations #### Splunk, Sysmon native diff --git a/docs/analytics/CAR-2019-04-004/index.md b/docs/analytics/CAR-2019-04-004/index.md index 53ead602..325ac168 100644 --- a/docs/analytics/CAR-2019-04-004/index.md +++ b/docs/analytics/CAR-2019-04-004/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

Credential dumpers like Mimikatz can be loaded into memory and from there read data from another processes. This analytic looks for instances where processes are requesting specific permissions to read parts of the LSASS process in order to detect when credential dumping is occurring. One weakness is that all current implementations are “overtuned” to look for common access patterns used by Mimikatz. *This requires information about process access, e.g. Sysmon Event ID 10. That currently doesn’t have a CAR data model mapping, since we currently lack any open/access actions for Processes. If this changes, we will update the data model requirements.* @@ -34,9 +34,6 @@ Credit to [Cyb3rWard0g](https://github.com/Cyb3rWard0g/ThreatHunter-Playbook/blo -### Applicable Sensors - - ### Implementations #### Common Mimikatz GrantedAccess Patterns (Splunk, Sysmon native) diff --git a/docs/analytics/CAR-2019-07-001/index.md b/docs/analytics/CAR-2019-07-001/index.md index 816787a5..013dfc51 100644 --- a/docs/analytics/CAR-2019-07-001/index.md +++ b/docs/analytics/CAR-2019-07-001/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness contributors: Meric Degirmenci, MITRE applicable_platforms: Windows, Linux, macOS --- - +

Adversaries sometimes modify object access rights at the operating system level. There are varying motivations behind this action - they may not want some files/objects to be changed on systems for persistence reasons and therefore provide admin only rights; also, they may want files to be accessible with lower levels of permissions. Note - this analytic references file permissions, which are not currently in the CAR data model. @@ -31,9 +31,6 @@ Note - this analytic references file permissions, which are not currently in the -### Applicable Sensors - - ### Implementations #### Windows - Pseudocode (Pseudocode) diff --git a/docs/analytics/CAR-2019-07-002/index.md b/docs/analytics/CAR-2019-07-002/index.md index 28049d4c..72858330 100644 --- a/docs/analytics/CAR-2019-07-002/index.md +++ b/docs/analytics/CAR-2019-07-002/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Kaushal Parikh/Cyware Labs, Tony Lambert/Red Canary, MITRE applicable_platforms: Windows --- - +

[ProcDump](https://docs.microsoft.com/en-us/sysinternals/downloads/procdump) is a sysinternal command-line utility whose primary purpose is monitoring an application for CPU spikes and generating crash dumps during a spike that an administrator or developer can use to determine the cause of the spike. ProcDump may be used to dump the memory space of lsass.exe to disk for processing with a credential access tool such as Mimikatz. This is performed by launching procdump.exe as a privileged user with command line options indicating that lsass.exe should be dumped to a file with an arbitrary name. @@ -40,9 +40,6 @@ Note - the CAR data model currently does not support process access actions, so -### Applicable Sensors - - ### Implementations #### Procdump - Process Create (Pseudocode) diff --git a/docs/analytics/CAR-2019-08-001/index.md b/docs/analytics/CAR-2019-08-001/index.md index cefcc98b..0d727545 100644 --- a/docs/analytics/CAR-2019-08-001/index.md +++ b/docs/analytics/CAR-2019-08-001/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Tony Lambert/Red Canary applicable_platforms: Windows --- - +

The Windows Task Manager may be used to dump the memory space of `lsass.exe` to disk for processing with a credential access tool such as Mimikatz. This is performed by launching Task Manager as a privileged user, selecting `lsass.exe`, and clicking "Create dump file". This saves a dump file to disk with a deterministic name that includes the name of the process being dumped. This requires filesystem data to determine whether files have been created. @@ -38,9 +38,6 @@ This requires filesystem data to determine whether files have been created. -### Applicable Sensors - - ### Implementations #### Procdump - File Create (Pseudocode) diff --git a/docs/analytics/CAR-2019-08-002/index.md b/docs/analytics/CAR-2019-08-002/index.md index 78cd94b8..f0fb91fd 100644 --- a/docs/analytics/CAR-2019-08-002/index.md +++ b/docs/analytics/CAR-2019-08-002/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Tony Lambert/Red Canary applicable_platforms: Windows --- - +

The NTDSUtil tool may be used to dump a Microsoft Active Directory database to disk for processing with a credential access tool such as Mimikatz. This is performed by launching `ntdsutil.exe` as a privileged user with command line arguments indicating that media should be created for offline Active Directory installation and specifying a folder path. This process will create a copy of the Active Directory database, `ntds.dit`, to the specified folder path. This requires filesystem data to determine whether files have been created. @@ -38,9 +38,6 @@ This requires filesystem data to determine whether files have been created. -### Applicable Sensors - - ### Implementations #### NTDSUtil - File Create (Pseudocode) diff --git a/docs/analytics/CAR-2020-04-001/index.md b/docs/analytics/CAR-2020-04-001/index.md index f61f351d..34f8426c 100644 --- a/docs/analytics/CAR-2020-04-001/index.md +++ b/docs/analytics/CAR-2020-04-001/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: applicable_platforms: Windows --- - +

This analytic has been deprecated in favor of [CAR-2021-01-009](/analytics/CAR-2021-01-009), which covers the same technique with some additional detections. diff --git a/docs/analytics/CAR-2020-05-001/index.md b/docs/analytics/CAR-2020-05-001/index.md index 9cecaad1..add50eb2 100644 --- a/docs/analytics/CAR-2020-05-001/index.md +++ b/docs/analytics/CAR-2020-05-001/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Cyber National Mission Force (CNMF) applicable_platforms: Windows --- - +

