[Tuning] Update DPRK ByBit Hunting Queries (#4645)
* fix * markdown generate * adding missing streamlit hunting query --------- Co-authored-by: terrancedejesus <terrance.dejesus@elastic.co> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
This commit is contained in:
Colson Wilhoit
+12
-15
@@ -1,37 +1,34 @@
|
||||
# Unsigned or Untrusted Binary Execution via Python
|
||||
# Suspcious Executable File Creation via Python
|
||||
|
||||
---
|
||||
|
||||
## Metadata
|
||||
|
||||
- **Author:** Elastic
|
||||
- **Description:** Detects the execution of unsigned or untrusted binaries where the parent process is a Python interpreter. Adversaries often use Python as a launcher to run untrusted payloads, typically dropped to locations like `/tmp`, `/Users/Shared`, or public directories. This behavior is indicative of custom loaders, malware staging, or post-exploitation actions.
|
||||
- **Description:** Detects suspicious creation of executable files by Python processes in commonly abused directories
|
||||
on macOS systems. These locations, such as /Users/Shared, /tmp, or /private/tmp, are frequently used by adversaries
|
||||
and post-exploitation frameworks to stage or drop payloads. The detection leverages the ELF or Mach-O magic bytes
|
||||
to confirm executables are written to disk.
|
||||
|
||||
- **UUID:** `9aaf1113-cf7a-4fd7-b796-f6456fdaffb5`
|
||||
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
|
||||
- **Language:** `[EQL]`
|
||||
- **Source File:** [Unsigned or Untrusted Binary Execution via Python](../queries/command_and_control_suspicious_executable_file_creation_via_python.toml)
|
||||
- **Source File:** [Suspcious Executable File Creation via Python](../queries/command_and_control_suspicious_executable_file_creation_via_python.toml)
|
||||
|
||||
## Query
|
||||
|
||||
```sql
|
||||
process where event.type == "start" and event.action == "exec" and
|
||||
(process.code_signature.trusted == false or process.code_signature.exists == false) and
|
||||
process.parent.name like~ "python*" and
|
||||
(
|
||||
process.executable like "/Users/Shared/*" or
|
||||
process.executable like "/tmp/*" or
|
||||
process.executable like "/private/tmp/*" or
|
||||
process.executable like "/Users/*/Public/*" or
|
||||
process.name like ".*"
|
||||
)
|
||||
file where event.action == "modification" and
|
||||
process.name like~ "python*" and
|
||||
file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*") and
|
||||
file.path like ("/Users/Shared/*", "/tmp/*", "/private/tmp/*", "/Users/*/Public/*") and
|
||||
not file.extension in ("dylib", "so")
|
||||
```
|
||||
|
||||
## Notes
|
||||
|
||||
- Execution of untrusted binaries from Python in shared or temporary directories is rare in normal operations.
|
||||
- Creation or modification of executable binaries in these directories is odd and rare in normal operations.
|
||||
- This hunt is useful for detecting dropper-style behavior during post-exploitation or initial access.
|
||||
- You may wish to enrich with file.hash or process.args to gain more triage context.
|
||||
|
||||
## MITRE ATT&CK Techniques
|
||||
|
||||
|
||||
+51
@@ -0,0 +1,51 @@
|
||||
# Self-Deleted Python Script Outbound Network Connection
|
||||
|
||||
---
|
||||
|
||||
## Metadata
|
||||
|
||||
- **Author:** Elastic
|
||||
- **Description:** Detects an outbound network connection by a Python script that was executed and deleted from disk. A recent DPRK
|
||||
initial access campaign used a Python script that self
|
||||
deletes and continues operating in memory.
|
||||
- **UUID:** `04d4b300-bf2f-4e86-8fab-c51502a1db32`
|
||||
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
|
||||
- **Language:** `[EQL]`
|
||||
- **Source File:** [Self-Deleted Python Script Outbound Network Connection](../queries/defense_evasion_self_deleted_python_script_outbound_network_connection.toml)
|
||||
|
||||
## Query
|
||||
|
||||
```sql
|
||||
sequence by process.entity_id with maxspan=10s
|
||||
[file where event.action == "deletion" and file.extension in ("py", "pyc") and process.name like~ "python*"]
|
||||
[network where event.type == "start" and
|
||||
not cidrmatch(destination.ip,
|
||||
"240.0.0.0/4", "233.252.0.0/24", "224.0.0.0/4", "198.19.0.0/16", "192.18.0.0/15",
|
||||
"192.0.0.0/24", "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
|
||||
"192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24",
|
||||
"100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24",
|
||||
"::1", "FE80::/10", "FF00::/8")]
|
||||
```
|
||||
|
||||
## Notes
|
||||
|
||||
- This hunt identifies a deleted Python script followed immediately followed by external network activity from the same process.
|
||||
- Outbound connection filtering avoids internal IPs and infrastructure — can be tuned to your network space.
