otrf / threathunter-playbook

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

The Threat Hunter Playbook

The Threat Hunter Playbook is a community-driven, open source project to share detection logic, adversary tradecraft and resources to make detection development more efficient. All the detection documents in this project follow the structure of MITRE ATT&CK categorizing post-compromise adversary behavior in tactical groups and are available in the form of interactive notebooks. The use of notebooks not only allow us to share text, queries and expected output, but also code to help others run detection logic against pre-recorded security datasets locally or remotely through BinderHub cloud computing environments.

Docs: https://threathunterplaybook.com/

Goals

• Expedite the development of techniques an hypothesis for hunting campaigns.
• Help security researchers understand patterns of behavior observed during post-exploitation.
• Share resources to validate analytics locally or remotely through cloud computing environments for free.
• Map pre-recorded datasets to adversarial techniques.
• Accelerate infosec learning through open source resources.

Author

Roberto Rodriguez @Cyb3rWard0g

Official Committers

• Jose Luis Rodriguez @Cyb3rPandaH is adding his expertise in data science to it.

Acknowledgements

• We document and share our content via a Jupyter Book which was created by Sam Lau and Chris Holdgraf with support of the UC Berkeley Data Science Education Program and the Berkeley Institute for Data Science

threathunter-playbook's Issues

Issue on page /notebooks/windows/07_discovery/WIN-190826010110.html

While reading the playbook page for Remote SCM handle failures, I noticed that while every SQL query on the page is filtering out SubjectLogonID 0x3e4, the Sigma rules appear to be inverted to only show results where SubjectLogonID=0x3e4, which from my understanding of the article seems to be backwards.

Both referenced Sigma rules are written this way: https://github.com/OTRF/ThreatHunter-Playbook/blob/master/signatures/sigma/win_scm_database_privileged_operation.yml
and https://github.com/OTRF/ThreatHunter-Playbook/blob/master/signatures/sigma/win_scm_database_handle_failure.yml

Relevant snippet:

detection:
    selection: 
        EventID: 4674
        ObjectType: 'SC_MANAGER OBJECT'
        ObjectName: 'servicesactive'
        PrivilegeList: 'SeTakeOwnershipPrivilege'
        SubjectLogonId: "0x3e4"
    condition: selection

Possible change:

detection:
    selection: 
        EventID: 4674
        ObjectType: 'SC_MANAGER OBJECT'
        ObjectName: 'servicesactive'
        PrivilegeList: 'SeTakeOwnershipPrivilege'
    filter:
        SubjectLogonId: "0x3e4"
    condition: selection and not filter

Update Navigator version

RegistryEvent Details element is not supported in Sysmon 3.40 config schema

T0000_wmimplant.xml has the following rule which is not supported:
<Details condition="is">Win32_OSRecoveryConfiguration</Details>

Due to a design flaw in the Sysmon 3.40 schema, the Details element is not supported. A viable replacement for this rule would be the following:
<TargetObject condition="contains">SYSTEM\CurrentControlSet\Control\CrashControl</TargetObject>

Issue on page /pre-hunt/data_documentation.html

Hey Roberto,

thanks for all the references!
The page mentioned above references this file, but the link is dead.

The sentence in question is "Translate useful fields to a YAML file as shown here."

Furthermore, in the section References, there is an ) too much.

Thanks again!
Matthias

Update Markdown Tables on Notebooks

executablebooks/MyST-Parser#430

IDEA - Aggregate Event IDs and Field Names used for each analytic

It would be good to have an idea of what fields and events are used the most for all analytics in the project.

Issue on page /notebooks/windows/06_credential_access/WIN-180815210510.html

Modification of query to exclude Azure sync via Azure AD Connect in hybrid environment.

Update License to MIT

Current: GPLv3
Proposed: MIT

Collaboration of the project is expanding and GPLv3 is not compatible with other ones that make it easier to collaborate.

Add OTR badge to Intro and main README

Badge:

T1185 - Man in the Browser missing from Windows Collection

Man in the Browser technique is missing from the Windows Collection Tactic column in the map. See link form ore details.

https://attack.mitre.org/wiki/Technique/T1185

T1015 - Accessibility Features - Possible Fix to Current Hunt

So I've been examining this hunt/detection and I have attempted to recreate the conditions for this hunt and while doing so I have encountered a possible incorrect logic presented in this hunt.
I may be wrong and if so I'd be happy to learn how to get the desired result.

TL: DR;
1.ParentImage OR ParentProcessName are not the Accessibility program (as suggested in the hunt), but rather the process "winlogon.exe"
2.ParentProcessName is not a field that exists in the event 4688 - "Creator Process Name" is, and only exists since Win10 according to this:
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4688

What I used:

• Windows Server 2012 R2
• Advanced Event log auditing policy (where every category and subcategory are configured to be logged)
• Sysmon-modular configs - https://github.com/olafhartong/sysmon-modular

The scenario is this:
I used IFEO to set cmd.exe as a debugger to sethc.exe, then, I used the Sticky-Keys, and other methods to invoke sethc.exe and while reviewing the logs (both Evt and Sysmon) none of them contains the had sethc.exe as a parent of cmd.exe

In addition, if those accessibility features do have a debugger set to them, The analytic proposed shouldn't work since it won't execute the accessibility program.