This analytic detects the minidump variant of credential dumping where a process opens lsass.exe in order to extract credentials using the Win32 API call [MiniDumpWriteDump](https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump). Tools like [SafetyKatz](https://github.com/GhostPack/SafetyKatz), [SafetyDump](https://github.com/m0rv4i/SafetyDump), and [Outflank-Dumpert](https://github.com/outflanknl/Dumpert) default to this variant and may be detected by this analytic, though keep in mind that not all options for using those tools will result in this specific behavior. The analytic is based on a [Sigma analytic](https://github.com/NVISO-BE/sigma-public/blob/master/rules/windows/sysmon/sysmon_lsass_memdump.yml) contributed by Samir Bousseaden and written up in a [blog on MENASEC](https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html). It looks for a call trace that includes either dbghelp.dll or dbgcore.dll, which export the relevant functions/permissions to perform the dump. It also detects using the Windows Task Manager (taskmgr.exe) to dump lsass, which is described in [CAR-2019-08-001](/analytics/CAR-2019-08-001/). In this iteration of the Sigma analytic, the `GrantedAccess` filter isn't included because it didn't seem to filter out any false positives and introduces the potential for evasion. @@ -35,9 +35,6 @@ NOTE - this analytic has no corresponding pseudocode implementation because the -### Applicable Sensors - - ### Implementations #### Lsass Process Access (Splunk, Sysmon native) diff --git a/docs/analytics/CAR-2020-05-003/index.md b/docs/analytics/CAR-2020-05-003/index.md index fbf967f6..9d095cf7 100644 --- a/docs/analytics/CAR-2020-05-003/index.md +++ b/docs/analytics/CAR-2020-05-003/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Cyber National Mission Force (CNMF) applicable_platforms: Windows --- - +

[LoLBAS](https://lolbas-project.github.io/) are binaries and scripts that are built in to Windows, frequently are signed by Microsoft, and may be used by an attacker. Some LoLBAS are used very rarely and it might be possible to alert every time they're used (this would depend on your environment), but many others are very common and can't be simply alerted on. This analytic takes all instances of LoLBAS execution and then looks for instances of command lines that are not normal in the environment. This can detect attackers (which will tend to need the binaries for something different than normal usage) but will also tend to have false positives. @@ -38,9 +38,6 @@ Note - this analytic is related to [CAR-2013-04-002](/analytics/CAR-2013-04-002) -### Applicable Sensors - - ### Implementations #### LolBAS Rare Commands (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2020-08-001/index.md b/docs/analytics/CAR-2020-08-001/index.md index 655676b0..8f13ef62 100644 --- a/docs/analytics/CAR-2020-08-001/index.md +++ b/docs/analytics/CAR-2020-08-001/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

NTFS Alternate Data Streams (ADSs) may be used by adversaries as a means of evading security tools by storing malicious data or binaries in file attribute metadata. ADSs are also powerful because they can be directly executed by various Windows tools; accordingly, this analytic looks at common ways of executing ADSs using system utilities such as powershell. #### References @@ -40,9 +40,6 @@ The [LOLBAS project](https://lolbas-project.github.io/) is an amazing resource f -### Applicable Sensors - - ### Implementations #### NTFS ADS - pseudocode (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2020-08-002/index.md b/docs/analytics/CAR-2020-08-002/index.md index 8c049b5f..a53a38fb 100644 --- a/docs/analytics/CAR-2020-08-002/index.md +++ b/docs/analytics/CAR-2020-08-002/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: MITRE applicable_platforms: Windows --- - +

NTFS Alternate Data Streams (ADSs) may be used by adversaries as a means of evading security tools by storing malicious data or binaries in file attribute metadata. ADSs are also powerful because their contents can be directly executed by various Windows tools; accordingly, this analytic looks at common ways of executing ADSs using Living off the Land Binaries and Scripts (LOLBAS). #### References @@ -40,9 +40,6 @@ Oddvar Moe has created an excellent NTFS ADS execution reference [here on github -### Applicable Sensors - - ### Implementations #### NTFS ADS - pseudocode (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2020-09-001/index.md b/docs/analytics/CAR-2020-09-001/index.md index f8fc8d46..5363b961 100644 --- a/docs/analytics/CAR-2020-09-001/index.md +++ b/docs/analytics/CAR-2020-09-001/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness contributors: Olaf Hartong applicable_platforms: Windows --- - +

In order to gain persistence, privilege escalation, or remote execution, an adversary may use the Windows Task Scheduler to schedule a command to be run at a specified time, date, and even host. Task Scheduler stores tasks as files in two locations - C:\Windows\Tasks (legacy) or C:\Windows\System32\Tasks. Accordingly, this analytic looks for the creation of task files in these two locations. @@ -36,9 +36,6 @@ In order to gain persistence, privilege escalation, or remote execution, an adve -### Applicable Sensors - - ### Implementations #### Pseudocode - Windows task file creation (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2020-09-002/index.md b/docs/analytics/CAR-2020-09-002/index.md index 40695b57..453072c5 100644 --- a/docs/analytics/CAR-2020-09-002/index.md +++ b/docs/analytics/CAR-2020-09-002/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness contributors: Olaf Hartong applicable_platforms: Windows --- - +

