Detection: Windows NirSoft Utilities

Description

The following analytic identifies the execution of commonly used NirSoft utilities on Windows systems. This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise. Note that this search does not use a where clause to filter out known benign paths, as NirSoft utilities can be executed from various locations. This might hinder performance in environments with high data volumes. Apply additional filtering as necessary to enhance this.

Search

 1
 2| tstats `security_content_summariesonly`
 3  count min(_time) as firstTime
 4        max(_time) as lastTime
 5
 6FROM datamodel=Endpoint.Processes WHERE
 7
 8Processes.original_file_name = "*.exe"
 9
10BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process
11   Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
12   Processes.parent_process_name Processes.parent_process_path Processes.process
13   Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
14   Processes.process_integrity_level Processes.process_name Processes.process_path
15   Processes.user Processes.user_id Processes.vendor_product
16
17
18| `drop_dm_object_name("Processes")`
19
20
21| search [
22             
23| inputlookup nirsoft_utilities_lookup
24             
25| search original_file_name=*.exe
26             
27| table original_file_name
28         ]
29
30
31| lookup local=t nirsoft_utilities_lookup original_file_name OUTPUT description
32
33
34| `security_content_ctime(firstTime)`
35
36| `security_content_ctime(lastTime)`
37
38| `windows_nirsoft_utilities_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 1	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To successfully implement this search, ingest process creation events from your endpoints and normalize them to the Processes node of the Endpoint data model using the Splunk Common Information Model (CIM). Ensure the normalized events populate the original_file_name field, which this search uses to identify NirSoft utilities. Supported sources might include Sysmon and CrowdStrike ProcessRollup2 when mapped to the data model.

Known False Positives

False positives may be present. Filtering may be required before setting to alert.

Associated Analytic Story

• WhisperGate

• Unusual Processes

• Data Destruction

Intermediate Findings

Threat Objects

References

• https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/

• http://www.nirsoft.net/

• https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L623

• https://www.cisa.gov/uscert/ncas/alerts/TA18-201A

Atomic Tests

Learn more about Atomic Red Team tests here.

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 12