Watch Principal Threat Researcher, Michael Haag, provide an overview of:  11 new analytic stories developed by the Splunk Threat Research Team in Q2 (May - July) related to adversary tradecraft, ransomware, and emerging threats A new machine learning detection A new Splunk SOAR hunting playbook   Check out these other great resources to learn more about security content released in Q2:  Amadey Threat Analysis and Detections  Don’t Get a PaperCut: Analyzing CVE-2023-27350 I am the Snake Now: Analysis of Snake Malware Do Not Cross the ‘RedLine’ Stealer: Detections and Analysis Machine Learning in Security: Detect DNS Data Exfiltration Using Deep Learning  Threat Hunting with Playbooks  ... View more

In the last month, the Splunk Threat Research Team (STRT) has had 4 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.8.0, v4.9.0, v4.10.0 and v4.11.1). With these releases, there are 24 new detections, 27 updated detections and 8 new analytic stories now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include:  An analytic story with detections related to known activities of the group Flax Typhoon Detections for organizations using Adobe ColdFusion related to critical vulnerabilities CVE-2023-29298 and CVE-2023-26360 Detection for critical vulnerability Ivanti Sentry (CVE-2023-38035) An analytic story to detect suspicious activities potentially related to Ave Maria (aka Warzone) RAT Updated detections related to Azure Active Directory  New detections for Windows Certificate Services and Active Directory Discovery  Updated detections for Clop ransomware variants  An analytic story related Citrix ShareFile RCE CVE-2023-24489 Detections for zero-day vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) CVE-2023-35078 and CVE-2023-35082. A new analytic for hunting events associated with Splunk Vulnerability Disclosure SVD-2023-0606 in which an attacker can use a specially crafted web URL in their browser to cause log file injection. The attack inserts American National Standards Institute (ANSI) escape codes into specific files using a terminal program that supports those escape codes. The attack requires a terminal program that supports the translation of ANSI escape codes and requires additional user interaction to execute successfully.  New Analytic Stories:  Juniper JunOS Remote Code Execution Flax Typhoon Windows Error Reporting Service Elevation of Privilege Vulnerability Ivanti Sentry Authentication Bypass CVE-2023-38035 Adobe ColdFusion Arbitrary Code Execution CVE-2023-29298 & CVE-2023-26360 Warzone RAT Ivanti EPMM Remote Unauthenticated Access Citrix ShareFile RCE CVE-2023-24489 New Detections:  Juniper Networks Remote Code Execution Exploit Detection Windows SQL Spawning CertUtil Ivanti Sentry Authentication Bypass Adobe ColdFusion Access Control Bypass Adobe ColdFusion Unauthenticated Arbitrary File Read Splunk DOS via printf search function Windows Bypass UAC via Pkgmgr Tool Windows Mark of The Web Bypass Windows Modify Registry MaxConnectionPerServer Windows Unsigned DLL Side-Loading Detect Certify Command Line Arguments (External Contributor @nterl0k) Detect Certify with PowerShell Script Block Logging (External Contributor @nterl0k) Windows Steal Authentication Certificates - ESC1 Authentication (External Contributor @nterl0k) Windows Suspect Process with Authentication Traffic (External Contributor @nterl0k) Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078 Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082 Citrix ShareFile Exploitation CVE-2023-24489 Windows Powershell RemoteSigned File PowerShell Script Block With URL Chain (External contributor: Steven Dick) PowerShell WebRequest Using Memory Stream (External contributor: Steven Dick) Suspicious Process Executed From Container File (External contributor: Steven Dick) Windows Registry Payload Injection (External contributor: Steven Dick) Windows Scheduled Task Service Spawned Shell (External contributor: Steven Dick Splunk Unauthenticated Log Injection Web Service Log Updated Detections:  Azure AD Global Administrator Role Assigned Azure AD Multiple Users Failing to Authenticate from IP Azure AD Service Principal Owner Added Azure AD Unusual Number of Failed Authentications from IP Azure AD Service Principal Created Azure AD Privileged Role Assigned Azure AD Privileged Authentication Administrator Role Assigned Azure AD Application Administrator Role Assigned Azure AD Multi-Factor Authentication Disabled Azure AD External Guest User Invited Azure AD User Enabled and Password Reset Azure AD Service Principal New Client Credentials Azure AD New Federated Domain Added Azure AD New Custom Domain Added Azure AD Successful Single-Factor Authentication Azure AD Authentication Failed During MFA Challenge Azure AD Successful PowerShell Authentication Azure AD Multiple Failed MFA Requests for User Azure AD User Immutable ID Attribute Updated Azure Active Directory High Risk Sign-in Unusually Long Command Line Suspicious Copy on System32 Clop Common Exec Parameter (External contributor: DipsyTipsy) O365 Added Service Principal O365 New Federated Domain Added O365 Excessive SSO logon errors Splunk risky Command Abuse disclosed February 2023 For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team ... View more

