Skip to content

Commit 888c224

Browse files
tccontret-contrerasnasbenchpatel-bhavin
authored
netsupport (#3798)
* netsupport * netsupport * netsupport * netsupport * Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> * Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> * Update data_sources/sysmon_eventid_29.yml Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> * Update data_sources/sysmon_eventid_29.yml Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> * Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> * Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> * Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> * Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> * netsupport * netsupport * netsupport * netsupport * updates * small fixes --------- Co-authored-by: Teoderick Contreras <tcontreras@splunk.com> Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
1 parent 19d3c48 commit 888c224

File tree

36 files changed

+427
-83
lines changed

36 files changed

+427
-83
lines changed

‎data_sources/sysmon_eventid_29.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
name: Sysmon EventID 29
2+
id: 06c61e04-2d07-4e85-bcd5-8110938b1b18
3+
version: 1
4+
date: '2025-11-14'
5+
author: Teoderick Contreras, Splunk
6+
description: Data source object for Sysmon EventID 29
7+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
8+
sourcetype: XmlWinEventLog
9+
separator: EventID
10+
configuration: https://github.com/SwiftOnSecurity/sysmon-config
11+
supported_TA:
12+
- name: Splunk Add-on for Sysmon
13+
url: https://splunkbase.splunk.com/app/5709
14+
version: 5.0.0
15+
fields:
16+
- _time
17+
- action
18+
- dest
19+
- dvc
20+
- Image
21+
- EventID
22+
- EventCode
23+
- event_type
24+
- date_hour
25+
- date_mday
26+
- date_minute
27+
- date_month
28+
- date_second
29+
- date_wday
30+
- date_year
31+
- date_zone
32+
- User
33+
- UserID
34+
- TargetFilename
35+
- process_id
36+
- ProcessID
37+
- Hashes
38+
- EventRecordID
39+
- Keywords
40+
- Channel
41+
- IMPHASH
42+
- file_hash
43+
- file_name
44+
- file_path
45+
- severity
46+
- signature
47+
- signature_id
48+
- user
49+
- user_id
50+
- SecurityID
51+
- process_guid
52+
output_fields:
53+
- Image
54+
- file_name
55+
- file_path
56+
- process_guid
57+
- file_hash
58+
- process_id
59+
- dest
60+
- user
61+
- EventCode
62+
example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>29</EventID><Version>5</Version><Level>4</Level><Task>29</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2025-11-14T10:09:37.700533300Z'/><EventRecordID>3374716</EventRecordID><Correlation/><Execution ProcessID='1668' ThreadID='2836'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>ar-win-dc</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2025-11-14 10:09:37.697</Data><Data Name='ProcessGuid'>{CA8A6768-FFA9-6916-9303-000000000304}</Data><Data Name='ProcessId'>1436</Data><Data Name='User'>AR-WIN-DC\Administrator</Data><Data Name='Image'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='TargetFilename'>C:\Users\Administrator\AppData\Local\Microsoft_Corporation\lScun7w.docx</Data><Data Name='Hashes'>MD5=1E6E804CA71EAF5BEF0ABEF95C578CF0,SHA256=6FFE12CDFE0A36DEC4B4A40ECDAFB4097B1AF7C340B0FCECF9F5C67B7FA8B299,IMPHASH=2C4D798BB87EC57193B7625C4259DA43</Data></EventData></Event>

‎detections/endpoint/add_or_set_windows_defender_exclusion.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Add or Set Windows Defender Exclusion
22
id: 773b66fe-4dd9-11ec-8289-acde48001122
3-
version: 11
4-
date: '2025-10-01'
3+
version: 12
4+
date: '2025-11-20'
55
author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
66
status: production
77
type: TTP
@@ -93,6 +93,7 @@ tags:
9393
- WhisperGate
9494
- Windows Defense Evasion Tactics
9595
- Crypto Stealer
96+
- NetSupport RMM Tool Abuse
9697
asset_type: Endpoint
9798
mitre_attack_id:
9899
- T1562.001
@@ -106,4 +107,4 @@ tests:
106107
attack_data:
107108
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/sysmon.log
108109
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
109-
sourcetype: XmlWinEventLog
110+
sourcetype: XmlWinEventLog

‎detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Allow Inbound Traffic In Firewall Rule
22
id: a5d85486-b89c-11eb-8267-acde48001122
3-
version: 8
4-
date: '2025-05-02'
3+
version: 9
4+
date: '2025-11-20'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: TTP
@@ -53,6 +53,7 @@ rba:
5353
tags:
5454
analytic_story:
5555
- Prohibited Traffic Allowed or Protocol Mismatch
56+
- NetSupport RMM Tool Abuse
5657
asset_type: Endpoint
5758
mitre_attack_id:
5859
- T1021.001
@@ -66,4 +67,4 @@ tests:
6667
attack_data:
6768
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/allow_inbound_traffic_in_firewall_rule/windows-xml.log
6869
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
69-
sourcetype: XmlWinEventLog
70+
sourcetype: XmlWinEventLog