Adversaries may establish persistence or escalate privileges by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. This is typically done by replacing COM object registry entries under the HKEY_CURRENT_USER\Software\Classes\CLSID or HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID keys. Accordingly, this analytic looks for any changes under these keys. @@ -37,9 +37,6 @@ Adversaries may establish persistence or escalate privileges by executing malici -### Applicable Sensors - - ### Implementations #### Pseudocode - COM object registry entry modification (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2020-09-003/index.md b/docs/analytics/CAR-2020-09-003/index.md index 3b8384a9..ec2492d4 100644 --- a/docs/analytics/CAR-2020-09-003/index.md +++ b/docs/analytics/CAR-2020-09-003/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Olaf Hartong applicable_platforms: Windows --- - +

Adversaries may attempt to evade system defenses by unloading minifilter drivers used by host-based sensors such as Sysmon through the use of the fltmc command-line utility. Accordingly, this analytic looks for command-line invocations of this utility when used to unload minifilter drivers. @@ -36,9 +36,6 @@ Adversaries may attempt to evade system defenses by unloading minifilter drivers -### Applicable Sensors - - ### Implementations #### Pseudocode - fltmc invocation (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2020-09-004/index.md b/docs/analytics/CAR-2020-09-004/index.md index f3e7be1b..02c9710c 100644 --- a/docs/analytics/CAR-2020-09-004/index.md +++ b/docs/analytics/CAR-2020-09-004/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Olaf Hartong applicable_platforms: Windows --- - +

Adversaries may search the Windows Registry on compromised systems for insecurely stored credentials for credential access. This can be accomplished using the query functionality of the reg.exe system utility, by looking for keys and values that contain strings such as "password". In addition, adversaries may use toolkits such as [PowerSploit](https://powersploit.readthedocs.io/en/latest/) in order to dump credentials from various applications such as IIS.Accordingly, this analytic looks for invocations of reg.exe in this capacity as well as that of several powersploit modules with similar functionality. @@ -35,9 +35,6 @@ Adversaries may search the Windows Registry on compromised systems for insecurel -### Applicable Sensors - - ### Implementations #### Pseudocode - reg.exe password search & powersploit modules (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2020-09-005/index.md b/docs/analytics/CAR-2020-09-005/index.md index 1d774f85..f5b226a5 100644 --- a/docs/analytics/CAR-2020-09-005/index.md +++ b/docs/analytics/CAR-2020-09-005/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Olaf Hartong applicable_platforms: Windows --- - +

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows` or `HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows` are loaded by user32.dll into every process that loads user32.dll. These values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes. Accordingly, this analytic looks for modifications to these registry keys that may be indicative of this type of abuse. @@ -37,9 +37,6 @@ Adversaries may establish persistence and/or elevate privileges by executing mal -### Applicable Sensors - - ### Implementations #### Pseudocode - AppInit DLL registry modification (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2020-11-001/index.md b/docs/analytics/CAR-2020-11-001/index.md index 7e0a1e67..881b48b4 100755 --- a/docs/analytics/CAR-2020-11-001/index.md +++ b/docs/analytics/CAR-2020-11-001/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Olaf Hartong applicable_platforms: Windows --- - +

Adversaries may schedule software to run whenever a user logs into the system; this is done to establish persistence and sometimes for lateral movement. This trigger is established through the registry key HKEY_CURRENT_USER\Environment*UserInitMprLogonScript*. This signature looks edits to existing keys or creation of new keys in that path. Users purposefully adding benign scripts to this path will result in false positives; that case is rare, however. There are other ways of running a script at startup or login that are not covered in this signature. Note that this signature overlaps with the Windows Sysinternals Autoruns tool, which would also show changes to this registry path. @@ -38,9 +38,6 @@ Adversaries may schedule software to run whenever a user logs into the system; t -### Applicable Sensors - - ### Implementations #### Pseudocode - logon run script key added to registry using reg.exe on commandline, or new logon scipt keys in registry from any source. (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2020-11-002/index.md b/docs/analytics/CAR-2020-11-002/index.md index d5a0c30a..11c8bef6 100755 --- a/docs/analytics/CAR-2020-11-002/index.md +++ b/docs/analytics/CAR-2020-11-002/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness contributors: Olaf Hartong applicable_platforms: Windows --- - +

Adversaries may use a variety of tools to gain visibility on the current status of things on the network: which processes are listening on which ports, which services are running on other hosts, etc. This analytic looks for the names of the most common network sniffing tools. While this may be noisy on networks where sysadmins are using any of these tools on a regular basis, in most networks their use is noteworthy. @@ -36,9 +36,6 @@ Adversaries may use a variety of tools to gain visibility on the current status -### Applicable Sensors - - ### Implementations #### Pseudocode - commands containing known network sniffing application names (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2020-11-003/index.md b/docs/analytics/CAR-2020-11-003/index.md index d0d3c17a..5195e8c1 100755 --- a/docs/analytics/CAR-2020-11-003/index.md +++ b/docs/analytics/CAR-2020-11-003/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Olaf Hartong applicable_platforms: Windows --- - +

Injecting a malicious DLL into a process is a common adversary TTP. Although the ways of doing this are numerous, mavinject.exe is a commonly used tool for doing so because it roles up many of the necessary steps into one, and is available within Windows. Attackers may rename the executable, so we also use the common argument "INJECTRUNNING" as a related signature here. Whitelisting certain applications may be necessary to reduce noise for this analytic. @@ -36,9 +36,6 @@ Injecting a malicious DLL into a process is a common adversary TTP. Although the -### Applicable Sensors - - ### Implementations #### Pseudocode - mavinject process and its common argument (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2020-11-004/index.md b/docs/analytics/CAR-2020-11-004/index.md index ebdd1aa9..4a286dcf 100755 --- a/docs/analytics/CAR-2020-11-004/index.md +++ b/docs/analytics/CAR-2020-11-004/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Olaf Hartong applicable_platforms: Windows --- - +