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.6.0 and v4.7.0). With these releases, there are 8 new detections, 16 updated detections and 7 new analytic stories now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include:  New searches that focus on potential malicious activities related to suspicious registry modification of Windows and malicious command line behavior, including potential exploitation attempts against Citrix ADC A new analytic story for the detection and investigation of unusual activities that relate to BlackByte ransomware Detections for CVE-2023-36884, an unpatched zero-day vulnerability affecting Windows and Microsoft Office products, and CVE-2023-3519, a vulnerability in NetScaler (formerly Citrix) Application Delivery Controller (ADC) and NetScaler Gateway A new analytic story to detect task scheduling activities related to MITRE ATT&CK technique T1053 New searches to detect activities related to Amadey, a type of malware that primarily operates as a banking Trojan  Detections for potential exploitation attempts against VMware vRealize Network Insight that align with the characteristics of CVE-2023-20887 New Analytic Stories:  BlackByte Ransomware CVE-2023-36884 Office and Windows HTML RCE Vulnerability Citrix Netscaler ADC CVE-2023-3519 Scheduled Tasks Amadey Graceful Wipe Out Attack VMware Aria Operations vRealize / CVE-2023-20887 New Detections:  Windows Modify Registry EnableLinkedConnections Windows Modify Registry LongPathsEnabled Windows Modify Registry Risk Behavior Windows Post Exploitation Risk Behavior Windows Common Abused Cmd Shell Risk Behavior Citrix ADC Exploitation CVE-2023-3519 Windows PowerShell ScheduleTask Windows Files and Dirs Access Rights Modification Via Icacls Updated Detections:  O365 Add App Role Assignment Grant User MSHTML Module Load in Office Product Office Document Spawned Child Process To Download Office Product Spawn CMD Process Office Product Spawning BITSAdmin Office Product Spawning CertUtil Office Product Spawning MSHTA Office Product Spawning Rundll32 with no DLL Office Product Spawning Windows Script Host ICACLS Grant Command Registry Keys Used For Persistence PowerShell 4104 Hunting Detect Baron Samedit CVE-2021-3156 Segfault Detect Baron Samedit CVE-2021-3156 Windows System Shutdown CommandLine VMWare Aria Operations Exploit Attempt The team has also published the following blogs: Amadey Threat Analysis and Detections I am the Snake Now: Analysis of Snake Malware For all our tools and security content, please visit research.splunk.com.  — The Splunk Threat Research Team   ... View more

The Snake implant is a highly advanced cyber espionage tool, developed and employed by Russia's Federal Security Service's (FSB) Center 16 for persistent intelligence gathering on important targets. They established a clandestine global peer-to-peer network of Snake-infected computers to carry out operations. This network includes relay nodes that facilitate encrypted and fragmented traffic between Snake implants and FSB's targets, designed to evade detection and data collection. Snake infrastructure has been identified in over 50 countries across all continents, including the US and Russia. While its infrastructure spans all sectors, Snake's targeting is tactical and intentional. FSB has leveraged Snake globally to extract sensitive intelligence from key targets like government networks, research establishments, and journalists. For instance, they used Snake to access and leak confidential diplomatic documents from a victim in a NATO country. Within the US, FSB has targeted sectors such as education, small businesses, media, government facilities, financial services, critical manufacturing, and communications. For more information on FSB and Russian state-sponsored cyber activity, please see the joint advisory Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure and CISA’s Russia Cyber Threat Overview and Advisories webpage. This blog provides an overview of the process the Splunk Threat Research Team used to develop Atomic Simulations with ChatGPT based on the indicators provided in the report and simulate the activity. It also provides an overview of new security content developed to identify adversaries. You can find a more detailed outline of how the team utilized ChatGPT to develop Atomic Simulations in the attached document.    Leveraging IOCs to Build Atomic Simulations and Content Within the report there are 4 main Host-Based Detections described in plain English, however no malicious samples were provided. The Splunk Threat Research Team looked at each as if they were software requirements and prompted ChatGPT to build Atomic Simulations which met these requirements. Note that most of our interactions with ChatGPT were conversational - we did not typically accept the first response from ChatGPT, but worked with it to refine the result until we had something that more closely aligns with the requirement.  After development, we tested the Atomic Simulations using Splunk Attack Range, an easy-to-use and open source tool that can automatically configure and deploy a full Splunk Environment, including endpoints, in minutes. Attack Range is the perfect tool for simulating and understanding attacks since it forwards log data to a Splunk instance out-of-the-box.   