Enterprise Security Content Update (ESCU) | New Releases

[cwopat]

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.6.0 and v4.7.0). With these releases, there are 8 new detections, 16 updated detections and 7 new analytic stories now available in Splunk Enterprise Security via the ESCU application update process.

Content highlights include: 

• New searches that focus on potential malicious activities related to suspicious registry modification of Windows and malicious command line behavior, including potential exploitation attempts against Citrix ADC
• A new analytic story for the detection and investigation of unusual activities that relate to BlackByte ransomware
• Detections for CVE-2023-36884, an unpatched zero-day vulnerability affecting Windows and Microsoft Office products, and CVE-2023-3519, a vulnerability in NetScaler (formerly Citrix) Application Delivery Controller (ADC) and NetScaler Gateway
• A new analytic story to detect task scheduling activities related to MITRE ATT&CK technique T1053
• New searches to detect activities related to Amadey, a type of malware that primarily operates as a banking Trojan 
• Detections for potential exploitation attempts against VMware vRealize Network Insight that align with the characteristics of CVE-2023-20887

New Analytic Stories: 

• BlackByte Ransomware

• CVE-2023-36884 Office and Windows HTML RCE Vulnerability

• Citrix Netscaler ADC CVE-2023-3519

• Scheduled Tasks

• Amadey

• Graceful Wipe Out Attack

• VMware Aria Operations vRealize / CVE-2023-20887

New Detections: 

• Windows Modify Registry EnableLinkedConnections

• Windows Modify Registry LongPathsEnabled

• Windows Modify Registry Risk Behavior

• Windows Post Exploitation Risk Behavior

• Windows Common Abused Cmd Shell Risk Behavior

• Citrix ADC Exploitation CVE-2023-3519

• Windows PowerShell ScheduleTask

• Windows Files and Dirs Access Rights Modification Via Icacls

Updated Detections: 

• O365 Add App Role Assignment Grant User

• MSHTML Module Load in Office Product

• Office Document Spawned Child Process To Download

• Office Product Spawn CMD Process

• Office Product Spawning BITSAdmin

• Office Product Spawning CertUtil

• Office Product Spawning MSHTA

• Office Product Spawning Rundll32 with no DLL

• Office Product Spawning Windows Script Host

• ICACLS Grant Command

• Registry Keys Used For Persistence

• PowerShell 4104 Hunting

• Detect Baron Samedit CVE-2021-3156 Segfault

• Detect Baron Samedit CVE-2021-3156

• Windows System Shutdown CommandLine
• VMWare Aria Operations Exploit Attempt

The team has also published the following blogs:

• Amadey Threat Analysis and Detections
• I am the Snake Now: Analysis of Snake Malware

For all our tools and security content, please visit research.splunk.com. 

— The Splunk Threat Research Team