Adversaries may start legitimate processes and then use their memory space to run malicious code. This analytic looks for common Windows processes that have been abused this way in the past; when the processes are started for this purpose they may not have the standard parent that we would expect. This list is not exhaustive, and it is possible for cyber actors to avoid this discepency. These signatures only work if Sysmon reports the parent process, which may not always be the case if the parent dies before sysmon processes the event. @@ -36,9 +36,6 @@ Adversaries may start legitimate processes and then use their memory space to ru -### Applicable Sensors - - ### Implementations #### Pseudocode - common processes that do not have the correct parent (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2020-11-005/index.md b/docs/analytics/CAR-2020-11-005/index.md index 863c13e2..bc69a6a5 100755 --- a/docs/analytics/CAR-2020-11-005/index.md +++ b/docs/analytics/CAR-2020-11-005/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Olaf Hartong applicable_platforms: Windows --- - +

Adversaries may attempt to conceal their tracks by deleting the history of commands run within the Powershell console, or turning off history saving to begin with. This analytic looks for several commands that would do this. This does not capture the event if it is done within the console itself; only commandline-based commands are detected. Note that the command to remove the history file directly may very a bit if the history file is not saved in the default path on a particular system. @@ -36,9 +36,6 @@ Adversaries may attempt to conceal their tracks by deleting the history of comma -### Applicable Sensors - - ### Implementations #### Pseudocode - clear or disable Powershell console history via commandline (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2020-11-006/index.md b/docs/analytics/CAR-2020-11-006/index.md index 480bcecd..4531700e 100755 --- a/docs/analytics/CAR-2020-11-006/index.md +++ b/docs/analytics/CAR-2020-11-006/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Olaf Hartong applicable_platforms: Windows --- - +

Cyber actors frequently enumerate local or domain permissions groups. The net utility is usually used for this purpose. This analytic looks for any instances of net.exe, which is not normally used for benign purposes, although system administrator actions may trigger false positives. @@ -36,9 +36,6 @@ Cyber actors frequently enumerate local or domain permissions groups. The net ut -### Applicable Sensors - - ### Implementations #### Pseudocode - net.exe instances (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2020-11-007/index.md b/docs/analytics/CAR-2020-11-007/index.md index 84442a0f..4d7eeabe 100755 --- a/docs/analytics/CAR-2020-11-007/index.md +++ b/docs/analytics/CAR-2020-11-007/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Olaf Hartong applicable_platforms: Windows --- - +

Adversaries may use network shares to exfliltrate date; they will then remove the shares to cover their tracks. This analytic looks for the removal of network shares via commandline, which is otherwise a rare event. @@ -36,9 +36,6 @@ Adversaries may use network shares to exfliltrate date; they will then remove th -### Applicable Sensors - - ### Implementations #### Pseudocode - network shares being removed via the command line (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2020-11-008/index.md b/docs/analytics/CAR-2020-11-008/index.md index f543e386..0915aec5 100755 --- a/docs/analytics/CAR-2020-11-008/index.md +++ b/docs/analytics/CAR-2020-11-008/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Olaf Hartong applicable_platforms: Windows --- - +

Trusted developer utilities such as MSBuild may be leveraged to run malicious code with elevated privileges. This analytic looks for any instances of msbuild.exe, which will execute any C# code placed within a given XML document; and msxsl.exe, which processes xsl transformation specifications for XML files and will execute a variaty of scripting languages contained within the XSL file. Both of these executables are rarely used outside of Visual Studio. @@ -36,9 +36,6 @@ Trusted developer utilities such as MSBuild may be leveraged to run malicious co -### Applicable Sensors - - ### Implementations #### Pseudocode - msbuild (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2020-11-009/index.md b/docs/analytics/CAR-2020-11-009/index.md index 7fed0206..34ea2984 100755 --- a/docs/analytics/CAR-2020-11-009/index.md +++ b/docs/analytics/CAR-2020-11-009/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Olaf Hartong applicable_platforms: Windows --- - +

Adversaries may hide malicious code in .chm compiled HTML files. When these files are read, Windows uses the HTML help executable named hh.exe, which is the signature for this analytic. @@ -35,9 +35,6 @@ Adversaries may hide malicious code in .chm compiled HTML files. When these file -### Applicable Sensors - - ### Implementations #### Pseudocode - instances of hh.exe (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2020-11-010/index.md b/docs/analytics/CAR-2020-11-010/index.md index e4ac232c..dbd07575 100755 --- a/docs/analytics/CAR-2020-11-010/index.md +++ b/docs/analytics/CAR-2020-11-010/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Olaf Hartong, MITRE applicable_platforms: Windows --- - +

CMSTP.exe is the Microsoft Connection Manager Profile Installer, which can be leveraged to setup listeners that will receive and install malware from remote sources in trusted fashion. When CMSTP.exe is seen in combination with an external connection, it is a good indication of this TTP. @@ -37,9 +37,6 @@ When CMSTP.exe is seen in combination with an external connection, it is a good -### Applicable Sensors - - ### Implementations #### Pseudocode - CMSTP (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2020-11-011/index.md b/docs/analytics/CAR-2020-11-011/index.md index 5b0fd83d..756d02c2 100755 --- a/docs/analytics/CAR-2020-11-011/index.md +++ b/docs/analytics/CAR-2020-11-011/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Olaf Hartong applicable_platforms: Windows --- - +