Below is a breakdown of each host-based detection and corresponding indicators, Atomic Simulation, and resulting security content. Registry Blob Indicators of Compromise: The registry blob is generally found at the location listed below. If it is not present at its typical location, the registry blob can be found by searching the full registry for a value of at least 0x1000 bytes in size and entropy of at least 7.9.  Typical Name: Unknown (RegBlob)  Typical Path: HKLM\SOFTWARE\Classes\.wav\OpenWithProgIds  Characteristics: High Entropy The final result in the Atomic Red Team page T1112: With Invoke-AtomicRedTeam, we ran this simulation Invoke-AtomicTest T1112 -TestNumbers 56 -showdetailsbrief Invoke-AtomicTest T1112 -TestNumbers 56 Splunk security content: Windows Snake Malware Registry Modification wav OpenWithProgIds This analytic identifies the registry being modified at .wav\OpenWithProgIds\, which is related to the Snake Malware campaign. Upon execution, Snake's WerFault.exe will attempt to decrypt an encrypted blob within the Windows registry that is typically found at HKLM:\SOFTWARE\Classes.wav\OpenWithProgIds. The encrypted data includes the AES key, IV, and path that is used to find and decrypt the file containing Snake's kernel driver and kernel driver loader. | tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\.wav\\OpenWithProgIds\\*"  by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name  | `security_content_ctime(lastTime)`  | `security_content_ctime(firstTime)`  | `drop_dm_object_name(Registry)`    Queue File The next host-based indicator provided in the report was the queue file, which is described as “The last host-based artifact to discuss is the Queue File. Typically, this file has been found within the %windows%\Registration directory with the format of .crmlog, and is decrypted by Snake’s kernel driver. Due to the complexity and importance of the Queue File, its details are discussed at length in the following subsection.”   Indicator of compromise: Typical Name: < RANDOM_GUID >..crmlog  Typical Path: %windows\registration\  Unique Characteristics: High Entropy, file attributes of hidden, system, and archive  Role: Snake Queue File Atomic Red Team test, T1027 test number 9, simulates the activity. Running the following with Invoke-AtomicTest: Invoke-AtomicTest T1027 -testnumbers 9 -ShowDetails Invoke-AtomicTest T1027 -testnumbers 9 Splunk security content: Windows Snake Malware File Modification Crmlog This analytic identifies a .crmlog written to windows\registration. Per the report, typically, this file has been found within the %windows%\Registration directory with the format of <RANDOM_GUID>.<RANDOM_GUID>.crmlog and is decrypted by Snake's kernel driver. | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\windows\\registration\\*" AND  Filesystem.file_name="*.crmlog"  by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.file_path Filesystem.dest  | `drop_dm_object_name(Filesystem)`  | `security_content_ctime(firstTime)`  | `security_content_ctime(lastTime)` Comadmin Per the CISA report, Snake’s installer drops the kernel driver and a custom DLL which is used to load the driver into a single AES encrypted file on disk. Typically, this file is named “comadmin.dat” and is stored in the %windows%\system32\Com directory. The STRT took this as part of the requirement that we shared with ChatGPT to generate this behavior.  Indicator of compromise: Typical Name: comadmin.dat  Typical Path: %windows%\system32\Com  Unique Characteristics: High Entropy  Role: Houses Snake’s kernel driver and the driver’s loader The Atomic Test is under T1547.006 and may be simulated with the following command: Invoke-AtomicTest T1547.006 -TestNumbers 4 Invoke-AtomicTest T1547.006 -TestNumbers 4 -ShowDetails Invoke-AtomicTest T1547.006 -TestNumbers 4 Splunk security content: Windows Snake Malware Kernel Driver Comadmin This analytic identifies the comadmin.dat file written to disk, which is related to Snake Malware. From the report, Snake's installer drops the kernel driver and a custom DLL which is used to load the driver into a single AES encrypted file on disk. Typically, this file is named comadmin.dat and is stored in the %windows%\system32\Com directory. | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\windows\\system32\\com\\*" AND Filesystem.file_name="comadmin.dat"  by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.file_path Filesystem.dest  | `drop_dm_object_name(Filesystem)`  | `security_content_ctime(firstTime)`  | `security_content_ctime(lastTime)`    Werfault  Indicator of compromise: Typical Name: Werfault.exe  Typical Path: %windows%\WinSxS\x86_microsoft-windowserrorreportingfaults_31bf3856ad364e35_4.0.9600.16384_none_a13f7e283339a0502\  Unique Characteristics: Icon is different than that of a valid Windows Werfault.exe file  Role: Persistence mechanism We used the EventID 7045 to develop the analytics that monitor service creations. The Snake malware was found to register a service located in the WinSxS path with a specific name. Holistically, it’s best to monitor for any new service creations across the fleet and monitor for non-standard paths or binary names.    