diff --git a/data_sources/windows_event_log_defender_1116.yml b/data_sources/windows_event_log_defender_1116.yml new file mode 100644 index 0000000000..9b02654eb1 --- /dev/null +++ b/data_sources/windows_event_log_defender_1116.yml @@ -0,0 +1,89 @@ +name: Windows Event Log Defender 1116 +id: 588d6a99-14eb-4061-aec3-55cc54d11d6b +version: 1 +creation_date: '2026-08-17' +modification_date: '2026-08-17' +author: Onur Mustafa Erdogan, Splunk +description: Logs an event when a Windows Defender detects a malware or potentially unwanted software. +mitre_components: + - Application Log Content + - Host Status + - Process Creation +source: WinEventLog:Microsoft-Windows-Windows Defender/Operational +sourcetype: XmlWinEventLog +separator: EventCode +separator_value: '1116' +supported_TA: + - name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 11.0.2 +fields: + - _time + - Action_ID + - Action_Name + - ActivityID + - Additional_Actions_ID + - Additional_Actions_String + - Category_ID + - Category_Name + - Channel + - Computer + - Detection_ID + - Detection_Time + - Detection_User + - dvc + - dvc_nt_host + - Engine_Version + - Error_Code + - Error_Description + - event_id + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - eventtype + - Execution_ID + - Execution_Name + - FWLink + - Guid + - id + - Keywords + - Level + - Name + - Opcode + - Origin_ID + - Origin_Name + - Path + - Post_Clean_Status + - Pre_Execution_Status + - Process_Name + - ProcessID + - Product_Name + - Product_Version + - RecordNumber + - Security_intelligence_Version + - severity + - Severity_ID + - severity_id + - Severity_Name + - signature_id + - Source_ID + - Source_Name + - splunk_server + - State + - Status_Code + - System_Props_Xml + - SystemTime + - tag + - Task + - TaskCategory + - ThreadID + - Threat_ID + - Threat_Name + - Type_ID + - Type_Name + - user_id + - UserID + - vendor_product + - Version +example_log: "111603000x80000000000000001799Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0111UserUnknownEC2AMAZ-FKEOM7G\\Administratorcontainerfile:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN; file:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN->eicar.com2Network share0Unknown0Concrete09Not Applicable0x00000000The operation completed successfully. 00No additional actions requiredAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7" diff --git a/data_sources/windows_event_log_defender_1117.yml b/data_sources/windows_event_log_defender_1117.yml new file mode 100644 index 0000000000..4eee9d4d80 --- /dev/null +++ b/data_sources/windows_event_log_defender_1117.yml @@ -0,0 +1,93 @@ +name: Windows Event Log Defender 1117 +id: c620d5f3-53d6-4697-abf5-b2c8434e7ff9 +version: 1 +creation_date: '2026-08-17' +modification_date: '2026-08-17' +author: Onur Mustafa Erdogan, Splunk +description: Logs an event when a Windows Defender takes an action against detected threat. +mitre_components: + - Application Log Content + - Host Status + - Process Creation +source: WinEventLog:Microsoft-Windows-Windows Defender/Operational +sourcetype: XmlWinEventLog +separator: EventCode +separator_value: '1117' +supported_TA: + - name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 11.0.2 +fields: + - _time + - Action_Name + - ActivityID + - Additional_Actions_ID + - Additional_Actions_String + - Category_ID + - Category_Name + - Channel + - Computer + - Detection_ID + - Detection_Time + - Detection_User + - dvc + - dvc_nt_host + - Engine_Version + - Error_Code + - Error_Description + - event_id + - EventAction_ID + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - eventtype + - Execution_ID + - Execution_Name + - FWLink + - Guid + - host + - id + - Keywords + - Level + - Name + - Opcode + - Origin_ID + - Origin_Name + - Path + - Post_Clean_Status + - Pre_Execution_Status + - Process_Name + - ProcessID + - Product_Name + - Product_Version + - RecordNumber + - Remediation_User + - Security_intelligence_Version + - severity + - Severity_ID + - severity_id + - Severity_Name + - signature_id + - source + - Source_ID + - Source_Name + - sourcetype + - splunk_server + - State + - Status_Code + - System_Props_Xml + - SystemTime + - tag + - Task + - TaskCategory + - ThreadID + - Threat_ID + - Threat_Name + - Type_ID + - Type_Name + - user_id + - UserID + - vendor_product + - Version +example_log: "111704000x80000000000000001800Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0321UserUnknownEC2AMAZ-FKEOM7G\\Administratorcontainerfile:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN; file:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN->eicar.com2Network share0Unknown0Concrete02Quarantine0x00000000The operation completed successfully. 