Detection: Detect DNS requests to Phishing Sites leveraging EvilGinx2

DEPRECATED DETECTION

This detection has been marked as deprecated by the Splunk Threat Research team. This means that it will no longer be maintained or supported. If you have any questions or concerns, please reach out to us at research@splunk.com.

Updated Date: 2024-10-17 ID: 24dd17b1-e2fb-4c31-878c-d4f226595bfa Author: Bhavin Patel, Splunk Type: TTP Product: Splunk Enterprise Security

Description

This search looks for DNS requests for phishing domains that are leveraging EvilGinx tools to mimic websites.

Search

 1
 2| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(DNS.answer) as answer from datamodel=Network_Resolution.DNS by DNS.dest DNS.src DNS.query host 
 3| `drop_dm_object_name(DNS)`
 4| rex field=query ".*?(?<domain>[^./:]+\.(\S{2,3}
 5|\S{2,3}.\S{2,3}))$" 
 6| stats count values(query) as query by domain dest src answer
 7| search `evilginx_phishlets_amazon` OR `evilginx_phishlets_facebook` OR `evilginx_phishlets_github` OR `evilginx_phishlets_0365` OR `evilginx_phishlets_outlook` OR `evilginx_phishlets_aws` OR `evilginx_phishlets_google` 
 8| search NOT [ inputlookup legit_domains.csv 
 9| fields domain]
10| join domain type=outer [
11| tstats count `security_content_summariesonly` values(Web.url) as url from datamodel=Web.Web by Web.dest Web.site 
12| rename "Web.*" as * 
13| rex field=site ".*?(?<domain>[^./:]+\.(\S{2,3}
14|\S{2,3}.\S{2,3}))$" 
15| table dest domain url] 
16| table count src dest query answer domain url 
17| `detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter`

Data Source

No data sources specified for this detection.

Macros Used

Name	Value
evilginx_phishlets_0365	`(query=login* AND query=www*)`
detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter	`search *`

detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1566.003	Spearphishing via Service	Initial Access

KillChainPhase.DELIVERY

NistCategory.DE_CM

Cis18Value.CIS_13

APT29

Ajax Security Team

CURIUM

Dark Caracal

EXOTIC LILY

FIN6

Lazarus Group

Magic Hound

Moonstone Sleet

OilRig

ToddyCat

Windshift

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Notable	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Risk Event	True

This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.

Implementation

You need to ingest data from your DNS logs in the Network_Resolution datamodel. Specifically you must ingest the domain that is being queried and the IP of the host originating the request. Ideally, you should also be ingesting the answer to the query and the query type. This approach allows you to also create your own localized passive DNS capability which can aid you in future investigations. You will have to add legitimate domain names to the legit_domains.csv file shipped with the app. Splunk>Phantom Playbook Integration If Splunk>Phantom is also configured in your environment, a Playbook called Lets Encrypt Domain Investigate can be configured to run when any results are found by this detection search. To use this integration, install the Phantom App for Splunk https://splunkbase.splunk.com/app/3411/, add the correct hostname to the "Phantom Instance" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active. (Playbook link:https://my.phantom.us/4.2/playbook/lets-encrypt-domain-investigate/)

Known False Positives

If a known good domain is not listed in the legit_domains.csv file, then the search could give you false postives. Please update that lookup file to filter out DNS requests to legitimate domains.

Associated Analytic Story

Common Phishing Frameworks

Risk Based Analytics (RBA)

Risk Message	Risk Score	Impact	Confidence
tbd	25	50	50

The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	Not Applicable	N/A	N/A	N/A
Unit	❌ Failing	N/A	`N/A`	`N/A`
Integration	❌ Failing	N/A	`N/A`	`N/A`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 4