Splunk security content: Windows Service Created with Suspicious Service Path `wineventlog_system` EventCode=7045  ImagePath = "*\\*.exe" NOT (ImagePath IN ("*:\\Windows\\*", "*:\\Program File*", "*:\\Programdata\\*", "*%systemroot%\\*"))  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ImagePath ServiceName StartType ServiceType dest  | `security_content_ctime(firstTime)`  | `security_content_ctime(lastTime)` This analytic identifies the creation of a new service that does not occur within these directories (":\Windows\", ":\Program File", ":\Programdata\", "%systemroot%\"). For Snake malware, it would create its service in the WinSxS path, which is uncommon. Windows Snake Malware Service Create For Snake malware, we created a more precise analytic based on the Snake behaviors outlined in the report and what we created during our simulation. `wineventlog_system` EventCode=7045  ImagePath="*\\windows\\winSxS\\*" ImagePath="*\Werfault.exe"  | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ImagePath ServiceName ServiceType  | `security_content_ctime(firstTime)`  | `security_content_ctime(lastTime)`    Why Should You Care? This security content enables Splunk customers to identify Snake Malware and the process outline helps the community understand how LLM tools like ChatGPT can recreate endpoint artifacts without malicious software samples. By understanding the behaviors, the Splunk Threat Research Team was able to generate telemetry and datasets to develop and test Splunk detections designed to defend and respond against this threat. Learn More You can find the latest content about security analytic stories on GitHub and in Splunkbase. Splunk Security Essentials also has all these detections available via push update.  For a full list of security content, check out the release notes on Splunk Docs. Feedback Any feedback or requests? Feel free to put in an issue on GitHub and we’ll follow up. Alternatively, join us on the Slack channel #security-research. Follow these instructions if you need an invitation to our Splunk user groups on Slack. Contributors We would like to thank Michael Haag,  Eric McGinnis and Teoderick Contreras for authoring this document and the entire Splunk Threat Research Team for their contributions: Mauricio Velazco, Lou Stella, Bhavin Patel, Rod Soto, and Patrick Bareiss. ... View more

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.3.0, v4.4.0, and v4.5.0). With these releases, there are 27 new detections and 2 new analytic stories, and 1 updated analytic story now available in Splunk Enterprise Security via the ESCU application update process or via Splunk Security Essentials (SSE). Content highlights include:  Detections to help address the vulnerability in MOVEit Transfer software that is being actively exploited in the wild  An advanced pre-trained deep learning model specifically engineered to discern and pinpoint instances of DNS-based exfiltration to accurately detect and flag potential data breaches or unauthorized information transfers New and updated searches to detect living-off-the-land techniques being utilized by the threat actor group Volt Typhoon  New Analytic Stories:  MOVEit Transfer Critical Vulnerability Volt Typhoon New Detections:  ASL AWS Concurrent Sessions From Different Ips ASL AWS CreateAccessKey ASL AWS Defense Evasion Delete Cloudtrail ASL AWS Defense Evasion Delete CloudWatch Log Group ASL AWS Defense Evasion Impair Security Services ASL AWS Excessive Security Scanning ASL AWS IAM Delete Policy ASL AWS Multi-Factor Authentication Disabled ASL AWS New MFA Method Registered For User ASL AWS Password Policy Changes Detect DNS Data Exfiltration using pretrained model in DSDL Detect RTLO In File Name  Detect RTLO In Process  Detect Webshell Exploit Behavior  Windows MOVEit Transfer Writing ASPX Splunk DOS Via Dump SPL Command Splunk Edit User Privilege Escalation Splunk HTTP Response Splitting Via Rest SPL Command Splunk Low Privilege User Can View Hashed Splunk Password Splunk Path Traversal In Splunk App For Lookup File Editing Splunk Persistent XSS Via URL Validation Bypass W Dashboard Splunk RBAC Bypass On Indexing Preview REST Endpoint Network Share Discovery Via Dir Command Active Directory Privilege Escalation Identified Windows Ldifde Directory Object Behavior Windows Proxy Via Netsh Windows Proxy Via Registry Updated Analytic Story: Splunk Vulnerabilities For all our tools and security content, please visit research.splunk.com.  The team has also published the following blogs in the last month: Don’t Get a PaperCut: Analyzing CVE-2023-27350 Do Not Cross the ‘RedLine’ Stealer: Detections and Analysis  Splunk Security Content for Threat Detection & Response - Q1 Roundup Security Content from the Splunk Threat Research Team — The Splunk Threat Research Team ... View more