00No additional actions requiredEC2AMAZ-FKEOM7G\\AdministratorAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7" diff --git a/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml b/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml new file mode 100644 index 0000000000..bd2877700b --- /dev/null +++ b/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml @@ -0,0 +1,83 @@ +name: Windows Alternate Data Stream Created Over Local Share +id: e974a5c9-cbe9-4b4a-8fba-b55e7dbc8259 +version: 1 +creation_date: '2026-08-19' +modification_date: '2026-08-19' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the creation of an NTFS alternate data stream (ADS) accessed over a local administrative share targeting the loopback address (127.0.0.1). + It leverages Windows Security Event Logs with EventCode 5145 to identify this activity. + Legitimate local processes access files directly rather than through a local SMB share. + This behavior is a hallmark of the ShieldBreak exploit, which abuses a symbolic link swap through a loopback share to redirect a privileged, Defender-driven write into an alternate data stream on a system-owned file, ultimately landing attacker content in C:\Windows\System32. + If confirmed malicious, this activity indicates an in-progress local privilege escalation attempt and should be investigated immediately. +data_source: + - Windows Event Log Security 5145 +search: |- + `wineventlog_security` + EventCode=5145 + IpAddress="127.0.0.1" + ObjectType="File" + | regex RelativeTargetName="(?i)\:\w+$" + | fillnull + | rename IpAddress as dest_ip + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest dest_ip + ShareName ShareLocalPath RelativeTargetName + AccessMask src_user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_alternate_data_stream_created_over_local_share_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Windows Security Event Logs with EventCode 5145 enabled. + The Windows TA is also required. + Enable Object Access auditing (success/failure) for File Share in group policy so that RelativeTargetName and IpAddress are populated. +known_false_positives: |- + Backup, replication, or file-sync software may occasionally write alternate data streams over administrative shares. + Loopback (127.0.0.1) access to a local share is rare for legitimate software, tune by ShareName or src_user as needed for your environment. +references: + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: An alternate data stream $RelativeTargetName$ was created over a loopback local share on $dest$ +threat_objects: + - field: dest + type: system + - field: RelativeTargetName + type: file_path + - field: src_user + type: user +analytic_story: + - RoguePlanet +asset_type: Endpoint +mitre_attack_id: + - T1564.004 + - T1021.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/ShieldBreak/ads_over_local_share.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml b/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml index f34db56778..59e7b20e37 100644 --- a/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml +++ b/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml @@ -1,8 +1,8 @@ name: Windows App Layer Protocol Wermgr Connect To NamedPipe id: 2f3a4092-548b-421c-9caa-84918e1787ef -version: 10 +version: 11 creation_date: '2022-10-28' -modification_date: '2026-05-13' +modification_date: '2026-08-18' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -33,6 +33,8 @@ intermediate_findings: message: wermgr.exe process is creating or connecting to a named pipe $PipeName$ on $dest$ analytic_story: - Qakbot + - RoguePlanet + - Windows Error Reporting Service Elevation of Privilege Vulnerability asset_type: Endpoint mitre_attack_id: - T1071 diff --git a/detections/endpoint/windows_defender_mpclient_dll_loaded_by_non_defender_process.yml b/detections/endpoint/windows_defender_mpclient_dll_loaded_by_non_defender_process.yml new file mode 100644 index 0000000000..d4ff791a7e --- /dev/null +++ b/detections/endpoint/windows_defender_mpclient_dll_loaded_by_non_defender_process.yml @@ -0,0 +1,86 @@ +name: Windows Defender MpClient.dll Loaded by Non-Defender Process +id: 20f72601-2a92-47bc-8776-177671bbe189 +version: 1 +creation_date: '2026-08-19' +modification_date: '2026-08-19' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects mpclient.dll, the Windows Defender client API library, being loaded by a process that is not part of the Windows Defender platform. + mpclient.dll exposes the API surface used to drive on-demand Defender scans (IOAV, MpScan). In the ShieldBreak exploit, the attacker binary loads mpclient.dll directly and calls its scan APIs against an object-manager path in order to trigger a Defender scan against attacker-controlled content as part of a race condition targeting Defender's placeholder-hydration behavior. + If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender's own scanning pipeline for local privilege escalation. +data_source: + - Sysmon EventID 7 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + from datamodel=Endpoint.Processes where + + Processes.loaded_file="mpclient.dll" + NOT Processes.user IN ("* SERVICE", "SYSTEM") + NOT Processes.process_path="*\MpCmdRun.exe" + Processes.process_path IN ( + "*:\\AppData\\Local\\Temp\\*", + "*:\\Perflogs\\*", + "*:\\ProgramData\\*", + "*:\\Temp\\*", + "*:\\Users\\*", + "*:\\Windows\\Tasks\\*" + ) + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.loaded_file Processes.process + Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_defender_mpclient_dll_loaded_by_non_defender_process_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting logs with the driver/module loaded from your endpoints. + If you are using Sysmon, configuration must explicitly include image loading events targeting mpclient.dll. +known_false_positives: |- + Third-party security products or custom AV-integration tooling that legitimately calls into the Defender client API may load mpclient.dll outside the Defender platform directories. Filter as necessary for your environment. +references: + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: The [$loaded_file$] DLL was loaded by a suspicious process [$process_path$] on [$dest$] +threat_objects: + - field: process_path + type: file_path +analytic_story: + - RoguePlanet +asset_type: Endpoint +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/ShieldBreak/mpclient_dll_loaded.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_defender_threat_detected_on_kernel_object_path.yml b/detections/endpoint/windows_defender_threat_detected_on_kernel_object_path.yml new file mode 100644 index 0000000000..023f83d6a9 --- /dev/null +++ b/detections/endpoint/windows_defender_threat_detected_on_kernel_object_path.yml @@ -0,0 +1,76 @@ +name: Windows Defender Threat Detected on Kernel Object Path +id: 702631e8-90ce-43db-90fd-cf0228edc8ad +version: 1 +creation_date: '2026-08-17' +modification_date: '2026-08-18' +author: Onur Mustafa Erdogan, Splunk +status: production +type: TTP +description: |- + The following analytic detects a Windows Defender malware detection or remediation event where the scanned path resolves through the NT object manager namespace (\globalroot\). + It leverages Windows Defender Operational log EventCodes 1116 and 1117 to identify this activity. + In the ShieldBreak exploit, this is how Defender is coerced into hydrating a cloud file placeholder and copying attacker content through a symbolic link chain that ultimately writes into C:\Windows\System32. + If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender's own scanning pipeline for local privilege escalation. +data_source: + - Windows Event Log Defender 1116 + - Windows Event Log Defender 1117 +search: |- + `ms_defender` + EventCode IN (1116, 1117) + Path="*\\globalroot\\*" + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + values(EventCode) as EventCode + values(Action_Name) as Action_Name + values(Additional_Actions_String) as Additional_Actions_String + values(FWLink) as FWLink + by dvc Detection_User Path Threat_Name Severity_Name Category_Name + | rename dvc as dest, Detection_User as user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_defender_threat_detected_on_kernel_object_path_filter` +how_to_implement: |- + The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line, via the Splunk Add-on for Microsoft Windows. Ensure the Microsoft-Windows-Windows Defender/Operational channel is being collected so that EventCode 1116 (detection) and 1117 (remediation) events are ingested. +known_false_positives: |- + No false positives have been identified at this time. Legitimate Defender scans do not report detections against paths resolved through the NT object manager namespace. +references: + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Windows Defender reported a detection on a kernel object path $Path$ on $dest$ + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: Path + type: file_path +analytic_story: + - RoguePlanet +asset_type: Endpoint +mitre_attack_id: + - T1068 + - T1211 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/ShieldBreak/defender_kernel_object.log + source: XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_error_report_created_in_reportqueue_manually.yml b/detections/endpoint/windows_error_report_created_in_reportqueue_manually.yml new file mode 100644 index 0000000000..23ce74f162 --- /dev/null +++ b/detections/endpoint/windows_error_report_created_in_reportqueue_manually.yml @@ -0,0 +1,84 @@ +name: Windows Error Report Created in ReportQueue Manually +id: c3b33d42-dd28-41bc-8abd-407654a5c9bc +version: 1 +creation_date: '2026-08-17' +modification_date: '2026-08-18' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects a .wer file being written into the Windows Error Reporting ReportQueue directory by a process other than the standard error-reporting binaries. + Windows Error Reporting normally populates ReportQueue only through werfault.exe, werfaultsecure.exe, or wermgr.exe following an actual application crash. + In the ShieldBreak exploit, the