Merge pull request #2964 from splunk/gitlab_release_v4.25.0

Gitlab release v4.25.0
splunk · Feb 22, 2024 · bac4b5b · bac4b5b
2 parents fe1686e + 70a20e7
commit bac4b5b
Show file tree

Hide file tree

Showing 49 changed files with 1,719 additions and 731 deletions.
diff --git a/contentctl b/contentctl
diff --git a/contentctl.yml b/contentctl.yml
@@ -6,7 +6,7 @@ build:
   path_root: dist
   prefix: ESCU
   build: 004210
-  version: 4.24.0
+  version: 4.25.0
   label: ES Content Updates
   author_name: Splunk Threat Research Team
   author_email: research@splunk.com
@@ -20,6 +20,6 @@ build_ssa:
 build_api:
   path_root: 'dist/api'
 enrichments:
-  attack_enrichment: true
-  cve_enrichment: true
+  attack_enrichment: false
+  cve_enrichment: false
   splunk_app_enrichment: false
diff --git a/detections/endpoint/connectwise_screenconnect_path_traversal.yml b/detections/endpoint/connectwise_screenconnect_path_traversal.yml
@@ -0,0 +1,57 @@
+name: ConnectWise ScreenConnect Path Traversal
+id: 56a3ac65-e747-41f7-b014-dff7423c1dda
+version: 1
+date: '2024-02-21'
+author: Michael Haag, Splunk
+data_source:
+- Sysmon Event ID 11
+type: TTP
+status: production
+description: This analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1708 vulnerability, which allows an attacker to perform path traversal attacks by manipulating the file_path and file_name parameters in the URL. The vulnerability, identified as critical with a CVSS score of 9.8, enables unauthorized users to access sensitive files and directories on the host system, potentially leading to the exfiltration of sensitive data or the execution of arbitrary code. The search query provided looks for file system events that could indicate exploitation attempts. This detection is crucial for identifying and responding to active exploitation of this vulnerability in environments running affected versions of ScreenConnect (23.9.7 and prior). It is recommended to update to version 23.9.8 or above immediately to remediate the issue, as detailed in the ConnectWise security advisory and further analyzed by Huntress researchers.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\ScreenConnect\\App_Extensions\\*") Filesystem.file_name IN ("*.aspx","*.ashx") by Filesystem.file_create_time Filesystem.process_id Filesystem.process_guid Filesystem.file_name Filesystem.file_path Filesystem.dest
+  | `drop_dm_object_name(Filesystem)`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `connectwise_screenconnect_path_traversal_filter`'
+how_to_implement: This analytic utilizes the Endpoint datamodel Filesystem node to identify path traversal attempts against ScreenConnect. Note that using SACL auditing or other file system monitoring tools may also be used to detect path traversal attempts. Typically the data for this analytic will come from EDR or other properly CIM mapped data sources.
+known_false_positives: False positives are not expected, as the detection is based on the presence of file system events that indicate path traversal attempts. The analytic may be modified to look for any file writes to this path as it is not common for files to write here.
+references:
+- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
+- https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
+- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
+tags:
+  analytic_story:
+  - ConnectWise ScreenConnect Vulnerabilities
+  asset_type: Endpoint
+  confidence: 100
+  impact: 100
+  message: A path traversal attack against ScreenConnect has been detected on $dest$.
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - Filesystem.file_create_time
+  - Filesystem.process_id
+  - Filesystem.process_guid
+  - Filesystem.file_name
+  - Filesystem.file_path
+  - Filesystem.dest
+  risk_score: 100
+  security_domain: endpoint
+  cve:
+  - CVE-2024-1708
+  - CVE-2024-1709 
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/screenconnect/sysmon_app_extensions.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
diff --git a/detections/endpoint/connectwise_screenconnect_path_traversal_windows_sacl.yml b/detections/endpoint/connectwise_screenconnect_path_traversal_windows_sacl.yml
@@ -0,0 +1,61 @@
+name: ConnectWise ScreenConnect Path Traversal Windows SACL
+id: 4e127857-1fc9-4c95-9d69-ba24c91d52d7
+version: 1
+date: '2024-02-21'
+author: Michael Haag, Splunk
+data_source:
+- Windows Security 4663
+type: TTP
+status: production
+description: This analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1708 vulnerability utilizing Windows SACL EventCode 4663, which allows an attacker to perform path traversal attacks by manipulating the file_path and file_name parameters in the URL. The vulnerability, identified as critical with a CVSS score of 9.8, enables unauthorized users to access sensitive files and directories on the host system, potentially leading to the exfiltration of sensitive data or the execution of arbitrary code. The search query provided looks for file system events that could indicate exploitation attempts. This detection is crucial for identifying and responding to active exploitation of this vulnerability in environments running affected versions of ScreenConnect (23.9.7 and prior). It is recommended to update to version 23.9.8 or above immediately to remediate the issue, as detailed in the ConnectWise security advisory and further analyzed by Huntress researchers.
+search: '`wineventlog_security` EventCode=4663  ProcessName=*\\ScreenConnect.Service.exe file_path IN ("*\\ScreenConnect\\App_Extensions\\*") file_name IN ("*.aspx","*.ashx")
+  | stats count min(_time) as firstTime max(_time) as lastTime by  ObjectName ObjectType ProcessName AccessMask process_id EventCode Computer Caller_User_Name 
+  | rename Computer as dest Caller_User_Name as user ProcessName as process_name
+  |  `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `connectwise_screenconnect_path_traversal_windows_sacl_filter`'
+how_to_implement: To implement the following query, enable SACL auditing for the ScreenConnect directory(ies). With this data, the following analytic will work correctly. A GIST is provided in the references to assist with enabling SACL Auditing.
+known_false_positives: False positives should be limited as the analytic is specific to ScreenConnect path traversal attempts. Tune as needed, or restrict to specific hosts if false positives are encountered.
+references:
+- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
+- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
+- https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
+- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
+tags:
+  analytic_story:
+  - ConnectWise ScreenConnect Vulnerabilities
+  asset_type: Endpoint
+  confidence: 100
+  impact: 100
+  message: A path traversal attack against ScreenConnect has been detected on $dest$.
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - ObjectName
+  - ObjectType
+  - ProcessName
+  - AccessMask
+  - process_id
+  - EventCode
+  - Computer
+  - Caller_User_Name
+  risk_score: 100
+  security_domain: endpoint
+  cve:
+  - CVE-2024-1708
+  - CVE-2024-1709 
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/screenconnect/4663_connectwise_aspx_app_extensions.log
+    sourcetype: XmlWinEventLog
+    source: XmlWinEventLog:Security
diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml
@@ -42,6 +42,7 @@ tags:
   - Suspicious Regsvcs Regasm Activity
   - Living Off The Land
   - DarkGate Malware
+  - Snake Keylogger
   asset_type: Endpoint
   confidence: 80
   impact: 80

diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml
@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - XMRig
   - Phemedrone Stealer
+  - Snake Keylogger
   asset_type: Endpoint
   confidence: 70
   impact: 70

diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
@@ -70,6 +70,7 @@ tags:
   - LockBit Ransomware
   - CISA AA23-347A
   - Data Destruction
+  - Snake Keylogger
   asset_type: Endpoint
   confidence: 50
   impact: 40

diff --git a/detections/endpoint/high_process_termination_frequency.yml b/detections/endpoint/high_process_termination_frequency.yml
@@ -29,6 +29,7 @@ tags:
   - LockBit Ransomware
   - BlackByte Ransomware
   - Rhysida Ransomware
+  - Snake Keylogger
   asset_type: Endpoint
   confidence: 80
   impact: 90

diff --git a/detections/endpoint/linux_edit_cron_table_parameter.yml b/detections/endpoint/linux_edit_cron_table_parameter.yml
@@ -23,7 +23,7 @@ description: 'The following analytic detects the suspicious editing of cron jobs
   Known false positives could stem from valid administrative tasks or automation processes
   using crontab. To reduce these, fine-tune the filter macros according to the benign
   activities within your environment. These adjustments ensure legitimate actions
-  aren''t mistaken for threats, allowing analysts to focus on genuine potential risks.\'
+  aren''t mistaken for threats, allowing analysts to focus on genuine potential risks.'
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)

diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
@@ -38,6 +38,7 @@ tags:
   - AgentTesla
   - CISA AA23-347A
   - Phemedrone Stealer
+  - Snake Keylogger
   asset_type: Endpoint
   confidence: 70
   impact: 50

diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
@@ -39,6 +39,7 @@ tags:
   - AgentTesla
   - CISA AA23-347A
   - Phemedrone Stealer
+  - Snake Keylogger
   asset_type: Endpoint
   confidence: 70
   impact: 50

diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml
@@ -40,6 +40,7 @@ tags:
   - DHS Report TA18-074A
   - Azorult
   - Volt Typhoon
+  - Snake Keylogger
   asset_type: Endpoint
   confidence: 70
   impact: 20

diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml
@@ -74,6 +74,7 @@ tags:
   - Amadey
   - BlackByte Ransomware
   - CISA AA23-347A
+  - Snake Keylogger
   asset_type: Endpoint
   confidence: 95
   impact: 80

diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/endpoint/suspicious_driver_loaded_path.yml
@@ -34,6 +34,7 @@ tags:
   - CISA AA22-320A
   - AgentTesla
   - BlackByte Ransomware
+  - Snake Keylogger
   asset_type: Endpoint
   confidence: 90
   impact: 70

diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml
@@ -35,6 +35,7 @@ tags:
   - WhisperGate
   - Remcos
   - Phemedrone Stealer
+  - Snake Keylogger
   asset_type: Endpoint
   confidence: 80
   impact: 80

diff --git a/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml b/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml
@@ -39,6 +39,7 @@ tags:
   - Unusual Processes
   - Amadey
   - Remcos
+  - Snake Keylogger
   asset_type: Endpoint
   confidence: 20
   impact: 80

diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml
@@ -33,6 +33,7 @@ tags:
   - NjRAT
   - DarkGate Malware
   - Phemedrone Stealer
+  - Snake Keylogger
   asset_type: Endpoint
   confidence: 50
   impact: 50

diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml
@@ -33,6 +33,7 @@ tags:
   - NjRAT
   - DarkGate Malware
   - Phemedrone Stealer
+  - Snake Keylogger
   asset_type: Endpoint
   confidence: 70
   impact: 70

diff --git a/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml b/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml
@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - AgentTesla
+  - Snake Keylogger
   asset_type: Endpoint
   confidence: 30
   impact: 30

diff --git a/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml b/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml
@@ -1,7 +1,7 @@
 name: Windows Gather Victim Network Info Through Ip Check Web Services
 id: 70f7c952-0758-46d6-9148-d8969c4481d1
-version: 1
-date: '2022-06-21'
+version: 2
+date: '2024-02-15'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
@@ -10,13 +10,15 @@ description: The following analytic identifies process that attempts to connect
   to perform reconnaissance against the infected machine and look for its IP address.
 data_source:
 - Sysmon Event ID 22
-search: '`sysmon` EventCode=22  QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com",
-  "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb",
-  "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org",
-  "*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net", "*iplogger.org*", "*ip-api.com*")
-  |  stats  min(_time) as firstTime max(_time) as lastTime count by  Image ProcessId
-  QueryName QueryStatus QueryResults EventCode Computer | rename Computer as dest| `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `windows_gather_victim_network_info_through_ip_check_web_services_filter`'
+search: '`sysmon` EventCode=22  QueryName IN ("*wtfismyip.com", "*checkip.*", "*ipecho.net", "*ipinfo.io", 
+  "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", 
+  "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org", "*dnsbl-1.uceprotect.net", 
+  "*spam.dnsbl.sorbs.net", "*iplogger.org*", "*ip-api.com*", "*geoip.*") 
+  |  stats  min(_time) as firstTime max(_time) as lastTime count by  Image ProcessId QueryName QueryStatus QueryResults EventCode Computer 
+  | rename Computer as dest
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_gather_victim_network_info_through_ip_check_web_services_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, dns query name process path , and query ststus from
   your endpoints like EventCode 22. If you are using Sysmon, you must have at least
@@ -30,6 +32,7 @@ tags:
   - Azorult
   - DarkCrystal RAT
   - Phemedrone Stealer
+  - Snake Keylogger
   asset_type: Endpoint
   confidence: 50
   impact: 50

diff --git a/detections/endpoint/windows_non_discord_app_access_discord_leveldb.yml b/detections/endpoint/windows_non_discord_app_access_discord_leveldb.yml
@@ -0,0 +1,61 @@
+name: Windows Non Discord App Access Discord LevelDB
+id: 1166360c-d495-45ac-87a6-8948aac1fa07
+version: 1
+date: '2024-02-16'
+author: Teoderick Contreras, Splunk
+data_source:
+- Windows Security 4663
+type: Anomaly
+status: production
+description: The following analytic detects suspicious file access within the Discord LevelDB database. 
+  This database contains critical data such as user profiles, messages, guilds, channels, settings, and cached information. 
+  Access to this data poses a risk of Discord credential theft or unauthorized access to sensitive information on the 
+  compromised system. Detecting such anomalies can serve as an effective pivot to identify non-Discord applications 
+  accessing this database, potentially indicating the presence of malware or trojan stealers aimed at data theft.
+search: '`wineventlog_security` EventCode=4663 object_file_path IN ("*\\discord\\Local Storage\\leveldb*") 
+  AND process_name != *\\discord.exe AND NOT (process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWow64\\*", "*:\\Program Files*", "*:\\Windows\\*"))
+  | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path  process_id EventCode dest 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_non_discord_app_access_discord_leveldb_filter`'
+how_to_implement: To successfully implement this search, you must ingest Windows Security
+  Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
+  Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+known_false_positives: unknown
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger
+tags:
+  analytic_story:
+  - Snake Keylogger
+  asset_type: Endpoint
+  confidence: 30
+  impact: 30
+  message: A non-discord process $process_name$ accessing discord "leveldb" file on $dest$
+  mitre_attack_id:
+  - T1012
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - object_file_name
+  - object_file_path
+  - process_name
+  - process_path
+  - process_id
+  - EventCode
+  - dest
+  risk_score: 9
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/snakey_keylogger_outlook_reg_access/snakekeylogger_4663.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
diff --git a/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml b/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml
@@ -37,6 +37,7 @@ references:
 tags:
   analytic_story:
   - Spearphishing Attachments
+  - Snake Keylogger
   asset_type: Endpoint
   confidence: 80
   impact: 80

diff --git a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml
@@ -40,6 +40,7 @@ tags:
   analytic_story:
   - Windows Post-Exploitation
   - Prestige Ransomware
+  - Snake Keylogger
   asset_type: Endpoint
   confidence: 30
   impact: 30