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.1.0 and v4.2.0). With these releases, there are 61 new detections and 6 new analytic stories now available in Splunk Enterprise Security via the ESCU application update process or via Splunk Security Essentials (SSE). Content highlights include:  Azure Active Directory Privilege Escalation and AWS Exfiltration detections that help detect various new techniques used to gain higher-level permissions or exfiltrate data on systems Detections to search for Snake Malware, a sophisticated espionage tool from Russia’s Federal Security Service (FSB), and its variants Active Directory Privilege Escalations detections to detect techniques that adversaries use to gain higher-level permissions on a system or network that leverage Active Directory Detections to search for adversaries leveraging RedLine Stealer malware Windows Registry bootkit detections  Remote Code Execution (RCE) detections in a commonly used printing software called PaperCut New Analytic Stories:  Azure Active Directory Privilege Escalation PaperCut MF NG Vulnerability Snake Malware Windows BootKits Active Directory Privilege Escalation RedLine Stealer New Detections:  AWS AMI Attribute Modification for Exfiltration AWS Disable Bucket Versioning AWS EC2 Snapshot Shared Externally AWS Exfiltration via Anomalous GetObject API Activity AWS Exfiltration via Batch Service AWS Exfiltration via Bucket Replication AWS Exfiltration via DataSync Task AWS Exfiltration via EC2 Snapshot AWS S3 Exfiltration Behavior Identified Azure AD Application Administrator Role Assigned Azure AD Global Administrator Role Assigned Azure AD PIM Role Assigned Azure AD PIM Role Assignment Activated Azure AD Privileged Authentication Administrator Role Assigned Azure AD Privileged Role Assigned to Service Principal Azure AD Service Principal Owner Added PaperCut Remote Web Access Attempt PaperCut Suspicious Behavior Debug Log Windows PaperCutNG Spawn Shell Windows Registry Bootexecute Modification Windows Snake Malware File Modification Crmlog Windows Snake Malware Kernel Driver Comadmin Windows Snake Malware Registry Modification Wav OpenWithProgids Windows Snake Malware Service Create Windows Winlogon with Public Network Connection Active Directory Lateral Movement Identified Impacket Lateral Movement smbexec CommandLine Parameters Impacket Lateral Movement WMIExec CommandLine Parameters Steal or Forge Authentication Certificates Behavior Identified Windows Administrative Shares Accessed on Multiple Hosts Windows Admon Default Group Policy Object Modified Windows Admon Group Policy Object Created Windows Credentials from Password Stores Chrome Extension Access Windows Credentials from Password Stores Chrome Local State Access Windows Credentials from Password Stores Chrome Login Data Access Windows Default Group Policy Object Modified Windows Default Group Policy Object Modified with GPME Windows DnsAdmins New Member Added Windows File Share Discovery with Powerview Windows Findstr GPP Discovery Windows Group Policy Object Created Windows Large Number of Computer Service Tickets Requested Windows Local Administrator Credential Stuffing Windows Modify Registry Auto Minor Updates Windows Modify Registry Auto Update Notif Windows Modify Registry Disable WinDefender Notifications Windows Modify Registry Do Not Connect to Win Update Windows Modify Registry No Auto Reboot with Logon User Windows Modify Registry No Auto Update Windows Modify Registry Tamper Protection Windows Modify Registry UpdateServiceUrlAlternate Windows Modify Registry UseWuServer Windows Modify Registry WuServer Windows Modify Registry WuStatusServer Windows PowerSploit GPP Discovery Windows PowerView AD Access Control List Enumeration Windows Query Registry Browser List Application Windows Query Registry UnInstall Program List Windows Rapid Authentication on Multiple Hosts Windows Service Stop Win Updates Windows Special Privileged Logon on Multiple Hosts The team has also published the following blogs in the last month: Threat Update: AwfulShred Script Wiper Security Content from the Splunk Threat Research Team Detecting Threats with Splunk Security Content - Q4 Roundup For all our tools and security content, please visit research.splunk.com.  — The Splunk Threat Research Team ... View more

  In the last month, the Splunk Threat Research Team (STRT) has had three releases of new content via the Enterprise Security Content Update (ESCU) app (v3.63.0, v3.64.0, v4.0.0). With these releases, there are 21 new detections and 4 new analytic stories now available in Splunk Enterprise Security via the ESCU application update process or via Splunk Security Essentials (SSE). Read on for a summary of what these entail! Content highlights include:  Detections to look for 3CX applications and compromised network indicators Expanded privileged escalation detections to detect PowerShell-based malicious activity using New-CIMSession and Invoke-CIMMethod cmdlets Detection searches for Winter Vivern and Sandworm malware  Detections to identify suspicious bootloaders based on the diverse techniques employed by the BlackLotus bootkit  New Analytic Stories:  Winter Vivern Sandworm Tools BlackLotus Campaign 3CX Supply Chain Attack New Detections:  Windows Exfiltration Over C2 Via Invoke RestMethod Windows Exfiltration Over C2 Via PowerShell UploadString Windows Scheduled Task Created Via XML Windows Screen Capture Via PowerShell Windows DNS Gather Network Info Windows Impair Defenses Disable HVCI Windows BootLoader Inventory Windows RDP Connection Successful PowerShell Invoke-WmiExec Usage PowerShell Invoke CIMMethod CIMSession PowerShell Enable PowerShell Remoting PowerShell Start or Stop Service Windows PowerShell Get-CIMInstance Remote Computer Windows Enable Win32_ScheduledJob via Registry Windows PowerShell WMI Win32_ScheduledJob Windows Service Create with Tscon Windows Lateral Tool Transfer RemCom Windows Service Create RemComSvc Hunting 3CXDesktopApp Software Windows Vulnerable 3CX Software 3CX Supply Chain Attack Network Indicators For all our tools and security content, please visit research.splunk.com.  