Techniques
Sample rules
Detect Remote Access Software Usage Registry
- source: splunk
- technicques:
Description
The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
latest(Registry.process_guid) as process_guid
FROM datamodel=Endpoint.Registry WHERE
(
Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*"
OR
(
Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*"
Registry.registry_value_name="ImagePath"
)
)
(
[
| inputlookup remote_access_software
| search file_name!=""
| eval file_name="*".file_name."*"
| rex mode=sed field=file_name "s/\*\*/\*/g"
| rename file_name as Registry.registry_value_data
| table Registry.registry_value_data
]
OR
[
| inputlookup remote_access_software
| search file_path!=""
| eval file_path="*".file_path."*"
| rex mode=sed field=file_path "s/\*\*/\*/g"
| rename file_path as Registry.registry_value_data
| table Registry.registry_value_data
]
)
BY Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive
Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)`
| rex field=registry_value_data "(?i)(?:^
|\x5c)(?<file_name>[^\x5c/\x27\x22]+\.\w{2,5})\b"
| rex field=registry_value_data "(?i)(?<file_path>\w:\x5c(?:[^\x5c/\x27\x22]+\x5c)+[^\x5c/\x27\x22]+\.\w{2,5})\b"
| lookup local=t remote_access_software file_name OUTPUT app as name_signature, category as name_category, reference as name_reference, description as name_description
| lookup local=t remote_access_software file_path OUTPUT app as path_signature, category as path_category, reference as path_reference, description as path_description
| eval signature=coalesce(nullif(name_signature, ""), path_signature),
category=coalesce(nullif(name_category, ""), path_category),
reference=coalesce(nullif(name_reference, ""), path_reference),
description=coalesce(nullif(name_description, ""), path_description)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `remote_access_software_usage_exceptions`
| `detect_remote_access_software_usage_registry_filter`
Detect Remote Access Software Usage File
- source: splunk
- technicques:
Description
The following analytic detects the writing of files from known remote access software to disk within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on file path, file name, and user information. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access. If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration, further compromise, or complete control over affected systems. It is best to update both the remote_access_software_usage_exception.csv lookup and the remote_access_software lookup with any known or approved remote access software to reduce false positives and increase coverage. In order to enhance performance, the detection filters for specific file names extensions / names that are used in the remote_access_software lookup. If add additional entries, consider updating the search filters to include those file names / extensions as well, if not alread covered.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime,
max(_time) as lastTime
values(Filesystem.file_path) as file_path
FROM datamodel=Endpoint.Filesystem WHERE
[
| inputlookup remote_access_software
| search file_name!=""
| rename file_name as Filesystem.file_name
| table Filesystem.file_name
]
OR
[
| inputlookup remote_access_software
| search file_path!=""
| rename file_path as Filesystem.file_path
| table Filesystem.file_path
]
BY Filesystem.action Filesystem.dest Filesystem.file_access_time
Filesystem.file_create_time Filesystem.file_hash
Filesystem.file_modify_time Filesystem.file_name
Filesystem.file_path Filesystem.file_acl Filesystem.file_size
Filesystem.process_guid Filesystem.process_id
Filesystem.user Filesystem.vendor_product
| `drop_dm_object_name(Filesystem)`
| lookup local=t remote_access_software file_name OUTPUT app as name_signature, category as name_category, reference as name_reference, description as name_description
| lookup local=t remote_access_software file_path OUTPUT app as path_signature, category as path_category, reference as path_reference, description as path_description
| eval signature=coalesce(nullif(name_signature, ""), path_signature),
category=coalesce(nullif(name_category, ""), path_category),
reference=coalesce(nullif(name_reference, ""), path_reference),
description=coalesce(nullif(name_description, ""), path_description)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `remote_access_software_usage_exceptions`
| `detect_remote_access_software_usage_file_filter`
Detect Remote Access Software Usage FileInfo
- source: splunk
- technicques:
Description
The following analytic detects the execution of processes with file or code signing attributes from known remote access software within the environment. It leverages Sysmon EventCode 1 data and cross-references a lookup table of remote access utilities such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these tools to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration or further compromise of the network.
Detection logic
`sysmon` EventCode=1
[
| inputlookup remote_access_software
| search file_info!=""
| rename file_info as Product
| table Product
]
| stats count min(_time) as firstTime
max(_time) as lastTime
values(Company) as Company
values(Product) as Product
BY action dest original_file_name
parent_process parent_process_exec parent_process_guid
parent_process_id parent_process_name parent_process_path
process process_exec process_guid
process_hash process_id process_integrity_level
process_name process_path user
user_id vendor_product
| lookup local=t remote_access_software file_info as Product OUTPUT app as signature, category, reference, description
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `remote_access_software_usage_exceptions`
| `detect_remote_access_software_usage_fileinfo_filter`