Detection: Detect Remote Access Software Usage Process

Description

The following analytic detects the execution of known remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software.

Search

 1
 2| tstats `security_content_summariesonly`
 3  count min(_time) as firstTime
 4        max(_time) as lastTime
 5        values(Processes.parent_process) as parent_process
 6
 7FROM datamodel=Endpoint.Processes WHERE
 8
 9[
10  
11| inputlookup remote_access_software
12  
13| search file_name!=""
14  
15| rename file_name as Processes.process_name
16  
17| table Processes.process_name
18]
19
20Processes.dest!="unknown"
21Processes.user!="unknown"
22
23BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
24   Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
25   Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
26   Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id
27   Processes.vendor_product
28
29
30| `drop_dm_object_name(Processes)`
31
32
33| lookup local=t remote_access_software file_name AS process_name OUTPUT app as signature, category, reference, description
34
35
36| `security_content_ctime(firstTime)`
37
38| `security_content_ctime(lastTime)`
39
40
41| `remote_access_software_usage_exceptions`
42
43
44| `detect_remote_access_software_usage_process_filter`

Data Source

Name	Platform	Sourcetype	Source
Windows Event Log Security 4688	Windows	'XmlWinEventLog'	'XmlWinEventLog:Security'
Sysmon EventID 1	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
CrowdStrike ProcessRollup2	Other	'crowdstrike:events:sensor'	'crowdstrike'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections.

Known False Positives

It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content

Associated Analytic Story

• GhostRedirector IIS Module and Rungan Backdoor

• CISA AA24-241A

• Gozi Malware

• Insider Threat

• Seashell Blizzard

• Scattered Spider

• Storm-0501 Ransomware

• Command And Control

• Cactus Ransomware

• Interlock Ransomware

• Remote Monitoring and Management Software

• Scattered Lapsus$ Hunters

• Ransomware

Intermediate Findings

Threat Objects

References

• https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L342

• https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L314

• https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/

• https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L287

• https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L222

• https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L483

• https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L452

• https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L509

• https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L95

• https://attack.mitre.org/techniques/T1219/

• https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L250

• https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L371

• https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L5

• https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/

Atomic Tests

Learn more about Atomic Red Team tests here.

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 19