The Splunk Threat Research Team has also recently published the following blogs for a more in-depth research analysis of various threats: These are the Drivers You Are Looking For: Detect and Prevent Malicious Drivers Splunk Insights: Investigating the 3CXDesktopApp Supply Chain Compromise  AsyncRAT Crusade: Detections and Defense  — The Splunk Threat Research Team ... View more

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise Security Content Update (ESCU) app (v3.60.0, v3.61.0, v3.62.0). With these releases, there are 44 new detections and 6 new analytic stories now available in Splunk Enterprise Security via the ESCU application update process or via Splunk Security Essentials (SSE). Content highlights include:  Detections related to CVE-2023-23397, a critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows A proof-of-concept for CVE-2023-21716, a critical vulnerability in Microsoft Word that allows remote code execution utilizing a heap corruption in rich text files Detections related to Okta IM2 logs for detecting suspicious authentication-based security attacks  Identifying the use of Silver, an OSS cross-platform adversary emulation/red team framework produced by BishopFox, that has gained more traction with adversaries as it is often seen as an alternative to Cobalt Strike An analytic story to hunt for and detect the presence of AwfulShred malware within Linux environments  Detections related to Fortinet ForiNAC CVE-2022-39952  New Analytic Stories:  CVE-2023-21716 Word RTF Heap Corruption CVE-2023-23397 Outlook Elevation of Privilege Sneaky Active Directory Persistence Tricks  BishopFox Silver Adversary Emulation Framework AwfulShred Fortinet FortiNAC CVE-2022-39952 New Detections:  Okta Mismatch Between Source and Response for Okta Verify Push Request Okta Multiple Failed Requests to Access Applications Okta Suspicious Use of a Session Cookie Okta Phishing Detection with FastPass Origin Check Okta ThreatInsight Login Failure with High Unknown users Okta ThreatInsight Suspected PasswordSpray Attack Windows Rundll32 WebDAV Request Windows Rundll32 WebDav With Network Connection Notepad with no Command Line Arguments Windows Process Injection into Notepad Windows AD Same Domain SID History Addition Windows AD Cross Domain SID History Addition Windows AD Replication Request Initiated by User Account Windows AD Replication Request Initiated from Unsanctioned Location Windows AD Domain Replication ACL Addition Windows AD DSRM Account Changes Windows AD DSRM Password Reset Windows AD Short Lived Domain Controller SPN Attribute Windows AD Short Lived Server Object Windows AD SID History Attribute Modified Windows AD AdminSDHolder ACL Modified Windows AD ServicePrincipalName Added To Domain Account Windows AD Short Lived Domain Account ServicePrincipalName Windows AD Rogue Domain Controller Network Activity Windows AD Account SID History Addition Windows AD Replication Service Traffic Windows Unusual Count of Disabled Users Failed Auth Using Kerberos Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM Windows Unusual Count Of Users Fail To Auth With Explicit Credentials Windows Unusual Count Of Users Failed To Auth Using Kerberos Windows Unusual Count Of Users Failed To Authenticate From Process Windows Unusual Count Of Users Failed To Authenticate Using NTLM Windows Unusual Count Of Users Remotely Failed To Auth From Host Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952 Linux Data Destruction Command Linux Hardware Addition SwapOff Linux Impair Defenses Process Kill Linux Indicator Removal Clear Cache Linux Indicator Removal Service File Deletion Linux System Reboot Via System Request Key Linux Unix Shell Enable All SysRq Functions Windows Steal Authentication Certificates CryptoAPI Windows Mimikatz Crypto Export File Extensions For all our tools and security content, please visit research.splunk.com.  The Splunk Threat Research Team has also recently published the following blogs for a more in-depth research analysis of various threats: Breaking the Chain: Defending Against Certificate Services Abuse Threat Advisory: SwiftSlicer Wiper STRT-TA03 — The Splunk Threat Research Team ... View more

