Detection: Windows ISO LNK File Creation

Updated Date: 2024-10-17 ID: d7c2c09b-9569-4a9e-a8b6-6a39a99c1d32 Author: Michael Haag, Teoderick Contreras, Splunk Type: Hunting Product: Splunk Enterprise Security

Description

The following analytic detects the creation of .iso.lnk files in the %USER%\AppData\Local\Temp<random folder name>\ path, indicating that an ISO file has been mounted and accessed. This detection leverages the Endpoint.Filesystem data model, specifically monitoring file creation events in the Windows Recent folder. This activity is significant as it may indicate the delivery and execution of potentially malicious payloads via ISO files. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further system compromise.

1
2| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\Microsoft\\Windows\\Recent\\*") Filesystem.file_name IN ("*.iso.lnk", "*.img.lnk", "*.vhd.lnk", "*vhdx.lnk") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.dest 
3| `drop_dm_object_name(Filesystem)` 
4| `security_content_ctime(firstTime)` 
5| `security_content_ctime(lastTime)` 
6| `windows_iso_lnk_file_creation_filter`

Data Source

Name Platform Sourcetype Source
Sysmon EventID 11 Windows icon Windows 'xmlwineventlog' 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Name Value
security_content_ctime convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)
windows_iso_lnk_file_creation_filter search *
windows_iso_lnk_file_creation_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1566.001 Spearphishing Attachment Initial Access
T1566 Phishing Initial Access
T1204.001 Malicious Link Execution
T1204 User Execution Execution
KillChainPhase.DELIVERY
KillChainPhase.INSTALLATION
NistCategory.DE_AE
Cis18Value.CIS_10
APT-C-36
APT1
APT12
APT19
APT28
APT29
APT30
APT32
APT33
APT37
APT38
APT39
APT41
Ajax Security Team
Andariel
BITTER
BRONZE BUTLER
BlackTech
CURIUM
Cobalt Group
Confucius
DarkHydrus
Darkhotel
Dragonfly
EXOTIC LILY
Elderwood
FIN4
FIN6
FIN7
FIN8
Ferocious Kitten
Gallmaker
Gamaredon Group
Gorgon Group
Higaisa
Inception
IndigoZebra
Kimsuky
Lazarus Group
LazyScripter
Leviathan
Machete
Malteiro
Mofang
Molerats
Moonstone Sleet
MuddyWater
Mustang Panda
Naikon
Nomadic Octopus
OilRig
PLATINUM
Patchwork
RTM
Rancor
RedCurl
Saint Bear
Sandworm Team
SideCopy
Sidewinder
Silence
Star Blizzard
TA2541
TA459
TA505
TA551
The White Company
Threat Group-3390
Tonto Team
Transparent Tribe
Tropic Trooper
WIRTE
Windshift
Winter Vivern
Wizard Spider
admin@338
menuPass
Axiom
GOLD SOUTHFIELD
INC Ransom
APT28
APT29
APT3
APT32
APT33
APT39
BlackTech
Cobalt Group
Confucius
Daggerfly
EXOTIC LILY
Earth Lusca
Elderwood
Evilnum
FIN4
FIN7
FIN8
Gamaredon Group
Kimsuky
LazyScripter
Leviathan
LuminousMoth
Machete
Magic Hound
Mofang
Molerats
MuddyWater
Mustang Panda
Mustard Tempest
OilRig
Patchwork
RedCurl
Saint Bear
Sandworm Team
Sidewinder
TA2541
TA505
TA577
TA578
Transparent Tribe
Turla
Windshift
Winter Vivern
Wizard Spider
ZIRCONIUM
LAPSUS$
Scattered Spider

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Risk Event False
This configuration file applies to all detections of type hunting.

Implementation

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Filesystem node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.

Known False Positives

False positives may be high depending on the environment and consistent use of ISOs mounting. Restrict to servers, or filter out based on commonly used ISO names. Filter as needed.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message Risk Score Impact Confidence
An ISO file was mounted on $dest$ and should be reviewed and filtered as needed. 40 80 50
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset XmlWinEventLog:Microsoft-Windows-Sysmon/Operational XmlWinEventLog
Integration ✅ Passing Dataset XmlWinEventLog:Microsoft-Windows-Sysmon/Operational XmlWinEventLog

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 4