attacker fabricates a .wer report directly and manually invokes the QueueReporting scheduled task, which causes wermgr.exe to process the report and load an attacker-planted phantom DLL at SYSTEM integrity. + If confirmed malicious, this activity indicates preparation for a local privilege escalation attempt abusing Windows Error Reporting. +data_source: + - Sysmon EventID 11 +search: |- + `sysmon` + EventCode=11 + action IN ("created","modified") + file_name="*.wer" + file_path="*\\ReportQueue\\*" + NOT process_path IN ( + "*\\svchost.exe", + "*\\werfault.exe", + "*\\werfaultsecure.exe", + "*\\wermgr.exe" + ) + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest file_name file_path file_hash action + process_name process_path process_id user vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_error_report_created_in_reportqueue_manually_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting logs with file creation events from your endpoints. If you are using Sysmon, you must have EventID 11 (FileCreate) enabled, and the FileCreate section of the configuration must include TargetFilename paths ending in .wer or containing ReportQueue, since these are commonly excluded by default configurations. +known_false_positives: |- + Crash-reporting or telemetry agents that integrate with Windows Error Reporting may stage .wer files outside the standard WER binaries. Tune by Image as necessary for your environment. +references: + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet + - https://isc.sans.edu/diary/22536 +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 40 + message: A suspicious process [$process_name$] created a Windows Error Reporting report [$file_path$] on [$dest$] +threat_objects: + - field: process_name + type: process_name + - field: file_path + type: file_path +analytic_story: + - RoguePlanet + - Windows Privilege Escalation + - Windows Error Reporting Service Elevation of Privilege Vulnerability +asset_type: Endpoint +mitre_attack_id: + - T1068 + - T1053.005 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/ShieldBreak/wer_file_creation.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_phantom_dll_created_on_disk.yml b/detections/endpoint/windows_phantom_dll_created_on_disk.yml new file mode 100644 index 0000000000..d953b9f1e6 --- /dev/null +++ b/detections/endpoint/windows_phantom_dll_created_on_disk.yml @@ -0,0 +1,111 @@ +name: Windows Phantom DLL Created on Disk +id: 34cb2dfb-1dec-4b6b-bc72-c3904e5e4521 +version: 2 +creation_date: '2026-08-17' +modification_date: '2026-08-20' +author: Onur Mustafa Erdogan, Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + The following analytic detects creation of DLL files with names associated with phantom DLL hijacking opportunities. + These DLLs are usually absent from standard Windows installations, but legitimate Windows components or services may attempt to load them when they are present in expected search paths such as System32. + Phantom DLL hijacking involves placing a malicious DLL where a legitimate process will search for a non-existent dependency, allowing the attacker-controlled library to execute in that process context. + ShieldBreak is one example where the exploit redirects a privileged Defender-driven write into C:\Windows\System32\phoneinfo.dll and then triggers Windows Error Reporting so wermgr.exe loads the planted DLL at SYSTEM integrity. + If confirmed malicious, this activity can indicate preparation for code execution, persistence, or local privilege escalation through DLL search order hijacking. +data_source: + - Sysmon EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + from datamodel=Endpoint.Filesystem where + + Filesystem.action IN ("created","modified") + + Filesystem.file_path IN ( + "*:\\Windows\\System32\\axeonoffhelper.dll", + "*:\\Windows\\System32\\cdpsgshims.dll", + "*:\\Windows\\System32\\oci.dll", + "*:\\Windows\\System32\\offdmpsvc.dll", + "*:\\Windows\\System32\\shellchromeapi.dll", + "*:\\Windows\\System32\\TSMSISrv.dll", + "*:\\Windows\\System32\\TSVIPSrv.dll", + "*:\\Windows\\System32\\wbem\\wbemcomn.dll", + "*:\\Windows\\System32\\WLBSCTRL.dll", + "*:\\Windows\\System32\\wow64log.dll", + "*:\\Windows\\System32\\WptsExtensions.dll", + "*\\phoneinfo.dll", + "*\\SprintCSP.dll" + ) + by Filesystem.action Filesystem.dest Filesystem.file_hash + Filesystem.file_name Filesystem.file_path Filesystem.process_id + Filesystem.user Filesystem.vendor_product + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_phantom_dll_created_on_disk_filter` +how_to_implement: |- + To successfully implement this search, you need file creation telemetry from Windows endpoints mapped into the Endpoint.Filesystem datamodel. + If you are using Sysmon, enable EventID 11 and ensure the FileCreate configuration captures the full target filename for DLL creations in Windows system paths. +known_false_positives: |- + Some legacy or third-party