The Splunk Threat Research Team (STRT) has had 3 releases of the Enterprise Security Content Update (ESCU) app within the last month (v3.57.0, v3.58.0, and v3.59.0). With these releases, there are 46 new detections and 7 new analytic stories now available in Splunk Enterprise Security via the ESCU application update process or via Splunk Security Essentials (SSE). Release highlights include: Detections that enable users to hunt for the presence of AsyncRAT Detections to identify compromised user accounts on Azure AD and AWS Detections to identify events and actions that could be attributed to the Chaos and LockBit ransomware New Analytic Stories: AsyncRAT Compromised User Account Swift Slicer Windows Certificate Services Chaos Ransomware LockBit Ransomware Splunk Vulnerabilities New Detections: AWS AD New MFA Method Registered For User AWS Concurrent Sessions From Different Ips AWS High Number Of Failed Authentications For User AWS High Number Of Failed Authentications From Ip AWS Password Policy Changes AWS Successful Console Authentication From Multiple IPs Azure AD Concurrent Sessions From Different Ips Azure AD High Number Of Failed Authentications For User Azure AD High Number Of Failed Authentications From Ip Azure AD New MFA Method Registered For User Azure AD Successful Authentication From Different Ips Detect suspicious process names using a pre trained model in DSDL Driver Inventory LOLBAS With Network Traffic (External contributor - @nterl0k) Windows Data Destruction Recursive Exec Files Deletion Windows Export Certificate Windows Powershell Cryptography Namespace Windows PowerShell Export Certificate Windows PowerShell Export PfxCertificate Windows Scheduled Task with Highest Privileges Windows Spear Phishing Attachment Onenote Spawn Mshta Windows Spear Phishing Attachment Connect to None MS Office Domain Windows Steal Authentication Certificates Certificate Issued Windows Steal Authentication Certificates Certificate Request Windows Steal Authentication Certificates CertUtil Backup Windows Steal Authentication Certificates CS Backup Windows Steal Authentication Certificates Export Certificate Windows Steal Authentication Certificates Export PfxCertificate Detect suspicious DNS TXT records using pretrained model in DSDL Windows Boot or Logon Autostart Execution in Startup Folder Windows Modify Registry Default Icon Setting Windows Phishing PDF File Executes URL Link Windows Replication Through Removable Media Windows User Execution Malicious URL Shortcut File Windows Vulnerable Driver Loaded Linux Ngrok Reverse Proxy Usage Windows Server Software Component GACUtil Install to GAC Windows PowerShell Add Module to Global Assembly Cache Windows Credential Dumping LSASS Memory Createdump Splunk csrf in the ssg kvstore Client Endpoint Splunk Improperly Formatted Parameter Crashes splunkd Persistent XSS in RapidDiag through User Interface Views Splunk Risky Command Abuse Disclosed February 2023 Splunk Unnecessary File Extensions Allowed by Lookup Table Uploads Splunk XSS via View Splunk List All Nonstandard Admin Accounts For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team       ... View more

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) app v3.55.0 and v3.56.0. With these releases, there are 25 new detections and 3 new analytic stories now available to help you stay ahead of threats. These detections are available now in Splunk Enterprise Security via the ESCU application update process or via Splunk Security Essentials (SSE). Release highlights include: Identifying mechanisms within Microsoft Internet Information Services (IIS) exploited by adversaries for malicious purposes  Detections to monitor unusual activities that are related to Prestige Ransomware activity  Detections to identify a variety of Windows post-exploitation tools such as winpeas.bat, winpeas.exe, WinPrivCheck.bat typically used to gain privileges and persistence across assets running the Windows Operating System. New Detections:  Windows Disable Windows Event Logging Disable HTTP Logging Windows IIS Components Add New Module Windows IIS Components Get-WebGlobalModule Module Query Windows IIS Components Module Failed to Load Windows IIS Components New Module Added Windows PowerShell Disable Windows Event Logging Disable HTTP Logging Windows PowerShell IIS Components WebGlobalModule Usage Windows Modify Registry Reg Restore Windows Query Registry Reg Save Windows System User Discovery Via Quser Windows WMI Process and Service List Windows Cached Domain Credentials Reg Query Windows ClipBoard Data via Get-ClipBoard Windows Credentials from Password Stores Query Windows Credentials in Registry Reg Query Windows Indirect Command Execution Via Series of Forfiles Windows Information Discovery Fsutil Windows Password Managers Discovery Windows Private Keys Discovery Windows Security Support Provider Reg Query Windows Steal or Forge Kerberos Tickets Klist Windows System Network Config Discovery Display DNS Windows System Network Connections Discovery Netsh Windows Change Default File Association for No File Ext Windows Service Stop Via Net and SC Application New Analytic Stories:  IIS Components Prestige Ransomware Windows Post-Exploitation For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team ... View more