Am I missing something?
If you need additional details I'd be happy to provide,
looking forward to your answer,
Sahar.

Dockerfile question

Hi, just want to say I am not familiar with jupyter noebook so this is more of a question than an issue at this point. Dockerfile build was successful without errors, looks like the default is to 8888. Able to connect fine, but it just looks like a blank jupyter instance. Am I missing something, I was expecting notebooks etc to all be populated, not sure what to expect. Is there more getting started documentation?

Mordor References need to point to Security Datasets project

Mordor -> Security Datasets mapping

• Mordor project was re-branded as Security Datasets
• We point from THP to SD in the "test_data" section
• We need to update all the links with the right paths.

Issue on page /library/windows/lsa_policy_objects.html

In the Local private data objects paragraph, there are some mismatched double quotes that have put everything in italic and attached together.

Contact

Cyb3rWard0g, how can I contact you directly regarding this project?

Issues with APT 29 Free Telemetry Notebook

The URL for Decompress Dataset is incorrect, had to use the following instead.
https://github.com/OTRF/Security-Datasets/raw/master/datasets/compound/apt29/day1/apt29_evals_day1_manual.zip

Btw, great work to you and the team. Standby for heavy use of OTRF tools in upcoming revision of Gray Hat Hacking book, in Jan.

Link - Results to Page 404

In the Documentation there is a link for the standardize event fields and combine them with data dictionaries.

Here the original text:
We could easily standardize its event fields and combine them with data dictionaries as shown in here by the OSSEM project.

The Link behind "here" doesn't work anymore:
https://github.com/hunters-forge/OSSEM/blob/master/data_dictionaries/windows/sysmon/event-1.md#data-dictionary

Additional msbuild.exe detection

I believe there could be an additional item which might be easier (with potentially less noise) for bypass_whitelisting_msbuild.md.

I am thinking of Sysmon Event ID =3 with Image=msbuild.exe. My environment contains a significant amount of Event ID =1 since we work in a development environment.

In-Memory Mimikatz OverPass-The-Hash

Link for T1075_mimikatz_inmem_pth.xml is not working.

Suggesting an article to add in your post for reference

Python is a type infer language, which means we don't have to specify the type of variable in Python. Let's see how to assign a variable in python.

For more

https://techwithpie.blogspot.com/2021/08/Pythonvariables.html

You may add this link in your article. This will increase user experience.

Updated Navigator Version from 4.2 to 4.3

WARNING: Uploaded layer version (4.2) does not match Navigator's layer version (4.3).
The layer configuration may not be fully restored.

Typo In T1117_regsvr32.xml Rule

Hi CyberWard0g,

I found a typo in the T1117_regsvr32.xml rule

Line 7 C:\Windows\System\32\regsvr32.exe

should read

C:\Windows\System32\regsvr32.exe

Superb resources, HELK and ThreatHunter-Playbook, many thanks for sharing

Dave

Dead link

This resource URL is returning 404 not found: https://sqrrl.com/media/Common-Techniques-for-Hunting.pdf

Update Sigma Reference Links to Sigma Project

Several rules were created here and contributed to the Sigma project. Initially the idea was to keep the rules in this repo and at the same time contribute them to Sigma. However, we never got around to update the links to the sigma project.

Example:

• Playbook: https://threathunterplaybook.com/notebooks/windows/04_privilege_escalation/WIN-200902020333.html
• Local Sigma rule: https://github.com/OTRF/ThreatHunter-Playbook/blob/master/signatures/sigma/win_scrcons_remote_wmi_scripteventconsumer.yml
• Sigma Rule: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_scrcons_remote_wmi_scripteventconsumer.yml

Rever MordorUtils library function registerSDSQLTable to registerMordorSQLTable

MordorUtils function 'registerMordorSQLTableis still not updated toregisterSDSQLTable`

sd_file = "https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/credential_access/host/empire_dcsync_dcerpc_drsuapi_DsGetNCChanges.zip"
registerSDSQLTable(spark, sd_file, "sdTable")

Move Docs Link to the top of README

Docs link: https://threathunterplaybook.com/introduction.html

Needs to be moved to the top of the README so that it is accessible right away without scrolling through the README.

Typos in atomic Sysmon configs results in a failure to parse

There are many ProcessCreate closing tags that have a "]" in them - e.g. T0000_bitsadmin.xml

Can you please help with this query ?

SwiftOnSecurity/sysmon-config#27

Update references to OSSEM project in Pre-Hunt Activities

OSSEM is not organized by:

• OSSEM Data Dictionaries (DD)
• OSSEM Common Data Model (CDM)
• OSSEM Detection Model (DM)

The Threat Hunter Playbook is pointing to the OSSEM project only. We need to update the links to the respective GitHub sub-modules.

Remote Desktop Logon

#29

Old fashion excel heatmap

Can you still upload the file > https://github.com/Cyb3rWard0g/ThreatHunter-Playbook/blob/master/metrics/HuntTeam_HeatMap.xlsx

I still prefer this precious gem over the convoluted current Mitre ATT&CK version. Thanks.

Typo in FileCreate rule in T1138_appcompat.xml

The TargetFileName element should be TargetFilename. Changing it will allow sysmon.exe to consume the config.