components may create DLLs with these names for legitimate compatibility reasons, but creation in Windows system paths should be uncommon. + Review the creating process, signer, file hash, path, and whether the DLL is expected on the host before tuning. +references: + - http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html + - https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/ + - https://decoded.avast.io/martinchlumecky/png-steganography/ + - https://github.com/blackarrowsec/redteam-research/tree/26e6fc0c0d30d364758fa11c2922064a9a7fd309/LPE%20via%20StorSvc + - https://github.com/Wh04m1001/SysmonEoP + - https://itm4n.github.io/cdpsvc-dll-hijacking/ + - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992 + - https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/ + - https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/ + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/ + - https://www.hexacorn.com/blog/2016/06/02/beyond-good-ol-run-key-part-40/ + - https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/ + - https://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/ + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet + - https://x.com/0gtweet/status/1564131230941122561 +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: A phantom DLL candidate named [$file_name$] was created at [$file_path$] on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: file_name + type: file_name + - field: file_path + type: file_path +analytic_story: + - RoguePlanet + - Windows Privilege Escalation + - Windows Defense Evasion Tactics +asset_type: Endpoint +mitre_attack_id: + - T1574.001 + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/ShieldBreak/phoneinfo_dll_created.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_process_injection_wermgr_child_process.yml b/detections/endpoint/windows_process_injection_wermgr_child_process.yml index 66f47b2066..14dce5c439 100644 --- a/detections/endpoint/windows_process_injection_wermgr_child_process.yml +++ b/detections/endpoint/windows_process_injection_wermgr_child_process.yml @@ -1,8 +1,8 @@ name: Windows Process Injection Wermgr Child Process id: 360ae6b0-38b5-4328-9e2b-bc9436cddb17 -version: 11 +version: 12 creation_date: '2022-10-27' -modification_date: '2026-05-13' +modification_date: '2026-08-18' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -49,6 +49,7 @@ intermediate_findings: analytic_story: - Qakbot - Windows Error Reporting Service Elevation of Privilege Vulnerability + - RoguePlanet asset_type: Endpoint mitre_attack_id: - T1055 diff --git a/detections/endpoint/windows_wermgr_spawning_system_integrity_process.yml b/detections/endpoint/windows_wermgr_spawning_system_integrity_process.yml new file mode 100644 index 0000000000..61822ae203 --- /dev/null +++ b/detections/endpoint/windows_wermgr_spawning_system_integrity_process.yml @@ -0,0 +1,90 @@ +name: Windows Wermgr Spawning System Integrity Process +id: d39634c8-7ce7-4503-a5da-73ca3c758fb9 +version: 1 +creation_date: '2026-08-17' +modification_date: '2026-08-18' +author: Onur Mustafa Erdogan, Splunk +status: production +type: TTP +description: |- + The following analytic detects WerMgr.exe (Windows Error Reporting) spawning a child process running at SYSTEM integrity level. + WerMgr.exe normally runs at the integrity level of the reporting user or as a background SYSTEM-owned service that does not launch interactive children. + In the ShieldBreak exploit, WerMgr.exe is manually triggered via the QueueReporting scheduled task and loads an attacker-planted phantom DLL (phoneinfo.dll), which then spawns an elevated shell. + If confirmed malicious, this activity indicates successful local privilege escalation to SYSTEM. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.parent_process_name="WerMgr.exe" + ( + Processes.process_integrity_level="System" + OR + Processes.user IN ("*$", "System") + ) + + by Processes.action Processes.dest Processes.parent_process_name Processes.parent_process_path + Processes.parent_process Processes.parent_process_id Processes.process_name + Processes.process_path Processes.process Processes.process_id Processes.process_hash + Processes.process_integrity_level Processes.user Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_wermgr_spawning_system_integrity_process_filter` +how_to_implement: |- + This detection is based on Process creation events. Make sure you are ingesting logs that contain parent process details and fields that indicate privilege level, such as user name or integrity level. If you are using Sysmon, make sure to enable logging of child processes of WerMgr.exe. +known_false_positives: |- + No false positives have been identified at this time. + WerMgr.exe spawning a SYSTEM-integrity child process is not expected under normal Windows Error Reporting operation. +references: + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet + - https://isc.sans.edu/diary/22536 +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: The [$parent_process_name$] process spawned [$process_name$] running at SYSTEM integrity level on $dest$ + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process + type: process + - field: process_name + type: process_name +analytic_story: + - RoguePlanet + - Windows Privilege Escalation + - Windows Error Reporting Service Elevation of Privilege Vulnerability +asset_type: Endpoint +mitre_attack_id: + - T1068 + - T1134.