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and v.53.0, which together contained 11 new detections and 4 new analytic stories to help you stay ahead of threats. These detections are now available in Splunk Enterprise Security via the ESCU application update process or via Splunk Security Essentials (SSE). Release Highlights Include: An analytic story for CVE-2022-3602 vulnerability in OpenSSL Qakbot (aka Qbot or Pinkslipbot) detections to proactively hunt and detect the presence of QBot infections and proliferation A new detection to identify Ngrok, which has been leveraged by threat actors in several campaigns used for tunneling, lateral movement, and data exfiltration. An analytic story for CISA Alert AA22-320A New Detections: SSL Certificates with Punycode Zeek x509 Certificate with Punycode Windows App Layer Protocol Qakbot NamedPipe Azorult Ngrok Reverse Proxy on Network Powershell Load Module in Meterpreter Windows Apache Benchmark Binary Windows Mimikatz Binary Execution Windows MSExchange Management Mailbox Cmdlet Usage Windows Ngrok Reverse Proxy Usage Windows Service Created with Suspicious Service Path New Analytic Stories : OpenSSL CVE-2022-3602 CISA AA22-320A Reverse Network Proxy MetaSploit For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team ... View more

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v.3.52.0, which contains 27 new detections and 4 new analytic stories to help you stay ahead of threats. These detections are now available in Splunk Enterprise Security via the ESCU application update process or via Splunk Security Essentials (SSE).  Release highlights include:  An update to the Splunk Vulnerabilities analytic story that contains 6 new detections for the latest CVEs published by Splunk in the Quarterly Security Patch Updates on November 2nd, 2022.  Several new detection analytics that help you detect unusual activities that might relate to the Qakbot/QBot malware including parent-child process anomalies, persistence, initial access, recon and many more. A new story, CVE-2022-40684 Fortinet Appliance Auth bypass, to help detect the exploitation of a critical authentication bypass vulnerability recently patched by Fortinet in their FortiOS, FortiProxy, and FortiSwitchManager projects CVE-2022-40684. A new detection for Text4Shell (CVE-2022-42889), a new critical vulnerability similar to the old Spring4Shell and Log4Shell. Additional content for the Cloud Account Takeover use case with 6 new analytic stories to help detect GCP Account Takeover. New Detections:  Exploit Public Facing Application via Apache Commons Text Fortinet Appliance Auth Bypass GCP Authentication Failed During MFA Challenge GCP Multi-Factor Authentication Disabled GCP Multiple Failed MFA Requests for User GCP Multiple Users Failing to Authenticate from Ip GCP Successful Single-Factor Authentication GCP Unusual Number of Failed Authentications from Ip Splunk Code Injection via Custom Dashboard Leading to RCE Splunk Data exfiltration from Analytics Workspace Using Sid Query Splunk RCE via Splunk Secure Gateway Splunk Mobile Alerts Feature Splunk Reflected XSS in the Templates Lists Radio Splunk Stored XSS via Data Model objectName Field Splunk XSS in Save Table Dialog Header in Search Page Windows App Layer Protocol Wermgr Connect to NamedPipe Windows Command Shell Fetch Env Variables Windows DLL Side-Loading in Calc Windows DLL Side-Loading Process Child of Calc Windows Masquerading Explorer as Child Process Windows Modify Registry Qakbot Binary Data Registry Windows Process Injection of Wermgr to Known Browser Windows Process Injection Remote Thread Windows Process Injection Wermgr Child Process Windows Regsvr32 Renamed Binary Windows System Discovery Using ldap Nslookup Windows System Discovery Using Qwinsta Windows WMI Impersonate Token New Analytic Stories:  CVE-2022-40684 Fortinet Appliance Auth bypass GCP Account Takeover Qakbot Text4Shell CVE-2022-42889 For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team    ... View more

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v.3.51.0, which contains 9 new detections and 2 new analytic stories to help you stay ahead of threats. These detections are now available in Splunk Enterprise Security via the ESCU application update process or via Splunk Security Essentials (SSE).  Release highlights include:  Advisory analytic story to assist defenders with CISA AA22-277A, which was recently released by the Cybersecurity and Infrastructure Security Agency (CISA) in response to an advanced persistent threat (APT) that utilized Impacket, an open-source toolkit, and other common techniques.  Updated content based on feedback and simulated attack data related to ProxyNotShell, which is a continuation of the ProxyShell saga but requires valid credentials.  Additional content for the Cloud Account Takeover use case with four new analytics that help detect attacks against Multi-factor Authentication (MFA) defense mechanisms for Amazon Web Services (AWS) console. New detections:  AWS Console Login Failed During MFA Challenge AWS Multi-Factor Authentication Disabled AWS Multiple Failed MFA Requests For User AWS Successful Single-Factor Authentication Detect Exchange Web Shell ProxyShell ProxyNotShell Behavior Detected Windows Create Local Account Windows Exchange Autodiscover SSRF Abuse  Windows Mshta Execution In Registry New Analytic Stories: CISA AA22-277A ProxyNotShell Updated Analytics: Detect SharpHound File Modifications Exchange PowerShell Abuse via SSRF Exchange PowerShell Module UsageUnified Messaging Service Spawning a Process For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team  ... View more