Adversaries may use screensaver files to run malicious code. This analytic triggers on suspicious edits to the screensaver registry keys, which dictate which .scr file the screensaver runs. @@ -36,9 +36,6 @@ Adversaries may use screensaver files to run malicious code. This analytic trigg -### Applicable Sensors - - ### Implementations #### Pseudocode - Screensaver (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2021-01-001/index.md b/docs/analytics/CAR-2021-01-001/index.md index 06f0808e..654d9ed6 100644 --- a/docs/analytics/CAR-2021-01-001/index.md +++ b/docs/analytics/CAR-2021-01-001/index.md @@ -8,7 +8,7 @@ analytic_type: Situational Awareness contributors: Cyware Labs applicable_platforms: Windows, Linux --- - +

After compromising an initial machine, adversaries commonly attempt to laterally move across the network. The first step to attempt the lateral movement often involves conducting host identification, port and service scans on the internal network via the compromised machine using tools such as Nmap, Cobalt Strike, etc. @@ -35,9 +35,6 @@ After compromising an initial machine, adversaries commonly attempt to laterally -### Applicable Sensors - - ### Implementations #### Splunk search - Identifying Internal hosts and services for lateral movement (Splunk, Sysmon native) diff --git a/docs/analytics/CAR-2021-01-002/index.md b/docs/analytics/CAR-2021-01-002/index.md index 1e190d5c..42fddd25 100644 --- a/docs/analytics/CAR-2021-01-002/index.md +++ b/docs/analytics/CAR-2021-01-002/index.md @@ -8,7 +8,7 @@ analytic_type: Anomaly contributors: Cyware Labs applicable_platforms: Windows --- - +

Often, after a threat actor gains access to a system, they will attempt to run some kind of malware to further infect the victim machine. These malware often have long command line strings, which could be a possible indicator of attack. Here, we use sysmon and Splunk to first find the average command string length and search for command strings that stretch over multiple lines, thus identifying anomalies and possibly malicious commands. @@ -35,9 +35,6 @@ Often, after a threat actor gains access to a system, they will attempt to run s -### Applicable Sensors - - ### Implementations #### Splunk search - Identifying possible malware activity via unusually long command line strings (Splunk, Sysmon native) diff --git a/docs/analytics/CAR-2021-01-003/index.md b/docs/analytics/CAR-2021-01-003/index.md index e8abb700..49deaf3b 100644 --- a/docs/analytics/CAR-2021-01-003/index.md +++ b/docs/analytics/CAR-2021-01-003/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Cyware Labs applicable_platforms: Windows --- - +

In an attempt to clear traces after compromising a machine, threat actors often try to clear Windows Event logs. This is often done using “wevtutil”, a legitimate tool provided by Microsoft. This action interferes with event collection and notification, and may lead to a security event going undetected, thereby potentially leading to further compromise of the network. @@ -35,9 +35,6 @@ In an attempt to clear traces after compromising a machine, threat actors often -### Applicable Sensors - - ### Implementations #### Splunk search - Detecting log clearing with wevtutil (Splunk, Sysmon native) diff --git a/docs/analytics/CAR-2021-01-004/index.md b/docs/analytics/CAR-2021-01-004/index.md index b04b8f1d..7aaac00c 100644 --- a/docs/analytics/CAR-2021-01-004/index.md +++ b/docs/analytics/CAR-2021-01-004/index.md @@ -8,7 +8,7 @@ analytic_type: Anomaly contributors: Cyware Labs applicable_platforms: Windows --- - +

After gaining initial access to a system, threat actors attempt to escalate privileges as they may be operating within a lower privileged process which does not allow them to access protected information or carry out tasks which require higher permissions. A common way of escalating privileges in a system is by externally invoking and exploiting spoolsv or connhost executables, both of which are legitimate Windows applications. This query searches for an invocation of either of these executables by a user, thus alerting us of any potentially malicious activity. @@ -35,9 +35,6 @@ After gaining initial access to a system, threat actors attempt to escalate priv -### Applicable Sensors - - ### Implementations #### Splunk search - Unusual Child Process For Spoolsv.exe Or Connhost.exe (Splunk, Sysmon native) diff --git a/docs/analytics/CAR-2021-01-006/index.md b/docs/analytics/CAR-2021-01-006/index.md index 4d079e58..aeb988af 100644 --- a/docs/analytics/CAR-2021-01-006/index.md +++ b/docs/analytics/CAR-2021-01-006/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Cyware Labs applicable_platforms: Windows --- - +

Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution. @@ -35,9 +35,6 @@ Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary com -### Applicable Sensors - - ### Implementations #### Splunk search - Unusual Child Process spawned using DDE exploit (Splunk, Sysmon native) diff --git a/docs/analytics/CAR-2021-01-007/index.md b/docs/analytics/CAR-2021-01-007/index.md index 738383ea..96f4c91b 100644 --- a/docs/analytics/CAR-2021-01-007/index.md +++ b/docs/analytics/CAR-2021-01-007/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Cyware Labs applicable_platforms: Windows --- - +

In an attempt to avoid detection after compromising a machine, threat actors often try to disable Windows Defender. This is often done using “sc” [service control], a legitimate tool provided by Microsoft for managing services. This action interferes with event detection and may lead to a security event going undetected, thereby potentially leading to further compromise of the network. @@ -35,9 +35,6 @@ In an attempt to avoid detection after compromising a machine, threat actors oft -### Applicable Sensors - - ### Implementations #### Splunk search - Detecting Tampering of Windows Defender Command Prompt (Splunk, Sysmon native) diff --git a/docs/analytics/CAR-2021-01-008/index.md b/docs/analytics/CAR-2021-01-008/index.md index 1133c168..6acda7f9 100644 --- a/docs/analytics/CAR-2021-01-008/index.md +++ b/docs/analytics/CAR-2021-01-008/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Cyware Labs applicable_platforms: Windows --- - +