‎detections/endpoint/detect_mshta_url_in_command_line.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect MSHTA Url in Command Line
22
id: 9b3af1e6-5b68-11eb-ae93-0242ac130002
3-
version: 15
4-
date: '2025-09-18'
3+
version: 16
4+
date: '2025-11-20'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -89,6 +89,7 @@ tags:
8989
- Suspicious MSHTA Activity
9090
- XWorm
9191
- Cisco Network Visibility Module Analytics
92+
- NetSupport RMM Tool Abuse
9293
asset_type: Endpoint
9394
mitre_attack_id:
9495
- T1218.005
@@ -107,4 +108,4 @@ tests:
107108
attack_data:
108109
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log
109110
source: not_applicable
110-
sourcetype: cisco:nvm:flowdata
111+
sourcetype: cisco:nvm:flowdata

‎detections/endpoint/disable_windows_behavior_monitoring.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Disable Windows Behavior Monitoring
22
id: 79439cae-9200-11eb-a4d3-acde48001122
3-
version: 16
4-
date: '2025-10-14'
3+
version: 17
4+
date: '2025-11-20'
55
author: Teoderick Contreras, Splunk, Steven Dick
66
status: production
77
type: TTP
@@ -69,6 +69,7 @@ tags:
6969
- RedLine Stealer
7070
- Cactus Ransomware
7171
- Scattered Lapsus$ Hunters
72+
- NetSupport RMM Tool Abuse
7273
asset_type: Endpoint
7374
mitre_attack_id:
7475
- T1562.001
@@ -82,4 +83,4 @@ tests:
8283
attack_data:
8384
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
8485
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
85-
sourcetype: XmlWinEventLog
86+
sourcetype: XmlWinEventLog

‎detections/endpoint/domain_controller_discovery_with_nltest.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Domain Controller Discovery with Nltest
22
id: 41243735-89a7-4c83-bcdd-570aa78f00a1
3-
version: 7
4-
date: '2025-05-02'
3+
version: 8
4+
date: '2025-11-20'
55
author: Mauricio Velazco, Splunk
66
status: production
77
type: TTP
@@ -66,6 +66,7 @@ tags:
6666
- Medusa Ransomware
6767
- BlackSuit Ransomware
6868
- Rhysida Ransomware
69+
- NetSupport RMM Tool Abuse
6970
asset_type: Endpoint
7071
mitre_attack_id:
7172
- T1018
@@ -79,4 +80,4 @@ tests:
7980
attack_data:
8081
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log
8182
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
82-
sourcetype: XmlWinEventLog
83+
sourcetype: XmlWinEventLog

‎detections/endpoint/icacls_grant_command.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: ICACLS Grant Command
22
id: b1b1e316-accc-11eb-a9b4-acde48001122
3-
version: 8
4-
date: '2025-06-17'
3+
version: 9
4+
date: '2025-11-20'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
@@ -76,6 +76,7 @@ tags:
7676
- Crypto Stealer
7777
- XMRig
7878
- Defense Evasion or Unauthorized Access Via SDDL Tampering
79+
- NetSupport RMM Tool Abuse
7980
asset_type: Endpoint
8081
mitre_attack_id:
8182
- T1222
@@ -89,4 +90,4 @@ tests:
8990
attack_data:
9091
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
9192
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
92-
sourcetype: XmlWinEventLog
93+
sourcetype: XmlWinEventLog

‎detections/endpoint/lolbas_with_network_traffic.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: LOLBAS With Network Traffic
22
id: 2820f032-19eb-497e-8642-25b04a880359
3-
version: 13
4-
date: '2025-10-20'
3+
version: 14
4+
date: '2025-11-20'
55
author: Steven Dick
66
status: production
77
type: TTP
@@ -143,6 +143,7 @@ tags:
143143
- APT37 Rustonotto and FadeStealer
144144
- GhostRedirector IIS Module and Rungan Backdoor
145145
- Hellcat Ransomware
146+
- NetSupport RMM Tool Abuse
146147
asset_type: Endpoint
147148
mitre_attack_id:
148149
- T1105
@@ -158,4 +159,4 @@ tests:
158159
attack_data:
159160
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log
160161
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
161-
sourcetype: XmlWinEventLog
162+
sourcetype: XmlWinEventLog

‎detections/endpoint/ntdsutil_export_ntds.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Ntdsutil Export NTDS
22
id: da63bc76-61ae-11eb-ae93-0242ac130002
3-
version: 7
4-
date: '2025-05-02'
3+
version: 8
4+
date: '2025-11-20'
55
author: Michael Haag, Patrick Bareiss, Splunk
66
status: production
77
type: TTP
@@ -72,6 +72,7 @@ tags:
7272
- Prestige Ransomware
7373
- Volt Typhoon
7474
- Rhysida Ransomware
75+
- NetSupport RMM Tool Abuse
7576
asset_type: Endpoint
7677
mitre_attack_id:
7778
- T1003.003
@@ -85,4 +86,4 @@ tests:
8586
attack_data:
8687
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
8788
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
88-
sourcetype: XmlWinEventLog
89+
sourcetype: XmlWinEventLog

‎detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Powershell Fileless Script Contains Base64 Encoded Content
22
id: 8acbc04c-c882-11eb-b060-acde48001122
3-
version: 14
4-
date: '2025-10-24'
3+
version: 15
4+
date: '2025-11-20'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -68,6 +68,7 @@ tags:
6868
- GhostRedirector IIS Module and Rungan Backdoor
6969
- Hellcat Ransomware
7070
- Microsoft WSUS CVE-2025-59287
71+
- NetSupport RMM Tool Abuse
7172
mitre_attack_id:
7273
- T1027
7374
- T1059.001

0 commit comments

Comments
 (0)