|
||||
|
||||
## MITRE ATT&CK Techniques
|
||||
|
||||
- [T1059.006](https://attack.mitre.org/techniques/T1059/006)
|
||||
- [T1105](https://attack.mitre.org/techniques/T1105)
|
||||
- [T1070.004](https://attack.mitre.org/techniques/T1070/004)
|
||||
|
||||
## References
|
||||
|
||||
- https://www.elastic.co/security-labs/dprk-code-of-conduct
|
||||
- https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/
|
||||
- https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34
|
||||
- https://x.com/safe/status/1897663514975649938
|
||||
- https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/
|
||||
|
||||
## License
|
||||
|
||||
- `Elastic License v2`
|
||||
+12
-15
@@ -1,31 +1,28 @@
|
||||
[hunt]
|
||||
author = "Elastic"
|
||||
name = "Unsigned or Untrusted Binary Execution via Python"
|
||||
name = "Suspcious Executable File Creation via Python"
|
||||
uuid = "9aaf1113-cf7a-4fd7-b796-f6456fdaffb5"
|
||||
description = """
|
||||
Detects the execution of unsigned or untrusted binaries where the parent process is a Python interpreter. Adversaries often use Python as a launcher to run untrusted payloads, typically dropped to locations like `/tmp`, `/Users/Shared`, or public directories. This behavior is indicative of custom loaders, malware staging, or post-exploitation actions.
|
||||
Detects suspicious creation of executable files by Python processes in commonly abused directories
|
||||
on macOS systems. These locations, such as /Users/Shared, /tmp, or /private/tmp, are frequently used by adversaries
|
||||
and post-exploitation frameworks to stage or drop payloads. The detection leverages the ELF or Mach-O magic bytes
|
||||
to confirm executables are written to disk.
|
||||
"""
|
||||
integration = ["endpoint"]
|
||||
language = ["EQL"]
|
||||
license = "Elastic License v2"
|
||||
mitre = ["T1059.006", "T1105"]
|
||||
notes = [
|
||||
"Execution of untrusted binaries from Python in shared or temporary directories is rare in normal operations.",
|
||||
"This hunt is useful for detecting dropper-style behavior during post-exploitation or initial access.",
|
||||
"You may wish to enrich with file.hash or process.args to gain more triage context."
|
||||
"Creation or modification of executable binaries in these directories is odd and rare in normal operations.",
|
||||
"This hunt is useful for detecting dropper-style behavior during post-exploitation or initial access."
|
||||
]
|
||||
query = [
|
||||
'''
|
||||
process where event.type == "start" and event.action == "exec" and
|
||||
(process.code_signature.trusted == false or process.code_signature.exists == false) and
|
||||
process.parent.name like~ "python*" and
|
||||
(
|
||||
process.executable like "/Users/Shared/*" or
|
||||
process.executable like "/tmp/*" or
|
||||
process.executable like "/private/tmp/*" or
|
||||
process.executable like "/Users/*/Public/*" or
|
||||
process.name like ".*"
|
||||
)
|
||||
file where event.action == "modification" and
|
||||
process.name like~ "python*" and
|
||||
file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*") and
|
||||
file.path like ("/Users/Shared/*", "/tmp/*", "/private/tmp/*", "/Users/*/Public/*") and
|
||||
not file.extension in ("dylib", "so")
|
||||
'''
|
||||
]
|
||||
references = [
|
||||
|
||||
+36
@@ -0,0 +1,36 @@
|
||||
[hunt]
|
||||
author = "Elastic"
|
||||
name = "Self-Deleted Python Script Outbound Network Connection"
|
||||
uuid = "04d4b300-bf2f-4e86-8fab-c51502a1db32"
|
||||
description = """
|
||||
Detects an outbound network connection by a Python script that was executed and deleted from disk. A recent DPRK
|
||||
initial access campaign used a Python script that self
|
||||
deletes and continues operating in memory."""
|
||||
integration = ["endpoint"]
|
||||
language = ["EQL"]
|
||||
license = "Elastic License v2"
|
||||
mitre = ["T1059.006", "T1105", "T1070.004"]
|
||||
notes = [
|
||||
"This hunt identifies a deleted Python script followed immediately followed by external network activity from the same process.",
|
||||
"Outbound connection filtering avoids internal IPs and infrastructure — can be tuned to your network space."
|
||||
]
|
||||
query = [
|
||||
'''
|
||||
sequence by process.entity_id with maxspan=10s
|
||||
[file where event.action == "deletion" and file.extension in ("py", "pyc") and process.name like~ "python*"]
|
||||
[network where event.type == "start" and
|
||||
not cidrmatch(destination.ip,
|
||||
"240.0.0.0/4", "233.252.0.0/24", "224.0.0.0/4", "198.19.0.0/16", "192.18.0.0/15",
|
||||
"192.0.0.0/24", "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
|
||||
"192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24",
|
||||
"100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24",
|
||||
"::1", "FE80::/10", "FF00::/8")]
|
||||
'''
|
||||
]
|
||||
references = [
|
||||
"https://www.elastic.co/security-labs/dprk-code-of-conduct",
|
||||
"https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/",
|
||||
"https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34",
|
||||
"https://x.com/safe/status/1897663514975649938",
|
||||
"https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/"
|
||||
]
|
||||
Reference in New Issue
Block a user