Threat actors often, after compromising a machine, try to disable User Access Control (UAC) to escalate privileges. This is often done by changing the registry key for system policies using “reg.exe”, a legitimate tool provided by Microsoft for modifying the registry via command prompt or scripts. This action interferes with UAC and may enable a threat actor to escalate privileges on the compromised system, thereby allowing further exploitation of the system. @@ -36,9 +36,6 @@ Threat actors often, after compromising a machine, try to disable User Access Co -### Applicable Sensors - - ### Implementations #### Detect disabling of UAC via reg.exe (Splunk, Sysmon native) diff --git a/docs/analytics/CAR-2021-01-009/index.md b/docs/analytics/CAR-2021-01-009/index.md index 99f5d959..da8c6b20 100644 --- a/docs/analytics/CAR-2021-01-009/index.md +++ b/docs/analytics/CAR-2021-01-009/index.md @@ -9,7 +9,7 @@ analytic_type: TTP contributors: Cyware Labs, Lucas Heiligenstein applicable_platforms: Windows --- - +

After compromising a network of systems, threat actors often try to delete/resize Shadow Copy in an attempt to prevent administrators from restoring the systems to versions present before the attack. This is often done via vssadmin, a legitimate Windows tool to interact with shadow copies. This action is often employed by ransomware, may lead to a failure in recovering systems after an attack. The pseudo code detection focus on Windows Security and Sysmon process creation (4688 and 1). The use of wmic to delete shadow copy generates WMI-Activity Operationnal 5857 event and could generate 5858 (if the operation fails). These 2 EventIDs could be interesting when attackers use wmic without process creation and/or for forensics. @@ -36,9 +36,6 @@ After compromising a network of systems, threat actors often try to delete/resiz -### Applicable Sensors - - ### Implementations #### Splunk Search - Detecting Shadow Copy Deletion or Resize (Splunk) diff --git a/docs/analytics/CAR-2021-02-001/index.md b/docs/analytics/CAR-2021-02-001/index.md index 50c101be..99a8ff0c 100644 --- a/docs/analytics/CAR-2021-02-001/index.md +++ b/docs/analytics/CAR-2021-02-001/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Nichols Jasper applicable_platforms: Windows --- - +

A web shell is a web script placed on an openly accessible web server to allow an adversary to use the server as a gatway in a network. As the shell operates, commands will be issued from within the web application into the broader server operating system. This analytic looks for host enumeration executables initiated by any web service that would not normally be executed within that environment. @@ -36,9 +36,6 @@ A web shell is a web script placed on an openly accessible web server to allow a -### Applicable Sensors - - ### Implementations #### Pseudocode - Look for suspicious process tree beginning with web service (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2021-02-002/index.md b/docs/analytics/CAR-2021-02-002/index.md index a0a9dfe2..b19db756 100644 --- a/docs/analytics/CAR-2021-02-002/index.md +++ b/docs/analytics/CAR-2021-02-002/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Sebastien Damaye applicable_platforms: Windows --- - +

Cyber actors frequently escalate to the SYSTEM account after gaining entry to a Windows host, to enable them to carry out various attacks more effectively. Tools such as Meterpreter, Cobalt Strike, and Empire carry out automated steps to "Get System", which is the same as switching over to the System user account. Most of these tools utilize multiple techniques to try and attain SYSTEM: in the first technique, they create a named pipe and connects an instance of cmd.exe to it, which allows them to impersonate the security context of cmd.exe, which is SYSTEM. In the second technique, a malicious DLL is injected into a process that is running as SYSTEM; the injected DLL steals the SYSTEM token and applies it where necessary to escalate privileges. This analytic looks for both of these techniques. @@ -38,9 +38,6 @@ Cyber actors frequently escalate to the SYSTEM account after gaining entry to a -### Applicable Sensors - - ### Implementations #### Pseudocode - Meterpreter and Cobalt Strike (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2021-04-001/index.md b/docs/analytics/CAR-2021-04-001/index.md index 5aa96d0a..791d82ca 100644 --- a/docs/analytics/CAR-2021-04-001/index.md +++ b/docs/analytics/CAR-2021-04-001/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Sebastien Damaye applicable_platforms: Windows --- - +

[Masquerading (T1036)](https://attack.mitre.org/techniques/T1036/) is defined by ATT&CK as follows: "Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names." @@ -61,9 +61,6 @@ To make sure the rule doesn't miss cases where the executable would be started f -### Applicable Sensors - - ### Implementations #### Pseudocode - Common Windows Process Masquerading (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2021-05-001/index.md b/docs/analytics/CAR-2021-05-001/index.md index 7caefa79..6b904bb5 100644 --- a/docs/analytics/CAR-2021-05-001/index.md +++ b/docs/analytics/CAR-2021-05-001/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Splunk Threat Research applicable_platforms: Windows --- - +

Adversaries may add their own root certificate to the certificate store, to cause the web browser to trust that certificate and not display a security warning when it encounters the previously unseen certificate. This action may be the precursor to malicious activity. @@ -36,9 +36,6 @@ Adversaries may add their own root certificate to the certificate store, to caus -### Applicable Sensors - - ### Implementations #### Splunk code (Splunk, Endpoint) diff --git a/docs/analytics/CAR-2021-05-002/index.md b/docs/analytics/CAR-2021-05-002/index.md index ae34fcbf..45d39dba 100644 --- a/docs/analytics/CAR-2021-05-002/index.md +++ b/docs/analytics/CAR-2021-05-002/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Splunk Threat Research applicable_platforms: Windows --- - +

While batch files are not inherently malicious, it is uncommon to see them created after OS installation, especially in the Windows directory. This analytic looks for the suspicious activity of a batch file being created within the C:\Windows\System32 directory tree. There will be only occasional false positives due to administrator actions. @@ -36,9 +36,6 @@ While batch files are not inherently malicious, it is uncommon to see them creat -### Applicable Sensors - - ### Implementations #### Pseudocode – Batch file created in the Windows system32 directory tree (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2021-05-003/index.md b/docs/analytics/CAR-2021-05-003/index.md index bc62a5ff..54242317 100644 --- a/docs/analytics/CAR-2021-05-003/index.md +++ b/docs/analytics/CAR-2021-05-003/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Splunk Threat Research applicable_platforms: Windows --- - +

This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery. @@ -37,9 +37,6 @@ This search looks for flags passed to bcdedit.exe modifications to the built-in -### Applicable Sensors - - ### Implementations #### Pseudocode – detect attempts to add a certificate to a certificate store (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2021-05-004/index.md b/docs/analytics/CAR-2021-05-004/index.md index f7da6c3d..301bea27 100644 --- a/docs/analytics/CAR-2021-05-004/index.md +++ b/docs/analytics/CAR-2021-05-004/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Splunk Threat Research applicable_platforms: Windows --- - +

The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. The query identifies the parameters used to create, resume or add a file to a BITS job. Typically seen combined in a oneliner or ran in sequence. If identified, review the BITS job created and capture any files written to disk. It is possible for BITS to be used to upload files and this may require further network data analysis to identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. @@ -36,9 +36,6 @@ The following query identifies Microsoft Background Intelligent Transfer Service -### Applicable Sensors - - ### Implementations #### Pseudocode – detect a BITS job being scheduled (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2021-05-005/index.md b/docs/analytics/CAR-2021-05-005/index.md index b030749e..1e5ac427 100644 --- a/docs/analytics/CAR-2021-05-005/index.md +++ b/docs/analytics/CAR-2021-05-005/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Splunk Threat Research applicable_platforms: Windows --- - +

The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote object. In addition, look for `download` or `upload` on the command-line, the switches are not required to perform a transfer. Capture any files downloaded. Review the reputation of the IP or domain used. Typically once executed, a follow on command will be used to execute the dropped file. Note that the network connection or file modification events related will not spawn or create from `bitsadmin.exe`, but the artifacts will appear in a parallel process of `svchost.exe` with a command-line similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel and child processes to capture any behaviors and artifacts. In some suspicious and malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. @@ -37,9 +37,6 @@ The following query identifies Microsoft Background Intelligent Transfer Service -### Applicable Sensors - - ### Implementations #### Pseudocode – detect BITS transfer jobs (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2021-05-006/index.md b/docs/analytics/CAR-2021-05-006/index.md index a29e8bbc..3eff2abb 100644 --- a/docs/analytics/CAR-2021-05-006/index.md +++ b/docs/analytics/CAR-2021-05-006/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Splunk Threat Research applicable_platforms: Windows --- - +

Certutil.exe may download a file from a remote destination using `-urlcache`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will be used. It is not entirely common for `certutil.exe` to contact public IP space. However, it is uncommon for `certutil.exe` to write files to world writeable paths.\ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question. @@ -36,9 +36,6 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th -### Applicable Sensors - - ### Implementations #### Pseudocode – CertUtil download (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2021-05-007/index.md b/docs/analytics/CAR-2021-05-007/index.md index 9613f5b4..ff39d9e5 100644 --- a/docs/analytics/CAR-2021-05-007/index.md +++ b/docs/analytics/CAR-2021-05-007/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Splunk Threat Research applicable_platforms: Windows --- - +

Certutil.exe may download a file from a remote destination using `-VerifyCtl`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will be used. It is not entirely common for `certutil.exe` to contact public IP space. \ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question. Using `-VerifyCtl`, the file will either be written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\`. @@ -36,9 +36,6 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T -### Applicable Sensors - - ### Implementations #### Pseudocode – CertUtil download with VerifyCtl (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2021-05-008/index.md b/docs/analytics/CAR-2021-05-008/index.md index a7ab7425..5056e205 100644 --- a/docs/analytics/CAR-2021-05-008/index.md +++ b/docs/analytics/CAR-2021-05-008/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Splunk Threat Research applicable_platforms: Windows --- - +

This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. @@ -36,9 +36,6 @@ This search looks for arguments to certutil.exe indicating the manipulation or e -### Applicable Sensors - - ### Implementations #### Pseudocode – CertUtil certificate extraction (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2021-05-009/index.md b/docs/analytics/CAR-2021-05-009/index.md index 5044d336..9ca808eb 100644 --- a/docs/analytics/CAR-2021-05-009/index.md +++ b/docs/analytics/CAR-2021-05-009/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Splunk Threat Research applicable_platforms: Windows --- - +

CertUtil.exe may be used to `encode` and `decode` a file, including PE and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded file that was downloaded. Once decoded, it will be loaded by a parallel process. Note that there are two additional command switches that may be used - `encodehex` and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for further execution. During triage, identify the source of the file being decoded. Review its contents or execution behavior for further analysis. @@ -36,9 +36,6 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip -### Applicable Sensors - - ### Implementations #### Pseudocode – CertUtil with Decode Argument (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2021-05-010/index.md b/docs/analytics/CAR-2021-05-010/index.md index e5ddb7b5..228547b8 100644 --- a/docs/analytics/CAR-2021-05-010/index.md +++ b/docs/analytics/CAR-2021-05-010/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Splunk Threat Research applicable_platforms: Windows --- - +

This search looks for the creation of local administrator accounts using net.exe. @@ -36,9 +36,6 @@ This search looks for the creation of local administrator accounts using net.exe -### Applicable Sensors - - ### Implementations #### Pseudocode – CertUtil certificate extraction (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2021-05-011/index.md b/docs/analytics/CAR-2021-05-011/index.md index e1691b3d..6e0a2ef1 100644 --- a/docs/analytics/CAR-2021-05-011/index.md +++ b/docs/analytics/CAR-2021-05-011/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Splunk Threat Research applicable_platforms: Windows --- - +

Actors may create a remote thread into the LSASS service as part of a workflow to dump credentials. @@ -35,9 +35,6 @@ Actors may create a remote thread into the LSASS service as part of a workflow t -### Applicable Sensors - - ### Implementations #### Pseudocode – Remote thread creation into LSASS (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2021-05-012/index.md b/docs/analytics/CAR-2021-05-012/index.md index 8a3fb700..e41ae61b 100644 --- a/docs/analytics/CAR-2021-05-012/index.md +++ b/docs/analytics/CAR-2021-05-012/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Splunk Threat Research applicable_platforms: Windows --- - +

This detection is to identify a creation of "user mode service" where the service file path is located in non-common service folder in windows. @@ -36,9 +36,6 @@ This detection is to identify a creation of "user mode service" where the servic -### Applicable Sensors - - ### Implementations #### Pseudocode – Service in Suspicious File Path (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2021-11-001/index.md b/docs/analytics/CAR-2021-11-001/index.md index f0c05873..18eb1c64 100644 --- a/docs/analytics/CAR-2021-11-001/index.md +++ b/docs/analytics/CAR-2021-11-001/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Lucas Heiligenstein applicable_platforms: Windows --- - +

Detection of creation of registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode. The key SafeDllSearchMode, if set to 0, will block the Windows mechanism for the search DLL order and adversaries may execute their own malicious dll. @@ -37,9 +37,6 @@ Detection of creation of registry key HKEY_LOCAL_MACHINE\System\CurrentControlSe -### Applicable Sensors - - ### Implementations #### Creation of SafeDllSearchMode (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2021-11-002/index.md b/docs/analytics/CAR-2021-11-002/index.md index 0c7f8e39..61b22c50 100644 --- a/docs/analytics/CAR-2021-11-002/index.md +++ b/docs/analytics/CAR-2021-11-002/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Lucas Heiligenstein applicable_platforms: Windows --- - +

Detection of modification of the registry key values of `Notify`, `Userinit`, and `Shell` located in `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\` and `HKEY_LOCAL_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\`. When a user logs on, the Registry key values of `Notify`, `Userinit` and `Shell` are used to load dedicated Windows component. Attackers may insert malicious payload following the legitimate value to launch a malicious payload. @@ -37,9 +37,6 @@ Detection of modification of the registry key values of `Notify`, `Userinit`, an -### Applicable Sensors - - ### Implementations #### Userinit/Shell/Notify Registry Modifications (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2021-12-001/index.md b/docs/analytics/CAR-2021-12-001/index.md index c62fc45e..b7078c65 100644 --- a/docs/analytics/CAR-2021-12-001/index.md +++ b/docs/analytics/CAR-2021-12-001/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Lucas Heiligenstein applicable_platforms: Windows --- - +

Detection of the creation or modification of Scheduled Tasks with a suspicious script, extension or user writable path. Attackers may create or modify Scheduled Tasks for the persistent execution of malicious code. This detection focuses at the same time on EventIDs 4688 and 1 with process creation (SCHTASKS) and EventID 4698, 4702 for Scheduled Task creation/modification event log. @@ -35,9 +35,6 @@ Detection of the creation or modification of Scheduled Tasks with a suspicious s -### Applicable Sensors - - ### Implementations #### Creation of Suspicious Scheduled Tasks (Pseudocode, CAR native) diff --git a/docs/analytics/CAR-2021-12-002/index.md b/docs/analytics/CAR-2021-12-002/index.md index 364c51f0..53fcf621 100644 --- a/docs/analytics/CAR-2021-12-002/index.md +++ b/docs/analytics/CAR-2021-12-002/index.md @@ -8,7 +8,7 @@ analytic_type: TTP contributors: Lucas Heiligenstein applicable_platforms: Windows --- - +

Detection of the modification of the registry key `Common Startup` located in `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\` and `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\`. When a user logs on, any files located in the Startup Folder are launched. Attackers may modify these folders with other files in order to evade detection set on these default folders. This detection focuses on EventIDs 4688 and 1 for process creation and EventID 4657 for the modification of the Registry Keys. @@ -37,9 +37,6 @@ Detection of the modification of the registry key `Common Startup` located in `H -### Applicable Sensors - - ### Implementations #### Common Startup Registry Key Modification (Pseudocode, CAR native) diff --git a/docs/analytics/index.md b/docs/analytics/index.md index 031271f8..f148b6c2 100644 --- a/docs/analytics/index.md +++ b/docs/analytics/index.md @@ -821,7 +821,7 @@ permalink: /analytics/