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/ShieldBreak/system_integrity_process.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/stories/rogueplanet.yml b/stories/rogueplanet.yml index 5ad81b0574..d050586cbc 100644 --- a/stories/rogueplanet.yml +++ b/stories/rogueplanet.yml @@ -1,9 +1,9 @@ name: RoguePlanet id: eafb5ab2-71bb-4da9-a541-015d002f01f1 -version: 1 +version: 2 creation_date: '2026-06-11' -modification_date: '2026-06-11' -author: Teoderick Contreras, Splunk +modification_date: '2026-08-17' +author: Teoderick Contreras, Onur Mustafa Erdogan, Splunk status: production description: |- RoguePlanet is a publicly released proof-of-concept exploit targeting a race condition in Microsoft Windows Defender. The attack abuses Defender scanning behavior, NTFS alternate data streams, virtual ISO mounting, volume shadow copy paths, and opportunistic oplocks to achieve local privilege escalation to SYSTEM. @@ -17,13 +17,22 @@ narrative: | From a detection standpoint, the most durable observables are Sysmon Event ID 15 records showing :WDFOO alternate data streams on wermgr.exe under RP_* temp directories, MsMpEng.exe touching those same paths, and the initial RoguePlanet.exe process writing ADS content. Secondary signals include creation of RP_* directories, virtual disk attach activity, reparse-point manipulation, and a user-context process later spawning SYSTEM-integrity children. - This analytic story groups detections that surface alternate data stream abuse, suspicious Defender-adjacent file activity, and privilege escalation patterns consistent with RoguePlanet and similar Windows Defender bypass research. Security teams should treat any matching activity as high priority, validate patch and Defender configuration status, and isolate affected endpoints pending vendor guidance. + ShieldBreak is a related proof-of-concept published by NightmareEclipse that exploits the same underlying weakness in Defender's scanning pipeline, targeting Windows Server 2025 rather than client builds. A low-privileged executable creates a working directory under C:\ShieldBreak_{GUID}\, registers a fake cloud storage provider, and creates a cloud file placeholder named BERLIN with a stream ADS. It loads mpclient.dll, Defender's own client API library, and directs Defender to scan a path resolved through the object manager under \BaseNamedObjects\Restricted\, hydrating the placeholder on demand. + + ShieldBreak wins its race through symbolic link manipulation rather than oplocks: an object-manager symlink initially resolves the scan target to the working directory, then is swapped to resolve through a CLFS path so that a locked Defender artifact file (BERLIN.blf) is produced instead. A second symbolic link, created over a local administrative share targeting 127.0.0.1, redirects that locked file to \Windows\System32\phoneinfo.dll, so the subsequent hydration writes the attacker's payload directly into a privileged system directory. The exploit then fabricates a Windows Error Report under the WER ReportQueue directory and manually executes the QueueReporting scheduled task, causing wermgr.exe to load phoneinfo.dll -- a classic phantom-DLL hijack target -- which steals a SYSTEM token and spawns an elevated shell. + + This analytic story groups detections that surface alternate data stream abuse, suspicious Defender-adjacent file and module-load activity, Windows Error Reporting abuse, and privilege escalation patterns consistent with RoguePlanet, ShieldBreak, and similar Windows Defender bypass research. Security teams should treat any matching activity as high priority, validate patch and Defender configuration status, and isolate affected endpoints pending vendor guidance. references: - https://github.com/MSNightmare/RoguePlanet/tree/main - https://attack.mitre.org/techniques/T1068/ - https://attack.mitre.org/techniques/T1564/004/ - https://attack.mitre.org/techniques/T1211/ - https://car.mitre.org/analytics/CAR-2020-08-001/ + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.picussecurity.com/resource/blog/rogueplanet-anatomy-of-the-nightmare-eclipse-microsoft-defender-zero-day#from-rce-to-lpe:-the-smb-and-vhdx-origin-story + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet + - https://www.hexacorn.com/blog/2016/06/02/beyond-good-ol-run-key-part-40/ + - https://secret.club/2020/07/01/diagtrack.html category: - Adversary Tactics product: